Mirai_ptea Botnet利用KGUARD DVR未公开漏洞报告
<!--kg-card-begin: markdown--><h1 id="">版权</h1>
<p>版权声明：本文为Netlab原创，依据 <a href="https://creativecommons.org/licenses/by-sa/4.0/">CC BY-SA 4.0</a> 许可证进行授权，转载请附上出处链接及本声明。</p>
<h1 id="">概述</h1>
<p>2021-06-22我们检测到一个我们命名为<code>mirai_ptea</code>的mirai变种样本通过未知漏洞传播。经过分析，该漏洞为<a href="https://www.kguard.com.tw/">KGUARD DVR</a>未公开的漏洞。从我们的分析看该漏洞存在于2016年的固件版本中。我们能找到的2017年之后的固件厂家均已经修复该漏洞。有意思的是，一天以后，6月23日，我们收到安全社区的询问，咨询我们是否看到一种新的DDoS攻击botnet。交叉对比线索，居然就是我们刚发现的这个botnet，目前看。这个僵尸网络处于活跃的攻击状态(见最后)。</p>
<h2 id="">时间线</h2>
<ul>
<li>2021-03-22 我们历史数据首次观察到针对该漏洞的探测扫描</li>
<li>2021-06-22 我们观察到mirai_ptea样本利用该漏洞传播</li>
<li>2021-06-23 我们收到安全社区的询问是否看到一种新的DDoS攻击botnet</li>
<li>2021-06-25 我们观察到mirai_aurora样本利用该漏洞传播</li>
</ul>
<h1 id="">漏洞分析</h1>
<p>鉴于我们并未发现该漏洞的公开资料，为防止该漏洞被滥用，此处我们将隐藏部分关键信息。</p>
<p>KGUARD DVR 2016年的固件上的<code>***</code>程序监听在<code>0.0.0.0</code>的<code>*****</code>端口无需认证即可远程执行系统命令。 最新的固件中厂家通过修改监听地址为<code>127.0.0.1</code>修复了该漏洞。部分利用payload如下：<br>
<img src="__GHOST_URL__/content/images/2021/07/mirai_ptea_xx_exp_p.png" alt="mirai_ptea_xx_exp_p" loading="lazy"></p>
<h2 id="">受影响设备分析</h2>
<p>通过探测我们发现至少3千左右的在线设备依然存在该漏洞。已知仍然受影响设备如下:</p>
<table>
<thead>
<tr>
<th>DeviceType</th>
<th>ProductType</th>
<th>HardVersion</th>
<th>DefDeviceName</th>
</tr>
</thead>
<tbody>
<tr>
<td>D1004NR</td>
<td>DVR4-1600</td>
<td>DM-268A</td>
<td>DVR4-1600</td>
</tr>
<tr>
<td>D1004NR</td>
<td>HY-DVR</td>
<td>DM-268</td>
<td>720P-HY04N</td>
</tr>
<tr>
<td>D1004NR</td>
<td>HY-DVR</td>
<td>DM-268A</td>
<td>720P-HY04N</td>
</tr>
<tr>
<td>D1004NR</td>
<td>HY-DVR</td>
<td>DM-274</td>
<td>720P-HY04N</td>
</tr>
<tr>
<td>D1004NR</td>
<td>HY-DVR</td>
<td>DM-274B</td>
<td>720P-HY04N</td>
</tr>
<tr>
<td>D1004NR</td>
<td>NHDR</td>
<td>DM-274</td>
<td>NHDR-3204AHD</td>
</tr>
<tr>
<td>D1004NR</td>
<td>RL-AHD4n</td>
<td>DM-268</td>
<td>720P-HY04N</td>
</tr>
<tr>
<td>D1008NR</td>
<td>1093/508N-DVRBM08H</td>
<td>DM-292</td>
<td>720P-HY08N</td>
</tr>
<tr>
<td>D1008NR</td>
<td>DVR8-1600</td>
<td>DM-298</td>
<td>DVR8-1600</td>
</tr>
<tr>
<td>D1008NR</td>
<td>DVR8-HDA10L</td>
<td>DM-292</td>
<td>DVR8-HDA10L</td>
</tr>
<tr>
<td>D1008NR</td>
<td>HD881</td>
<td>DM-292</td>
<td>HD881</td>
</tr>
<tr>
<td>D1008NR</td>
<td>HY-DVR</td>
<td>DM-292</td>
<td>720P-HY08N</td>
</tr>
<tr>
<td>D1008NR</td>
<td>HY-DVR</td>
<td>DM-298</td>
<td>720P-HY08N</td>
</tr>
<tr>
<td>D1008NR</td>
<td>NHDR</td>
<td>DM-298</td>
<td>NHDR-3208AHD</td>
</tr>
<tr>
<td>D1008NR</td>
<td>RL-AHD8n</td>
<td>DM-292</td>
<td>720P-HY08N</td>
</tr>
<tr>
<td>D1016NR</td>
<td>DVR16-HDA10L</td>
<td>DM-303</td>
<td>DVR16-HDA10L</td>
</tr>
<tr>
<td>D1016NR</td>
<td>HD1681</td>
<td>DM-303</td>
<td>HD1681</td>
</tr>
<tr>
<td>D1016NR</td>
<td>HY-DVR</td>
<td>DM-303A</td>
<td>720P-HY16N</td>
</tr>
<tr>
<td>D1016NR</td>
<td>HY-DVR</td>
<td>DM-310</td>
<td>720P-HY16N</td>
</tr>
<tr>
<td>D1016NR</td>
<td>HY-DVR</td>
<td>DM-310A</td>
<td>720P-HY16N</td>
</tr>
<tr>
<td>D1016NR</td>
<td>NHDR</td>
<td>DM-310</td>
<td>NHDR-3216AHD</td>
</tr>
<tr>
<td>D1016NR</td>
<td>RL-MHD16n(21A)</td>
<td>DM-310A</td>
<td>720P-HY16N</td>
</tr>
<tr>
<td>D1104</td>
<td>HY-DVR</td>
<td>DM-290A</td>
<td>1080P-HY04</td>
</tr>
<tr>
<td>D1104</td>
<td>NHDR</td>
<td>DM-307</td>
<td>NHDR-5304AHD</td>
</tr>
<tr>
<td>D1104NR</td>
<td>HD1T4</td>
<td>DM-291A</td>
<td>1080P-04</td>
</tr>
<tr>
<td>D1104NR</td>
<td>HD481</td>
<td>DM-291</td>
<td>HD481</td>
</tr>
<tr>
<td>D1104NR</td>
<td>HRD-E430L</td>
<td>DM-291A</td>
<td>HRD-E430L</td>
</tr>
<tr>
<td>D1104NR</td>
<td>HY-DVR</td>
<td>DM-284</td>
<td>1080P-HY04N</td>
</tr>
<tr>
<td>D1104NR</td>
<td>HY-DVR</td>
<td>DM-291</td>
<td>&quot;Panda</td>
</tr>
<tr>
<td>D1104NR</td>
<td>HY-DVR</td>
<td>DM-291</td>
<td>1080P-HY04N</td>
</tr>
<tr>
<td>D1104NR</td>
<td>HY-DVR</td>
<td>DM-291A</td>
<td>1080P-HY04N</td>
</tr>
<tr>
<td>D1104NR</td>
<td>HY-DVR</td>
<td>DM-291C</td>
<td>LRA3040N</td>
</tr>
<tr>
<td>D1104NR</td>
<td>NHDR</td>
<td>DM-307</td>
<td>NHDR-5104AHD</td>
</tr>
<tr>
<td>D1104NR</td>
<td>SDR-B73303</td>
<td>DM-291A</td>
<td>SDR-B73303</td>
</tr>
<tr>
<td>D1104NR</td>
<td>SVR9204H</td>
<td>DM-291A</td>
<td>1080P-HY04N</td>
</tr>
<tr>
<td>D1108NR</td>
<td>1093/538P</td>
<td>DM-290</td>
<td>1080P-HY08N</td>
</tr>
<tr>
<td>D1108NR</td>
<td>DVR8-4575</td>
<td>DM-290</td>
<td>DVR8-4575</td>
</tr>
<tr>
<td>D1108NR</td>
<td>DVR8-HDA10P</td>
<td>DM-290</td>
<td>DVR8-HDA10P</td>
</tr>
<tr>
<td>D1108NR</td>
<td>HRD-E830L</td>
<td>DM-290A</td>
<td>HRD-E830L</td>
</tr>
<tr>
<td>D1108NR</td>
<td>HY-DVR</td>
<td>DM-290</td>
<td>1080P-HY08N</td>
</tr>
<tr>
<td>D1108NR</td>
<td>HY-DVR</td>
<td>DM-290A</td>
<td>1080P-HY08N</td>
</tr>
<tr>
<td>D1108NR</td>
<td>HY-DVR</td>
<td>DM-290A</td>
<td>LRA3080N</td>
</tr>
<tr>
<td>D1108NR</td>
<td>NHDR</td>
<td>DM-307</td>
<td>NHDR-5108AHD</td>
</tr>
<tr>
<td>D1108NR</td>
<td>RL-AHD8p</td>
<td>DM-290</td>
<td>1080P-HY08N</td>
</tr>
<tr>
<td>D1108NR</td>
<td>SDR-B74301</td>
<td>DM-290A</td>
<td>SDR-B74301</td>
</tr>
<tr>
<td>D1108NR</td>
<td>SDR-B74303</td>
<td>DM-290A</td>
<td>SDR-B74303</td>
</tr>
<tr>
<td>D1116</td>
<td>HY-DVR</td>
<td>DM-300</td>
<td>EHR-5164</td>
</tr>
<tr>
<td>D1116NR</td>
<td>HRD-E1630L</td>
<td>DM-295</td>
<td>HRD-E1630L</td>
</tr>
<tr>
<td>D1116NR</td>
<td>HY-DVR</td>
<td>DM-295</td>
<td>1080P-HY16N</td>
</tr>
<tr>
<td>D1116NR</td>
<td>HY-DVR</td>
<td>DM-295</td>
<td>LRA3160N</td>
</tr>
<tr>
<td>D1116NR</td>
<td>HY-DVR</td>
<td>DM-299</td>
<td>1080P-HY16N</td>
</tr>
<tr>
<td>D1116NR</td>
<td>SDR-B75303</td>
<td>DM-295</td>
<td>SDR-B75303</td>
</tr>
<tr>
<td>D1132NR</td>
<td>HY-DVR</td>
<td>DM-300</td>
<td>1080P-HY32</td>
</tr>
<tr>
<td>D2116NR</td>
<td>SDR-B85300</td>
<td>DM-300</td>
<td>SDR-B85300</td>
</tr>
<tr>
<td>D973215U</td>
<td>F9-DVR32</td>
<td>DM-195</td>
<td>F9-DVR32</td>
</tr>
<tr>
<td>D9804AHD</td>
<td>DVR</td>
<td>DM-210</td>
<td>391115</td>
</tr>
<tr>
<td>D9804NAHD</td>
<td>AHD7-DVR4</td>
<td>DM-239</td>
<td>AHD7-DVR4</td>
</tr>
<tr>
<td>D9804NAHD</td>
<td>DVR</td>
<td>DM-239</td>
<td>720P-DVR04ND</td>
</tr>
<tr>
<td>D9804NAHD</td>
<td>NHDR</td>
<td>DM-239</td>
<td>NHDR-3104AHD-II</td>
</tr>
<tr>
<td>D9808NRAHD</td>
<td>AHD7-DVR8</td>
<td>DM-228</td>
<td>AHD7-DVR8</td>
</tr>
<tr>
<td>D9808NRAHD</td>
<td>DVR</td>
<td>DM-228</td>
<td></td>
</tr>
<tr>
<td>D9808NRAHD</td>
<td>DVR</td>
<td>DM-228</td>
<td>391116</td>
</tr>
<tr>
<td>D9808NRAHD</td>
<td>NHDR</td>
<td>DM-228</td>
<td>NHDR-3108AHD-II</td>
</tr>
<tr>
<td>D9808NRAHD</td>
<td>NHDR</td>
<td>DM-228</td>
<td>NHDR3108AHDII</td>
</tr>
<tr>
<td>D9816NAHD</td>
<td>DVR</td>
<td>DM-233</td>
<td>720P-DVR016N</td>
</tr>
<tr>
<td>D9816NAHD</td>
<td>NHDR</td>
<td>DM-233</td>
<td>NHDR3116AHDII</td>
</tr>
<tr>
<td>D9816NRAHD</td>
<td>AHD7-DVR16</td>
<td>DM-229</td>
<td>AHD7-DVR16</td>
</tr>
<tr>
<td>D9816NRAHD</td>
<td>DVR</td>
<td>DM-229</td>
<td>720P-DVR016NB</td>
</tr>
<tr>
<td>D9904</td>
<td>D9904</td>
<td>DM-237</td>
<td>1080P-DVR04</td>
</tr>
<tr>
<td>D9904</td>
<td>DVR</td>
<td>DM-237</td>
<td>1080P-DVR04</td>
</tr>
<tr>
<td>D9904</td>
<td>NHDR</td>
<td>DM-237</td>
<td>NHDR-5204AHD</td>
</tr>
<tr>
<td>D9904NR</td>
<td>DVR</td>
<td>DM-244</td>
<td>1080P-DVR04N</td>
</tr>
<tr>
<td>D9904NR</td>
<td>DVR</td>
<td>DM-244</td>
<td>BCS-VAVR0401M</td>
</tr>
<tr>
<td>D9904NR</td>
<td>HY-DVR</td>
<td>DM-244</td>
<td>CVD-AF04S</td>
</tr>
<tr>
<td>D9904NR</td>
<td>N420</td>
<td>DM-244</td>
<td>1080P-DVR04N</td>
</tr>
<tr>
<td>D9904NR</td>
<td>NHDR</td>
<td>DM-244</td>
<td>NHDR-5004AHD-II</td>
</tr>
<tr>
<td>D9904NR</td>
<td>NHDR</td>
<td>DM-244</td>
<td>NHDR5004AHDII</td>
</tr>
<tr>
<td>D9908</td>
<td>DVR</td>
<td>DM-245</td>
<td>BCS-VAVR0802Q</td>
</tr>
<tr>
<td>D9908</td>
<td>NHDR</td>
<td>DM-245</td>
<td>NHDR-5208AHD</td>
</tr>
<tr>
<td>D9908AHD</td>
<td>DVR</td>
<td>DM-246</td>
<td>1080P-DVR08A</td>
</tr>
<tr>
<td>D9908NR</td>
<td>AHD10-DVR8</td>
<td>DM-237</td>
<td>AHD10-DVR8</td>
</tr>
<tr>
<td>D9908NR</td>
<td>DVR</td>
<td>DM-237</td>
<td>1080P-DVR08N</td>
</tr>
<tr>
<td>D9908NR</td>
<td>DVR</td>
<td>DM-237</td>
<td>SVR9008ATHD/C</td>
</tr>
<tr>
<td>D9908NR</td>
<td>HY-DVR</td>
<td>DM-237</td>
<td>CVD-AF08S</td>
</tr>
<tr>
<td>D9908NR</td>
<td>N820</td>
<td>DM-237</td>
<td>1080P-DVR08N</td>
</tr>
<tr>
<td>D9908NR</td>
<td>NHDR</td>
<td>DM-237</td>
<td>NHDR-5008AHD-II</td>
</tr>
<tr>
<td>D9916NR</td>
<td>DVR</td>
<td>DM-245</td>
<td>1080P-DVR016NAT;UI</td>
</tr>
<tr>
<td>D9916NR</td>
<td>DVR</td>
<td>DM-245</td>
<td>HR-31-211620;UI</td>
</tr>
<tr>
<td>D9916NR</td>
<td>HY-DVR</td>
<td>DM-245</td>
<td>CVD-AF16S</td>
</tr>
<tr>
<td>D9916NR</td>
<td>NHDR</td>
<td>DM-245</td>
<td>NHDR-5016AHD-II</td>
</tr>
<tr>
<td>D9916NRAHD</td>
<td>DVR</td>
<td>DM-246</td>
<td>1080P-DVR016NA</td>
</tr>
<tr>
<td>D9916NRAHD</td>
<td>N1620</td>
<td>DM-246</td>
<td>1080P-DVR016NA</td>
</tr>
<tr>
<td>H1104W</td>
<td>SNR-73200W</td>
<td>DM-339</td>
<td>SNR-73200W</td>
</tr>
<tr>
<td>H1106W</td>
<td>LHB806</td>
<td>DM-291B</td>
<td>LHB806</td>
</tr>
<tr>
<td>H1106W</td>
<td>LHB906</td>
<td>DM-291B</td>
<td>LHB906</td>
</tr>
</tbody>
</table>
<h1 id="bot">Bot规模分析</h1>
<p>从我们的数据视野看，该botnet的活跃Bot源IP趋势如下：<br>
<img src="__GHOST_URL__/content/images/2021/06/Snip202110630_10.png" alt="Snip202110630_10" loading="lazy"></p>
<p>Bot源IP地理位置分布如下，主要集中在美国、韩国和巴西：<br>
<img src="__GHOST_URL__/content/images/2021/06/Snip20210629_1.png" alt="Snip20210629_1" loading="lazy"></p>
<h1 id="">样本分析</h1>
<p>本文选取以下样本为主要分析对象</p>
<pre><code>Verdict:mirai_ptea
MD5:c6ef442bc804fc5290d3617056492d4b
ELF 32-bit LSB executable, ARM, version 1, statically linked, stripped 
Packer:No
Lib:uclibc
</code></pre>
<p><code>c6ef442bc804fc5290d3617056492d4b</code>是一个Mirai的变种，基于其使用Tor Proxy和C2通信，以及TEA算法（Tiny Encryption Algorithm）隐藏敏感的资源信息，我们称之为<code>Mirai_ptea</code>。Mirai_ptea运行时在会Console输出字串<code>come at me krebs rimasuta go BRRT</code>，这就是有的研究人员将它称之为<code>Rimasuta</code>的原因，它在主机行为层面和Mirai很相似，并无亮点，因此这方面不再细述；在网络流量层面采用Tor Proxy，样本内嵌了大量的代理节点，而且Tor-C2被加密，下文将着重讨论加密方法和通信协议。</p>
<h1 id="">加密算法</h1>
<p>Mirai_ptea将所有的敏感资源信息加密并按一定的顺序存储，在IDA打开样本看到的字串信息如下所示，几乎没有可读的信息。</p>
<p><img src="__GHOST_URL__/content/images/2021/06/ptea_strtab.png" alt="ptea_strtab" loading="lazy"></p>
<p>下面的代码片段来自样本中解密相关函数，通过<code>红框中的常量</code>可以判定它使用的是TEA算法，</p>
<img src="__GHOST_URL__/content/images/2021/06/ptea_tea.png"  width="860px" />
<p>密钥为：</p>
<pre><code>0xC26F6A52 0x24AA0006 0x8E1BF2C5 0x4BA51F8C
</code></pre>
<p>基于逆向分析，我们实现了<a href="#decrypt_str"><strong>附录</strong></a>的解密脚本，通过它可以获得所有的解密后的敏感资源以及它们的表项信息，部分资源信息如下所示：</p>
<img src="__GHOST_URL__/content/images/2021/06/ptea_decinfo.png"  width="860px" />
<p>Mirai_ptea在使用加密资源时有2种操作方式</p>
<ul>
<li><strong>传统的Mirai方式</strong>，解密一个加密项，取值，加密一个解密后的项，即<code>var_unlock--&gt;var_get--&gt;var_lock</code>。例如在获取输出在Console上的信息时，就是通过这种方式。<br>
<img src="__GHOST_URL__/content/images/2021/06/ptea_var.png" alt="ptea_strtab" loading="lazy"></li>
</ul>
<p>表项0x11的值正是<code>come at me krebs rimasuta go BRRT</code>。</p>
<ul>
<li><strong>Mirai_ptea的方式</strong>，解密多个加密项，取值，重新加密已解密的项，即<code>rangeVar_unlock--&gt;var_get--&gt;rangeVar_lock</code>。例如在获取伪装进程名时，就是通过这种方式。</li>
</ul>
<p><img src="__GHOST_URL__/content/images/2021/06/ptea_rangevar.png" alt="ptea_strtab" loading="lazy"><br>
表项0x2c到0x2c+10的值如下所示，正是11个供选择的伪装进程名：</p>
<pre><code>index 0x2c, value = /bin/sh
index 0x2d, value = telnetd
index 0x2e, value = upnpc-static
index 0x2f, value = wsdd
index 0x30, value = proftpd
index 0x31, value = mini_httpd
index 0x32, value = udevd
index 0x33, value = /sbin/udhcpc
index 0x34, value = boa
index 0x35, value = /usr/sbin/inetd
index 0x36, value = dnsmasq
</code></pre>
<h1 id="">通信协议</h1>
<p>Mirai_ptea的网络流量概览如下图所示：</p>
<img src="__GHOST_URL__/content/images/2021/06/ptea_network.png"  width="860px" />
<p>整个过程可以分成以下3个步骤：</p>
<p>1：和代理节点建立连接</p>
<p>2：和Tor C2建立连接</p>
<p>3：通过ptea自定义的协议和C2通信，接收C2下发的攻击指令。</p>
<h3 id="0x1">0x1. 和代理建立连接</h3>
<p>Mirai_ptea样本中内置了2组代理，它们在加密资源中的表项分别为0x2a,0x2b。Bot样本运行时，会在2组代理中随机选一组，然后在选中的组中随机选一个通过下面代码片段建立连接。</p>
<img src="__GHOST_URL__/content/images/2021/06/ptea_proxy.png"  width="860px" />
<p>其中<code>0x2a</code>中一共有38个代理节点，格式为<code>ip:port</code></p>
<img src="__GHOST_URL__/content/images/2021/06/ptea_0x2a.png"  width="860px" />
<p>而<code>0x2b</code>中一共有个334个代理节点，格式为<code>ip</code>，这组代理的端口为固定的9050。</p>
<img src="__GHOST_URL__/content/images/2021/06/ptea_0x2b.png"  width="860px" />
<p>详细的代理列表见附录。</p>
<h3 id="0x2torproxyc2">0x2. 通过Tor-Proxy协议和C2建立连接</h3>
<p><img src="__GHOST_URL__/content/images/2021/06/ptea_c2.png" alt="ptea_strtab" loading="lazy"></p>
<p>可以看出C2在加密资源中的表项为<code>0xD</code>，解密后得到下面字串：</p>
<pre><code>rkz2f5u57cvs3kdt6amdku2uhly2esj7m2336dttvcygloivcgsmxjjnuickasbuatxajrovi4lvd2zjuejivzrb3vobuoezbc6z3gtu6b3r5tce.onion
</code></pre>
<p>将上面字串排除尾部的“.onion”后以长度16分割，然后和尾部的<code>.onion</code>字串进行拼接，就得到了以下7个C2。</p>
<pre><code>rkz2f5u57cvs3kdt.onion
6amdku2uhly2esj7.onion
m2336dttvcygloiv.onion
cgsmxjjnuickasbu.onion
atxajrovi4lvd2zj.onion
uejivzrb3vobuoez.onion
bc6z3gtu6b3r5tce.onion
</code></pre>
<h3 id="0x3c2">0x3. 通过自定义的协议和C2进行通信，具体的上线，心跳，攻击如下所示</h3>
<ul>
<li>上线<br>
<img src="__GHOST_URL__/content/images/2021/06/ptea_reg.png"  width="860px" /></li>
</ul>
<pre><code>msg parsing
----------------------------------------------------------------
3e c7 e3 1e 37 47 61 20						-----&gt;hardcoded msg from Bot
b1 2f de ce cb 89 e1 a0						-----&gt;cmd from C2,ask Bot to upload info
3a 31 34 b5 02 00							-----&gt;hardcoded 6 bytes msg from Bot
b4 a3 e1 16									-----&gt;ip of infected device
04											-----&gt;group string length
74 65 73 74								    -----&gt;group string
79			                                -----&gt;padding
</code></pre>
<ul>
<li>心跳<br>
<img src="__GHOST_URL__/content/images/2021/06/ptea_heart.png"  width="860px" /></li>
</ul>
<pre><code>msg parsing
----------------------------------------------------------------
2a 23						-----&gt; random 2 bytes msg from Bot
2a 23						-----&gt; random 2 bytes msg from C2
</code></pre>
<ul>
<li>攻击指令，前4字节<code>AD AF FE 7F</code>为固定的幻数，剩余部分与mirai的攻击指令格式类似</li>
</ul>
<pre><code>00000000: AD AF FE 7F 1E 00 00 00  00 01 B9 98 42 65 20 00  ............Be .
00000010: 42 65 20 00     
</code></pre>
<h1 id="ddos">DDoS攻击活动</h1>
<p>从我们的DDoS跟踪系统看，该僵尸网络已经发起实际的DDoS攻击，下图为我们观察到的该僵尸网络的一些DDoS攻击指令：<br>
<a href="__GHOST_URL__/content/images/2021/06/mirai_ptea_atk_cmd_4c.png"><img src="__GHOST_URL__/content/images/2021/06/mirai_ptea_atk_cmd_4.png" class="kg-image"/></a></p>
<h1 id="">联系我们</h1>
<p>感兴趣的读者，可以在 <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a> 或者通过邮件<strong>netlab[at]360.cn</strong>联系我们。</p>
<h1 id="ioc">IoC</h1>
<h2 id="torc2">Tor-C2</h2>
<pre><code>bc6z3gtu6b3r5tce.onion:3742
cgsmxjjnuickasbu.onion:992
uejivzrb3vobuoez.onion:5353
rkz2f5u57cvs3kdt.onion:280
atxajrovi4lvd2zj.onion:110
6amdku2uhly2esj7.onion:513
m2336dttvcygloiv.onion:666
</code></pre>
<h2 id="samplemd5">Sample MD5</h2>
<pre><code>c6ef442bc804fc5290d3617056492d4b
f849fdd79d433e2828473f258ffddaab
</code></pre>
<h2 id="downloaderurl">Downloader URL</h2>
<pre><code>http://193[.177.182.221/boot
</code></pre>
<h2 id="scannerip">Scanner IP</h2>
<pre><code>205.185.117.21	AS53667|FranTech_Solutions	United_States|Nevada|Las_Vegas
205.185.114.55	AS53667|FranTech_Solutions	United_States|Nevada|Las_Vegas
68.183.109.6	AS14061|DigitalOcean,_LLC	United_States|New_York|New_York_City
67.205.163.141	AS14061|DigitalOcean,_LLC	United_States|New_York|New_York_City
165.227.88.215	AS14061|DigitalOcean,_LLC	United_States|New_York|New_York_City
</code></pre>
<h2 id="proxys">Proxys</h2>
<pre><code>---------proxys at index 0x2a，count=38---------
149.202.9.7:9898
91.134.216.103:16358
84.32.188.34:1157
51.178.185.237:32
65.21.16.80:23560
149.202.9.14:19765
146.59.11.109:5089
195.189.96.61:29582
84.32.188.37:1454
51.195.209.80:26848
5.199.174.242:27931
95.179.158.147:22413
146.59.11.103:1701
185.150.117.10:29086
149.56.154.210:24709
135.148.11.151:3563
51.195.152.255:25107
45.79.193.124:7158
135.148.11.150:5560
185.150.117.41:20790
135.125.250.120:14498
172.106.70.135:692
195.189.96.60:9700
172.106.70.134:25054
149.56.154.211:21299
108.61.218.205:29240
51.178.185.236:21685
51.81.139.251:6255
51.255.237.164:963
51.81.139.249:32380
139.162.45.218:5165
65.21.16.94:28056
207.148.74.163:32389
172.104.100.78:1039
45.32.8.100:19759
141.164.46.133:2205
172.105.36.167:10843
172.105.180.239:19531

---------proxys at index 0x2b，count=334，port=9050---------
Too many, not list here, you can get them via the IDA script
</code></pre>
<h1 id="aiddecrypt_stridaa"><a id="decrypt_str">附录（IDA解密脚本）</a></h1>
<pre><code># IDAPYTHON SCRIPT for md5 c6ef442bc804fc5290d3617056492d4b only.
# Tested at ida 7.0
from ctypes import *
import struct
print &quot;-------------------decryption start------------------------&quot;

key=[0xC26F6A52,0x24AA0006,0x8E1BF2C5,0x4BA51F8C]
def tea_dec(buf,key):
    rbuf=&quot;&quot;
    fmt = '&gt;' + str(len(buf)/4) + 'I'
    tbuf= struct.unpack_from(fmt,buf)
    j=0
    for i in range(0,len(tbuf)/2):
        
        v1=c_uint32(tbuf[i+j])
        v2=c_uint32(tbuf[i+1+j])

        sum=c_uint32(0xC6EF3720)
        while(sum.value):
            v2.value -= ((v1.value&gt;&gt;5)+key[3])    ^(v1.value+sum.value)^  ((v1.value&lt;&lt;4)+key[2])
            v1.value -= ((v2.value&gt;&gt;5)+key[1])   ^(v2.value+sum.value)^ ((v2.value&lt;&lt;4)+key[0])
            sum.value+=0x61C88647
        rbuf +=struct.pack(&quot;&gt;I&quot;,v1.value)+struct.pack(&quot;&gt;I&quot;,v2.value)
        j+=1
    return rbuf
def getbuff(addr):
    buf = &quot;&quot;
    while idc.get_bytes(addr, 2) != &quot;\x00\x00&quot;:
        buf += idc.get_bytes(addr, 1)
        addr += 1

    return buf



# pay attention to function at 0x0000D074
a=getbuff(idc.get_wide_dword(0x00019C9C))

    

buf=[]
#0x19c9c-0x199f0 --&gt; 684
for i in range(0,684,12):
    offset=idc.get_wide_word(0x000199F4+i)
    length=idc.get_wide_word(0x000199F4+i+2)

    buf.append(a[offset:offset+length])
    
c2=[]
#684/12 --&gt; 57
for i in range(57):
    decbuf=tea_dec(buf[i],key)

    if(&quot;.onion&quot; in decbuf):
        c2.append(decbuf)
    print &quot;index %x, value = %s&quot; %(i,decbuf)    
print &quot;-------------------decryption end---------------&quot;

proxya=tea_dec(buf[0x2a],key)
pacnt=struct.unpack(&quot;&lt;H&quot;,proxya[2:4])


proxy=[]
port=[]
tmp=proxya[4:4+6*(pacnt[0])]
print &quot;------------proxys at index 0x2A, count= %d------------&quot; %(pacnt[0])
for i in range(0,len(tmp),6):
    proxy.append(struct.unpack(&quot;&gt;I&quot;,tmp[i:i+4])[0])
    port.append(struct.unpack(&quot;&lt;H&quot;,tmp[i+4:i+6])[0])
for i in range(pacnt[0]):
    a=struct.pack(&quot;&gt;I&quot;,proxy[i])
    ip=&quot;&quot;
    for j in range(4):
        ip+=str(ord(a[j]))
        if j!=3:
            ip+=&quot;.&quot;
    
    print&quot;%s:%d&quot; %(ip,port[i])



proxyb=tea_dec(buf[0x2b],key)
pbcnt=struct.unpack(&quot;&lt;H&quot;,proxyb[2:4])
fmt = '&gt;' + str(pbcnt[0]) + 'I'
tmp=proxyb[4:4*(pbcnt[0]+1)]
print &quot;------------proxys at index 0x2B, count= %d------------&quot; %(pbcnt[0])
xxxxx=struct.unpack(fmt,tmp)
for i in xxxxx:
    a=struct.pack(&quot;&gt;I&quot;,i)
    ip=&quot;&quot;
    for i in range(4):
        ip+=str(ord(a[i]))
        if i!=3:
            ip+=&quot;.&quot;
    print ip


print &quot;-------------------------onion info--------------&quot;    
if len(c2)!=0:
    for i in c2:
        
        pos=i.find(&quot;.onion&quot;)

        for j in range(0,pos,16):
            print i[j:16+j]+&quot;.onion&quot;
else:
    print &quot;Don't find the onion c2&quot;
</code></pre>
<!--kg-card-end: markdown-->
版权


版权声明：本文为Netlab原创，依据 CC BY-SA 4.0 许可证进行授权，转载请附上出处链接及本声明。



概述


2021-06-22我们检测到一个我们命名为mirai_ptea的mirai变种样本通过未知漏洞传播。经过分析，该漏洞为KGUARD DVR未公开的漏洞。从我们的分析看该漏洞存在于2016年的固件版本中。我们能找到的2017年之后的固件厂家均已经修复该漏洞。有意思的是，一天以后，6月23日，我们收到安全社区的询问，咨询我们是否看到一种新的DDoS攻击botnet。交叉对比线索，居然就是我们刚发现的这个botnet，目前看。这个僵尸网络处于活跃的攻击状态(见最后)。



时间线


 * 2021-03-22 我们历史数据首次观察到针对该漏洞的探测扫描
 * 2021-06-22 我们观察到mirai_ptea样本利用该漏洞传播
 * 2021-06-23 我们收到安全社区的询问是否看到一种新的DDoS攻击botnet
 * 2021-06-25 我们观察到mirai_aurora样本利用该漏洞传播



漏洞分析


鉴于我们并未发现该漏洞的公开资料，为防止该漏洞被滥用，此处我们将隐藏部分关键信息。


KGUARD DVR 2016年的固件上的***程序监听在0.0.0.0的*****端口无需认证即可远程执行系统命令。 最新的固件中厂家通过修改监听地址为127.0.0.1修复了该漏洞。部分利用payload如下：





受影响设备分析


通过探测我们发现至少3千左右的在线设备依然存在该漏洞。已知仍然受影响设备如下:





DeviceType
ProductType
HardVersion
DefDeviceName




D1004NR
DVR4-1600
DM-268A
DVR4-1600


D1004NR
HY-DVR
DM-268
720P-HY04N


D1004NR
HY-DVR
DM-268A
720P-HY04N


D1004NR
HY-DVR
DM-274
720P-HY04N


D1004NR
HY-DVR
DM-274B
720P-HY04N


D1004NR
NHDR
DM-274
NHDR-3204AHD


D1004NR
RL-AHD4n
DM-268
720P-HY04N


D1008NR
1093/508N-DVRBM08H
DM-292
720P-HY08N


D1008NR
DVR8-1600
DM-298
DVR8-1600


D1008NR
DVR8-HDA10L
DM-292
DVR8-HDA10L


D1008NR
HD881
DM-292
HD881


D1008NR
HY-DVR
DM-292
720P-HY08N


D1008NR
HY-DVR
DM-298
720P-HY08N


D1008NR
NHDR
DM-298
NHDR-3208AHD


D1008NR
RL-AHD8n
DM-292
720P-HY08N


D1016NR
DVR16-HDA10L
DM-303
DVR16-HDA10L


D1016NR
HD1681
DM-303
HD1681


D1016NR
HY-DVR
DM-303A
720P-HY16N


D1016NR
HY-DVR
DM-310
720P-HY16N


D1016NR
HY-DVR
DM-310A
720P-HY16N


D1016NR
NHDR
DM-310
NHDR-3216AHD


D1016NR
RL-MHD16n(21A)
DM-310A
720P-HY16N


D1104
HY-DVR
DM-290A
1080P-HY04


D1104
NHDR
DM-307
NHDR-5304AHD


D1104NR
HD1T4
DM-291A
1080P-04


D1104NR
HD481
DM-291
HD481


D1104NR
HRD-E430L
DM-291A
HRD-E430L


D1104NR
HY-DVR
DM-284
1080P-HY04N


D1104NR
HY-DVR
DM-291
"Panda


D1104NR
HY-DVR
DM-291
1080P-HY04N


D1104NR
HY-DVR
DM-291A
1080P-HY04N


D1104NR
HY-DVR
DM-291C
LRA3040N


D1104NR
NHDR
DM-307
NHDR-5104AHD


D1104NR
SDR-B73303
DM-291A
SDR-B73303


D1104NR
SVR9204H
DM-291A
1080P-HY04N


D1108NR
1093/538P
DM-290
1080P-HY08N


D1108NR
DVR8-4575
DM-290
DVR8-4575


D1108NR
DVR8-HDA10P
DM-290
DVR8-HDA10P


D1108NR
HRD-E830L
DM-290A
HRD-E830L


D1108NR
HY-DVR
DM-290
1080P-HY08N


D1108NR
HY-DVR
DM-290A
1080P-HY08N


D1108NR
HY-DVR
DM-290A
LRA3080N


D1108NR
NHDR
DM-307
NHDR-5108AHD


D1108NR
RL-AHD8p
DM-290
1080P-HY08N


D1108NR
SDR-B74301
DM-290A
SDR-B74301


D1108NR
SDR-B74303
DM-290A
SDR-B74303


D1116
HY-DVR
DM-300
EHR-5164


D1116NR
HRD-E1630L
DM-295
HRD-E1630L


D1116NR
HY-DVR
DM-295
1080P-HY16N


D1116NR
HY-DVR
DM-295
LRA3160N


D1116NR
HY-DVR
DM-299
1080P-HY16N


D1116NR
SDR-B75303
DM-295
SDR-B75303


D1132NR
HY-DVR
DM-300
1080P-HY32


D2116NR
SDR-B85300
DM-300
SDR-B85300


D973215U
F9-DVR32
DM-195
F9-DVR32


D9804AHD
DVR
DM-210
391115


D9804NAHD
AHD7-DVR4
DM-239
AHD7-DVR4


D9804NAHD
DVR
DM-239
720P-DVR04ND


D9804NAHD
NHDR
DM-239
NHDR-3104AHD-II


D9808NRAHD
AHD7-DVR8
DM-228
AHD7-DVR8


D9808NRAHD
DVR
DM-228



D9808NRAHD
DVR
DM-228
391116


D9808NRAHD
NHDR
DM-228
NHDR-3108AHD-II


D9808NRAHD
NHDR
DM-228
NHDR3108AHDII


D9816NAHD
DVR
DM-233
720P-DVR016N


D9816NAHD
NHDR
DM-233
NHDR3116AHDII


D9816NRAHD
AHD7-DVR16
DM-229
AHD7-DVR16


D9816NRAHD
DVR
DM-229
720P-DVR016NB


D9904
D9904
DM-237
1080P-DVR04


D9904
DVR
DM-237
1080P-DVR04


D9904
NHDR
DM-237
NHDR-5204AHD


D9904NR
DVR
DM-244
1080P-DVR04N


D9904NR
DVR
DM-244
BCS-VAVR0401M


D9904NR
HY-DVR
DM-244
CVD-AF04S


D9904NR
N420
DM-244
1080P-DVR04N


D9904NR
NHDR
DM-244
NHDR-5004AHD-II


D9904NR
NHDR
DM-244
NHDR5004AHDII


D9908
DVR
DM-245
BCS-VAVR0802Q


D9908
NHDR
DM-245
NHDR-5208AHD


D9908AHD
DVR
DM-246
1080P-DVR08A


D9908NR
AHD10-DVR8
DM-237
AHD10-DVR8


D9908NR
DVR
DM-237
1080P-DVR08N


D9908NR
DVR
DM-237
SVR9008ATHD/C


D9908NR
HY-DVR
DM-237
CVD-AF08S


D9908NR
N820
DM-237
1080P-DVR08N


D9908NR
NHDR
DM-237
NHDR-5008AHD-II


D9916NR
DVR
DM-245
1080P-DVR016NAT;UI


D9916NR
DVR
DM-245
HR-31-211620;UI


D9916NR
HY-DVR
DM-245
CVD-AF16S


D9916NR
NHDR
DM-245
NHDR-5016AHD-II


D9916NRAHD
DVR
DM-246
1080P-DVR016NA


D9916NRAHD
N1620
DM-246
1080P-DVR016NA


H1104W
SNR-73200W
DM-339
SNR-73200W


H1106W
LHB806
DM-291B
LHB806


H1106W
LHB906
DM-291B
LHB906






Bot规模分析


从我们的数据视野看，该botnet的活跃Bot源IP趋势如下：




Bot源IP地理位置分布如下，主要集中在美国、韩国和巴西：





样本分析


本文选取以下样本为主要分析对象


Verdict:mirai_ptea
MD5:c6ef442bc804fc5290d3617056492d4b
ELF 32-bit LSB executable, ARM, version 1, statically linked, stripped 
Packer:No
Lib:uclibc



c6ef442bc804fc5290d3617056492d4b是一个Mirai的变种，基于其使用Tor Proxy和C2通信，以及TEA算法（Tiny Encryption Algorithm）隐藏敏感的资源信息，我们称之为Mirai_ptea。Mirai_ptea运行时在会Console输出字串come at me krebs rimasuta go BRRT，这就是有的研究人员将它称之为Rimasuta的原因，它在主机行为层面和Mirai很相似，并无亮点，因此这方面不再细述；在网络流量层面采用Tor Proxy，样本内嵌了大量的代理节点，而且Tor-C2被加密，下文将着重讨论加密方法和通信协议。



加密算法


Mirai_ptea将所有的敏感资源信息加密并按一定的顺序存储，在IDA打开样本看到的字串信息如下所示，几乎没有可读的信息。





下面的代码片段来自样本中解密相关函数，通过红框中的常量可以判定它使用的是TEA算法，



密钥为：


0xC26F6A52 0x24AA0006 0x8E1BF2C5 0x4BA51F8C



基于逆向分析，我们实现了附录的解密脚本，通过它可以获得所有的解密后的敏感资源以及它们的表项信息，部分资源信息如下所示：



Mirai_ptea在使用加密资源时有2种操作方式


 * 传统的Mirai方式，解密一个加密项，取值，加密一个解密后的项，即var_unlock-->var_get-->var_lock。例如在获取输出在Console上的信息时，就是通过这种方式。
   
   


表项0x11的值正是come at me krebs rimasuta go BRRT。


 * Mirai_ptea的方式，解密多个加密项，取值，重新加密已解密的项，即rangeVar_unlock-->var_get-->rangeVar_lock。例如在获取伪装进程名时，就是通过这种方式。




表项0x2c到0x2c+10的值如下所示，正是11个供选择的伪装进程名：


index 0x2c, value = /bin/sh
index 0x2d, value = telnetd
index 0x2e, value = upnpc-static
index 0x2f, value = wsdd
index 0x30, value = proftpd
index 0x31, value = mini_httpd
index 0x32, value = udevd
index 0x33, value = /sbin/udhcpc
index 0x34, value = boa
index 0x35, value = /usr/sbin/inetd
index 0x36, value = dnsmasq




通信协议


Mirai_ptea的网络流量概览如下图所示：



整个过程可以分成以下3个步骤：


1：和代理节点建立连接


2：和Tor C2建立连接


3：通过ptea自定义的协议和C2通信，接收C2下发的攻击指令。



0x1. 和代理建立连接


Mirai_ptea样本中内置了2组代理，它们在加密资源中的表项分别为0x2a,0x2b。Bot样本运行时，会在2组代理中随机选一组，然后在选中的组中随机选一个通过下面代码片段建立连接。



其中0x2a中一共有38个代理节点，格式为ip:port



而0x2b中一共有个334个代理节点，格式为ip，这组代理的端口为固定的9050。



详细的代理列表见附录。



0x2. 通过Tor-Proxy协议和C2建立连接





可以看出C2在加密资源中的表项为0xD，解密后得到下面字串：


rkz2f5u57cvs3kdt6amdku2uhly2esj7m2336dttvcygloivcgsmxjjnuickasbuatxajrovi4lvd2zjuejivzrb3vobuoezbc6z3gtu6b3r5tce.onion



将上面字串排除尾部的“.onion”后以长度16分割，然后和尾部的.onion字串进行拼接，就得到了以下7个C2。


rkz2f5u57cvs3kdt.onion
6amdku2uhly2esj7.onion
m2336dttvcygloiv.onion
cgsmxjjnuickasbu.onion
atxajrovi4lvd2zj.onion
uejivzrb3vobuoez.onion
bc6z3gtu6b3r5tce.onion




0x3. 通过自定义的协议和C2进行通信，具体的上线，心跳，攻击如下所示


 * 上线
   
   


msg parsing
----------------------------------------------------------------
3e c7 e3 1e 37 47 61 20						----->hardcoded msg from Bot
b1 2f de ce cb 89 e1 a0						----->cmd from C2,ask Bot to upload info
3a 31 34 b5 02 00							----->hardcoded 6 bytes msg from Bot
b4 a3 e1 16									----->ip of infected device
04											----->group string length
74 65 73 74								    ----->group string
79			                                ----->padding



 * 心跳
   
   


msg parsing
----------------------------------------------------------------
2a 23						-----> random 2 bytes msg from Bot
2a 23						-----> random 2 bytes msg from C2



 * 攻击指令，前4字节AD AF FE 7F为固定的幻数，剩余部分与mirai的攻击指令格式类似


00000000: AD AF FE 7F 1E 00 00 00  00 01 B9 98 42 65 20 00  ............Be .
00000010: 42 65 20 00     




DDoS攻击活动


从我们的DDoS跟踪系统看，该僵尸网络已经发起实际的DDoS攻击，下图为我们观察到的该僵尸网络的一些DDoS攻击指令：





联系我们


感兴趣的读者，可以在 twitter 或者通过邮件netlab[at]360.cn联系我们。



IoC



Tor-C2


bc6z3gtu6b3r5tce.onion:3742
cgsmxjjnuickasbu.onion:992
uejivzrb3vobuoez.onion:5353
rkz2f5u57cvs3kdt.onion:280
atxajrovi4lvd2zj.onion:110
6amdku2uhly2esj7.onion:513
m2336dttvcygloiv.onion:666




Sample MD5


c6ef442bc804fc5290d3617056492d4b
f849fdd79d433e2828473f258ffddaab




Downloader URL


http://193[.177.182.221/boot




Scanner IP


205.185.117.21	AS53667|FranTech_Solutions	United_States|Nevada|Las_Vegas
205.185.114.55	AS53667|FranTech_Solutions	United_States|Nevada|Las_Vegas
68.183.109.6	AS14061|DigitalOcean,_LLC	United_States|New_York|New_York_City
67.205.163.141	AS14061|DigitalOcean,_LLC	United_States|New_York|New_York_City
165.227.88.215	AS14061|DigitalOcean,_LLC	United_States|New_York|New_York_City




Proxys


---------proxys at index 0x2a，count=38---------
149.202.9.7:9898
91.134.216.103:16358
84.32.188.34:1157
51.178.185.237:32
65.21.16.80:23560
149.202.9.14:19765
146.59.11.109:5089
195.189.96.61:29582
84.32.188.37:1454
51.195.209.80:26848
5.199.174.242:27931
95.179.158.147:22413
146.59.11.103:1701
185.150.117.10:29086
149.56.154.210:24709
135.148.11.151:3563
51.195.152.255:25107
45.79.193.124:7158
135.148.11.150:5560
185.150.117.41:20790
135.125.250.120:14498
172.106.70.135:692
195.189.96.60:9700
172.106.70.134:25054
149.56.154.211:21299
108.61.218.205:29240
51.178.185.236:21685
51.81.139.251:6255
51.255.237.164:963
51.81.139.249:32380
139.162.45.218:5165
65.21.16.94:28056
207.148.74.163:32389
172.104.100.78:1039
45.32.8.100:19759
141.164.46.133:2205
172.105.36.167:10843
172.105.180.239:19531

---------proxys at index 0x2b，count=334，port=9050---------
Too many, not list here, you can get them via the IDA script




附录（IDA解密脚本）


# IDAPYTHON SCRIPT for md5 c6ef442bc804fc5290d3617056492d4b only.
# Tested at ida 7.0
from ctypes import *
import struct
print "-------------------decryption start------------------------"

key=[0xC26F6A52,0x24AA0006,0x8E1BF2C5,0x4BA51F8C]
def tea_dec(buf,key):
    rbuf=""
    fmt = '>' + str(len(buf)/4) + 'I'
    tbuf= struct.unpack_from(fmt,buf)
    j=0
    for i in range(0,len(tbuf)/2):
        
        v1=c_uint32(tbuf[i+j])
        v2=c_uint32(tbuf[i+1+j])

        sum=c_uint32(0xC6EF3720)
        while(sum.value):
            v2.value -= ((v1.value>>5)+key[3])    ^(v1.value+sum.value)^  ((v1.value<<4)+key[2])
            v1.value -= ((v2.value>>5)+key[1])   ^(v2.value+sum.value)^ ((v2.value<<4)+key[0])
            sum.value+=0x61C88647
        rbuf +=struct.pack(">I",v1.value)+struct.pack(">I",v2.value)
        j+=1
    return rbuf
def getbuff(addr):
    buf = ""
    while idc.get_bytes(addr, 2) != "\x00\x00":
        buf += idc.get_bytes(addr, 1)
        addr += 1

    return buf



# pay attention to function at 0x0000D074
a=getbuff(idc.get_wide_dword(0x00019C9C))

    

buf=[]
#0x19c9c-0x199f0 --> 684
for i in range(0,684,12):
    offset=idc.get_wide_word(0x000199F4+i)
    length=idc.get_wide_word(0x000199F4+i+2)

    buf.append(a[offset:offset+length])
    
c2=[]
#684/12 --> 57
for i in range(57):
    decbuf=tea_dec(buf[i],key)

    if(".onion" in decbuf):
        c2.append(decbuf)
    print "index %x, value = %s" %(i,decbuf)    
print "-------------------decryption end---------------"

proxya=tea_dec(buf[0x2a],key)
pacnt=struct.unpack("<H",proxya[2:4])


proxy=[]
port=[]
tmp=proxya[4:4+6*(pacnt[0])]
print "------------proxys at index 0x2A, count= %d------------" %(pacnt[0])
for i in range(0,len(tmp),6):
    proxy.append(struct.unpack(">I",tmp[i:i+4])[0])
    port.append(struct.unpack("<H",tmp[i+4:i+6])[0])
for i in range(pacnt[0]):
    a=struct.pack(">I",proxy[i])
    ip=""
    for j in range(4):
        ip+=str(ord(a[j]))
        if j!=3:
            ip+="."
    
    print"%s:%d" %(ip,port[i])



proxyb=tea_dec(buf[0x2b],key)
pbcnt=struct.unpack("<H",proxyb[2:4])
fmt = '>' + str(pbcnt[0]) + 'I'
tmp=proxyb[4:4*(pbcnt[0]+1)]
print "------------proxys at index 0x2B, count= %d------------" %(pbcnt[0])
xxxxx=struct.unpack(fmt,tmp)
for i in xxxxx:
    a=struct.pack(">I",i)
    ip=""
    for i in range(4):
        ip+=str(ord(a[i]))
        if i!=3:
            ip+="."
    print ip


print "-------------------------onion info--------------"    
if len(c2)!=0:
    for i in c2:
        
        pos=i.find(".onion")

        for j in range(0,pos,16):
            print i[j:16+j]+".onion"
else:
    print "Don't find the onion c2"


{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"# 版权\n版权声明：本文为Netlab原创，依据 [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/) 许可证进行授权，转载请附上出处链接及本声明。\n# 概述\n2021-06-22我们检测到一个我们命名为`mirai_ptea`的mirai变种样本通过未知漏洞传播。经过分析，该漏洞为[KGUARD DVR](https://www.kguard.com.tw/)未公开的漏洞。从我们的分析看该漏洞存在于2016年的固件版本中。我们能找到的2017年之后的固件厂家均已经修复该漏洞。有意思的是，一天以后，6月23日，我们收到安全社区的询问，咨询我们是否看到一种新的DDoS攻击botnet。交叉对比线索，居然就是我们刚发现的这个botnet，目前看。这个僵尸网络处于活跃的攻击状态(见最后)。\n\n## 时间线\n- 2021-03-22 我们历史数据首次观察到针对该漏洞的探测扫描\n- 2021-06-22 我们观察到mirai_ptea样本利用该漏洞传播\n- 2021-06-23 我们收到安全社区的询问是否看到一种新的DDoS攻击botnet\n- 2021-06-25 我们观察到mirai_aurora样本利用该漏洞传播\n\n# 漏洞分析\n鉴于我们并未发现该漏洞的公开资料，为防止该漏洞被滥用，此处我们将隐藏部分关键信息。\n\nKGUARD DVR 2016年的固件上的`***`程序监听在`0.0.0.0`的`*****`端口无需认证即可远程执行系统命令。 最新的固件中厂家通过修改监听地址为`127.0.0.1`修复了该漏洞。部分利用payload如下：\n![mirai_ptea_xx_exp_p](__GHOST_URL__/content/images/2021/07/mirai_ptea_xx_exp_p.png)\n\n## 受影响设备分析\n\n通过探测我们发现至少3千左右的在线设备依然存在该漏洞。已知仍然受影响设备如下:\n| DeviceType | ProductType | HardVersion | DefDeviceName |\n| ------------- | ---------------- | ------------- | ---------------- |\n| D1004NR | DVR4-1600 | DM-268A | DVR4-1600 |\n| D1004NR | HY-DVR | DM-268 | 720P-HY04N |\n| D1004NR | HY-DVR | DM-268A | 720P-HY04N |\n| D1004NR | HY-DVR | DM-274 | 720P-HY04N |\n| D1004NR | HY-DVR | DM-274B | 720P-HY04N |\n| D1004NR | NHDR | DM-274 | NHDR-3204AHD |\n| D1004NR | RL-AHD4n | DM-268 | 720P-HY04N |\n| D1008NR | 1093/508N-DVRBM08H | DM-292 | 720P-HY08N |\n| D1008NR | DVR8-1600 | DM-298 | DVR8-1600 |\n| D1008NR | DVR8-HDA10L | DM-292 | DVR8-HDA10L |\n| D1008NR | HD881 | DM-292 | HD881 |\n| D1008NR | HY-DVR | DM-292 | 720P-HY08N |\n| D1008NR | HY-DVR | DM-298 | 720P-HY08N |\n| D1008NR | NHDR | DM-298 | NHDR-3208AHD |\n| D1008NR | RL-AHD8n | DM-292 | 720P-HY08N |\n| D1016NR | DVR16-HDA10L | DM-303 | DVR16-HDA10L |\n| D1016NR | HD1681 | DM-303 | HD1681 |\n| D1016NR | HY-DVR | DM-303A | 720P-HY16N |\n| D1016NR | HY-DVR | DM-310 | 720P-HY16N |\n| D1016NR | HY-DVR | DM-310A | 720P-HY16N |\n| D1016NR | NHDR | DM-310 | NHDR-3216AHD |\n| D1016NR | RL-MHD16n(21A) | DM-310A | 720P-HY16N |\n| D1104 | HY-DVR | DM-290A | 1080P-HY04 |\n| D1104 | NHDR | DM-307 | NHDR-5304AHD |\n| D1104NR | HD1T4 | DM-291A | 1080P-04 |\n| D1104NR | HD481 | DM-291 | HD481 |\n| D1104NR | HRD-E430L | DM-291A | HRD-E430L |\n| D1104NR | HY-DVR | DM-284 | 1080P-HY04N |\n| D1104NR | HY-DVR | DM-291 | \"Panda |\n| D1104NR | HY-DVR | DM-291 | 1080P-HY04N |\n| D1104NR | HY-DVR | DM-291A | 1080P-HY04N |\n| D1104NR | HY-DVR | DM-291C | LRA3040N |\n| D1104NR | NHDR | DM-307 | NHDR-5104AHD |\n| D1104NR | SDR-B73303 | DM-291A | SDR-B73303 |\n| D1104NR | SVR9204H | DM-291A | 1080P-HY04N |\n| D1108NR | 1093/538P | DM-290 | 1080P-HY08N |\n| D1108NR | DVR8-4575 | DM-290 | DVR8-4575 |\n| D1108NR | DVR8-HDA10P | DM-290 | DVR8-HDA10P |\n| D1108NR | HRD-E830L | DM-290A | HRD-E830L |\n| D1108NR | HY-DVR | DM-290 | 1080P-HY08N |\n| D1108NR | HY-DVR | DM-290A | 1080P-HY08N |\n| D1108NR | HY-DVR | DM-290A | LRA3080N |\n| D1108NR | NHDR | DM-307 | NHDR-5108AHD |\n| D1108NR | RL-AHD8p | DM-290 | 1080P-HY08N |\n| D1108NR | SDR-B74301 | DM-290A | SDR-B74301 |\n| D1108NR | SDR-B74303 | DM-290A | SDR-B74303 |\n| D1116 | HY-DVR | DM-300 | EHR-5164 |\n| D1116NR | HRD-E1630L | DM-295 | HRD-E1630L |\n| D1116NR | HY-DVR | DM-295 | 1080P-HY16N |\n| D1116NR | HY-DVR | DM-295 | LRA3160N |\n| D1116NR | HY-DVR | DM-299 | 1080P-HY16N |\n| D1116NR | SDR-B75303 | DM-295 | SDR-B75303 |\n| D1132NR | HY-DVR | DM-300 | 1080P-HY32 |\n| D2116NR | SDR-B85300 | DM-300 | SDR-B85300 |\n| D973215U | F9-DVR32 | DM-195 | F9-DVR32 |\n| D9804AHD | DVR | DM-210 | 391115 |\n| D9804NAHD | AHD7-DVR4 | DM-239 | AHD7-DVR4 |\n| D9804NAHD | DVR | DM-239 | 720P-DVR04ND |\n| D9804NAHD | NHDR | DM-239 | NHDR-3104AHD-II |\n| D9808NRAHD | AHD7-DVR8 | DM-228 | AHD7-DVR8 |\n| D9808NRAHD | DVR | DM-228 |  |\n| D9808NRAHD | DVR | DM-228 | 391116 |\n| D9808NRAHD | NHDR | DM-228 | NHDR-3108AHD-II |\n| D9808NRAHD | NHDR | DM-228 | NHDR3108AHDII |\n| D9816NAHD | DVR | DM-233 | 720P-DVR016N |\n| D9816NAHD | NHDR | DM-233 | NHDR3116AHDII |\n| D9816NRAHD | AHD7-DVR16 | DM-229 | AHD7-DVR16 |\n| D9816NRAHD | DVR | DM-229 | 720P-DVR016NB |\n| D9904 | D9904 | DM-237 | 1080P-DVR04 |\n| D9904 | DVR | DM-237 | 1080P-DVR04 |\n| D9904 | NHDR | DM-237 | NHDR-5204AHD |\n| D9904NR | DVR | DM-244 | 1080P-DVR04N |\n| D9904NR | DVR | DM-244 | BCS-VAVR0401M |\n| D9904NR | HY-DVR | DM-244 | CVD-AF04S |\n| D9904NR | N420 | DM-244 | 1080P-DVR04N |\n| D9904NR | NHDR | DM-244 | NHDR-5004AHD-II |\n| D9904NR | NHDR | DM-244 | NHDR5004AHDII |\n| D9908 | DVR | DM-245 | BCS-VAVR0802Q |\n| D9908 | NHDR | DM-245 | NHDR-5208AHD |\n| D9908AHD | DVR | DM-246 | 1080P-DVR08A |\n| D9908NR | AHD10-DVR8 | DM-237 | AHD10-DVR8 |\n| D9908NR | DVR | DM-237 | 1080P-DVR08N |\n| D9908NR | DVR | DM-237 | SVR9008ATHD/C |\n| D9908NR | HY-DVR | DM-237 | CVD-AF08S |\n| D9908NR | N820 | DM-237 | 1080P-DVR08N |\n| D9908NR | NHDR | DM-237 | NHDR-5008AHD-II |\n| D9916NR | DVR | DM-245 | 1080P-DVR016NAT;UI |\n| D9916NR | DVR | DM-245 | HR-31-211620;UI |\n| D9916NR | HY-DVR | DM-245 | CVD-AF16S |\n| D9916NR | NHDR | DM-245 | NHDR-5016AHD-II |\n| D9916NRAHD | DVR | DM-246 | 1080P-DVR016NA |\n| D9916NRAHD | N1620 | DM-246 | 1080P-DVR016NA |\n| H1104W | SNR-73200W | DM-339 | SNR-73200W |\n| H1106W | LHB806 | DM-291B | LHB806 |\n| H1106W | LHB906 | DM-291B | LHB906 |\n\n\n# Bot规模分析\n从我们的数据视野看，该botnet的活跃Bot源IP趋势如下：\n![Snip202110630_10](__GHOST_URL__/content/images/2021/06/Snip202110630_10.png)\n\nBot源IP地理位置分布如下，主要集中在美国、韩国和巴西：\n![Snip20210629_1](__GHOST_URL__/content/images/2021/06/Snip20210629_1.png)\n\n\n# 样本分析\n\n本文选取以下样本为主要分析对象\n\n```\nVerdict:mirai_ptea\nMD5:c6ef442bc804fc5290d3617056492d4b\nELF 32-bit LSB executable, ARM, version 1, statically linked, stripped \nPacker:No\nLib:uclibc\n```\n\n```c6ef442bc804fc5290d3617056492d4b```是一个Mirai的变种，基于其使用Tor Proxy和C2通信，以及TEA算法（Tiny Encryption Algorithm）隐藏敏感的资源信息，我们称之为```Mirai_ptea```。Mirai_ptea运行时在会Console输出字串```come at me krebs rimasuta go BRRT```，这就是有的研究人员将它称之为```Rimasuta```的原因，它在主机行为层面和Mirai很相似，并无亮点，因此这方面不再细述；在网络流量层面采用Tor Proxy，样本内嵌了大量的代理节点，而且Tor-C2被加密，下文将着重讨论加密方法和通信协议。\n\n\n\n# 加密算法\n\nMirai_ptea将所有的敏感资源信息加密并按一定的顺序存储，在IDA打开样本看到的字串信息如下所示，几乎没有可读的信息。\n\n\n\n![ptea_strtab](__GHOST_URL__/content/images/2021/06/ptea_strtab.png)\n\n下面的代码片段来自样本中解密相关函数，通过```红框中的常量```可以判定它使用的是TEA算法，\n\n\n<img src=\"__GHOST_URL__/content/images/2021/06/ptea_tea.png\"  width=\"860px\" />\n\n密钥为：\n\n```\n0xC26F6A52 0x24AA0006 0x8E1BF2C5 0x4BA51F8C\n```\n\n\n\n基于逆向分析，我们实现了[**附录**](#decrypt_str)的解密脚本，通过它可以获得所有的解密后的敏感资源以及它们的表项信息，部分资源信息如下所示：\n\n\n<img src=\"__GHOST_URL__/content/images/2021/06/ptea_decinfo.png\"  width=\"860px\" />\n\nMirai_ptea在使用加密资源时有2种操作方式\n- **传统的Mirai方式**，解密一个加密项，取值，加密一个解密后的项，即```var_unlock-->var_get-->var_lock```。例如在获取输出在Console上的信息时，就是通过这种方式。\n![ptea_strtab](__GHOST_URL__/content/images/2021/06/ptea_var.png)\n\n\n表项0x11的值正是```come at me krebs rimasuta go BRRT```。\n\n- **Mirai_ptea的方式**，解密多个加密项，取值，重新加密已解密的项，即```rangeVar_unlock-->var_get-->rangeVar_lock```。例如在获取伪装进程名时，就是通过这种方式。\n\n\n![ptea_strtab](__GHOST_URL__/content/images/2021/06/ptea_rangevar.png)\n表项0x2c到0x2c+10的值如下所示，正是11个供选择的伪装进程名：\n\n```\nindex 0x2c, value = /bin/sh\nindex 0x2d, value = telnetd\nindex 0x2e, value = upnpc-static\nindex 0x2f, value = wsdd\nindex 0x30, value = proftpd\nindex 0x31, value = mini_httpd\nindex 0x32, value = udevd\nindex 0x33, value = /sbin/udhcpc\nindex 0x34, value = boa\nindex 0x35, value = /usr/sbin/inetd\nindex 0x36, value = dnsmasq\n```\n\n# 通信协议\n\nMirai_ptea的网络流量概览如下图所示：\n\n\n<img src=\"__GHOST_URL__/content/images/2021/06/ptea_network.png\"  width=\"860px\" />\n\n整个过程可以分成以下3个步骤：\n\n1：和代理节点建立连接\n\n2：和Tor C2建立连接\n\n3：通过ptea自定义的协议和C2通信，接收C2下发的攻击指令。\n\n### 0x1. 和代理建立连接\n\nMirai_ptea样本中内置了2组代理，它们在加密资源中的表项分别为0x2a,0x2b。Bot样本运行时，会在2组代理中随机选一组，然后在选中的组中随机选一个通过下面代码片段建立连接。\n\n\n<img src=\"__GHOST_URL__/content/images/2021/06/ptea_proxy.png\"  width=\"860px\" />\n\n其中```0x2a```中一共有38个代理节点，格式为```ip:port```\n\n\n<img src=\"__GHOST_URL__/content/images/2021/06/ptea_0x2a.png\"  width=\"860px\" />\n\n而```0x2b```中一共有个334个代理节点，格式为```ip```，这组代理的端口为固定的9050。\n\n\n<img src=\"__GHOST_URL__/content/images/2021/06/ptea_0x2b.png\"  width=\"860px\" />\n\n详细的代理列表见附录。\n\n\n\n### 0x2. 通过Tor-Proxy协议和C2建立连接\n\n\n![ptea_strtab](__GHOST_URL__/content/images/2021/06/ptea_c2.png)\n\n可以看出C2在加密资源中的表项为```0xD```，解密后得到下面字串：\n\n```\nrkz2f5u57cvs3kdt6amdku2uhly2esj7m2336dttvcygloivcgsmxjjnuickasbuatxajrovi4lvd2zjuejivzrb3vobuoezbc6z3gtu6b3r5tce.onion\n```\n\n将上面字串排除尾部的“.onion”后以长度16分割，然后和尾部的```.onion```字串进行拼接，就得到了以下7个C2。\n\n```\nrkz2f5u57cvs3kdt.onion\n6amdku2uhly2esj7.onion\nm2336dttvcygloiv.onion\ncgsmxjjnuickasbu.onion\natxajrovi4lvd2zj.onion\nuejivzrb3vobuoez.onion\nbc6z3gtu6b3r5tce.onion\n```\n\n### 0x3. 通过自定义的协议和C2进行通信，具体的上线，心跳，攻击如下所示\n\n- 上线\n<img src=\"__GHOST_URL__/content/images/2021/06/ptea_reg.png\"  width=\"860px\" />\n\n```\nmsg parsing\n----------------------------------------------------------------\n3e c7 e3 1e 37 47 61 20\t\t\t\t\t\t----->hardcoded msg from Bot\nb1 2f de ce cb 89 e1 a0\t\t\t\t\t\t----->cmd from C2,ask Bot to upload info\n3a 31 34 b5 02 00\t\t\t\t\t\t\t----->hardcoded 6 bytes msg from Bot\nb4 a3 e1 16\t\t\t\t\t\t\t\t\t----->ip of infected device\n04\t\t\t\t\t\t\t\t\t\t\t----->group string length\n74 65 73 74\t\t\t\t\t\t\t\t    ----->group string\n79\t\t\t                                ----->padding\n```\n- 心跳\n<img src=\"__GHOST_URL__/content/images/2021/06/ptea_heart.png\"  width=\"860px\" />\n\n```\nmsg parsing\n----------------------------------------------------------------\n2a 23\t\t\t\t\t\t-----> random 2 bytes msg from Bot\n2a 23\t\t\t\t\t\t-----> random 2 bytes msg from C2\n```\n- 攻击指令，前4字节```AD AF FE 7F```为固定的幻数，剩余部分与mirai的攻击指令格式类似\n\n```\n00000000: AD AF FE 7F 1E 00 00 00  00 01 B9 98 42 65 20 00  ............Be .\n00000010: 42 65 20 00     \n```\n\n# DDoS攻击活动\n从我们的DDoS跟踪系统看，该僵尸网络已经发起实际的DDoS攻击，下图为我们观察到的该僵尸网络的一些DDoS攻击指令：\n<a href=\"__GHOST_URL__/content/images/2021/06/mirai_ptea_atk_cmd_4c.png\"><img src=\"__GHOST_URL__/content/images/2021/06/mirai_ptea_atk_cmd_4.png\" class=\"kg-image\"/></a>\n\n\n# 联系我们\n感兴趣的读者，可以在 [**twitter**](https://twitter.com/360Netlab) 或者通过邮件**netlab[at]360.cn**联系我们。\n\n# IoC\n\n## Tor-C2\n```\nbc6z3gtu6b3r5tce.onion:3742\ncgsmxjjnuickasbu.onion:992\nuejivzrb3vobuoez.onion:5353\nrkz2f5u57cvs3kdt.onion:280\natxajrovi4lvd2zj.onion:110\n6amdku2uhly2esj7.onion:513\nm2336dttvcygloiv.onion:666\n```\n\n## Sample MD5\n\n```\nc6ef442bc804fc5290d3617056492d4b\nf849fdd79d433e2828473f258ffddaab\n```\n\n## Downloader URL\n```\nhttp://193[.177.182.221/boot\n```\n\n## Scanner IP\n```\n205.185.117.21\tAS53667|FranTech_Solutions\tUnited_States|Nevada|Las_Vegas\n205.185.114.55\tAS53667|FranTech_Solutions\tUnited_States|Nevada|Las_Vegas\n68.183.109.6\tAS14061|DigitalOcean,_LLC\tUnited_States|New_York|New_York_City\n67.205.163.141\tAS14061|DigitalOcean,_LLC\tUnited_States|New_York|New_York_City\n165.227.88.215\tAS14061|DigitalOcean,_LLC\tUnited_States|New_York|New_York_City\n```\n\n## Proxys\n```\n---------proxys at index 0x2a，count=38---------\n149.202.9.7:9898\n91.134.216.103:16358\n84.32.188.34:1157\n51.178.185.237:32\n65.21.16.80:23560\n149.202.9.14:19765\n146.59.11.109:5089\n195.189.96.61:29582\n84.32.188.37:1454\n51.195.209.80:26848\n5.199.174.242:27931\n95.179.158.147:22413\n146.59.11.103:1701\n185.150.117.10:29086\n149.56.154.210:24709\n135.148.11.151:3563\n51.195.152.255:25107\n45.79.193.124:7158\n135.148.11.150:5560\n185.150.117.41:20790\n135.125.250.120:14498\n172.106.70.135:692\n195.189.96.60:9700\n172.106.70.134:25054\n149.56.154.211:21299\n108.61.218.205:29240\n51.178.185.236:21685\n51.81.139.251:6255\n51.255.237.164:963\n51.81.139.249:32380\n139.162.45.218:5165\n65.21.16.94:28056\n207.148.74.163:32389\n172.104.100.78:1039\n45.32.8.100:19759\n141.164.46.133:2205\n172.105.36.167:10843\n172.105.180.239:19531\n\n---------proxys at index 0x2b，count=334，port=9050---------\nToo many, not list here, you can get them via the IDA script\n```\n# <a id=\"decrypt_str\">附录（IDA解密脚本）</a>\n```\n# IDAPYTHON SCRIPT for md5 c6ef442bc804fc5290d3617056492d4b only.\n# Tested at ida 7.0\nfrom ctypes import *\nimport struct\nprint \"-------------------decryption start------------------------\"\n\nkey=[0xC26F6A52,0x24AA0006,0x8E1BF2C5,0x4BA51F8C]\ndef tea_dec(buf,key):\n    rbuf=\"\"\n    fmt = '>' + str(len(buf)/4) + 'I'\n    tbuf= struct.unpack_from(fmt,buf)\n    j=0\n    for i in range(0,len(tbuf)/2):\n        \n        v1=c_uint32(tbuf[i+j])\n        v2=c_uint32(tbuf[i+1+j])\n\n        sum=c_uint32(0xC6EF3720)\n        while(sum.value):\n            v2.value -= ((v1.value>>5)+key[3])    ^(v1.value+sum.value)^  ((v1.value<<4)+key[2])\n            v1.value -= ((v2.value>>5)+key[1])   ^(v2.value+sum.value)^ ((v2.value<<4)+key[0])\n            sum.value+=0x61C88647\n        rbuf +=struct.pack(\">I\",v1.value)+struct.pack(\">I\",v2.value)\n        j+=1\n    return rbuf\ndef getbuff(addr):\n    buf = \"\"\n    while idc.get_bytes(addr, 2) != \"\\x00\\x00\":\n        buf += idc.get_bytes(addr, 1)\n        addr += 1\n\n    return buf\n\n\n\n# pay attention to function at 0x0000D074\na=getbuff(idc.get_wide_dword(0x00019C9C))\n\n    \n\nbuf=[]\n#0x19c9c-0x199f0 --> 684\nfor i in range(0,684,12):\n    offset=idc.get_wide_word(0x000199F4+i)\n    length=idc.get_wide_word(0x000199F4+i+2)\n\n    buf.append(a[offset:offset+length])\n    \nc2=[]\n#684/12 --> 57\nfor i in range(57):\n    decbuf=tea_dec(buf[i],key)\n\n    if(\".onion\" in decbuf):\n        c2.append(decbuf)\n    print \"index %x, value = %s\" %(i,decbuf)    \nprint \"-------------------decryption end---------------\"\n\nproxya=tea_dec(buf[0x2a],key)\npacnt=struct.unpack(\"<H\",proxya[2:4])\n\n\nproxy=[]\nport=[]\ntmp=proxya[4:4+6*(pacnt[0])]\nprint \"------------proxys at index 0x2A, count= %d------------\" %(pacnt[0])\nfor i in range(0,len(tmp),6):\n    proxy.append(struct.unpack(\">I\",tmp[i:i+4])[0])\n    port.append(struct.unpack(\"<H\",tmp[i+4:i+6])[0])\nfor i in range(pacnt[0]):\n    a=struct.pack(\">I\",proxy[i])\n    ip=\"\"\n    for j in range(4):\n        ip+=str(ord(a[j]))\n        if j!=3:\n            ip+=\".\"\n    \n    print\"%s:%d\" %(ip,port[i])\n\n\n\nproxyb=tea_dec(buf[0x2b],key)\npbcnt=struct.unpack(\"<H\",proxyb[2:4])\nfmt = '>' + str(pbcnt[0]) + 'I'\ntmp=proxyb[4:4*(pbcnt[0]+1)]\nprint \"------------proxys at index 0x2B, count= %d------------\" %(pbcnt[0])\nxxxxx=struct.unpack(fmt,tmp)\nfor i in xxxxx:\n    a=struct.pack(\">I\",i)\n    ip=\"\"\n    for i in range(4):\n        ip+=str(ord(a[i]))\n        if i!=3:\n            ip+=\".\"\n    print ip\n\n\nprint \"-------------------------onion info--------------\"    \nif len(c2)!=0:\n    for i in c2:\n        \n        pos=i.find(\".onion\")\n\n        for j in range(0,pos,16):\n            print i[j:16+j]+\".onion\"\nelse:\n    print \"Don't find the onion c2\"\n```"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}