Script for finding XOR value used to calculate Bunitu CnC's IP

cnc_gen.py

#!/usr/bin/env python2.7
"Script for finding XOR value used to calculate CnC's IP (for Bunitu)"

__AUTHOR__ = 'hasherezade'
__VERSION__ = '0.1'

import sys
import time
import struct
import socket
import random
import argparse

#XORVALUE = 0x32BC236F # 0x16ec1a31 # old: 0x13107579

def get_xor(orig_hostname, cnc_hostname):
    orig_ip = socket.gethostbyname(orig_hostname)
    cnc_ip = socket.gethostbyname(cnc_hostname)
    
    b_orig_ip = struct.unpack('<L', socket.inet_aton(orig_ip))[0]
    b_cnc_ip = struct.unpack('<L', socket.inet_aton(cnc_ip))[0]
    print "\torig_ip = %x" % b_orig_ip
    print "\tcnc_ip = %x" % b_cnc_ip
    xorv = b_orig_ip ^ b_cnc_ip
    return xorv

def c2_ip(hostname, xorval):
    orig_ip = socket.gethostbyname(hostname)
    b_orig_ip = struct.unpack('<L', socket.inet_aton(orig_ip))[0]
    b_cnc_ip = b_orig_ip ^ xorval
    print "\tcnc_ip = %x" % b_cnc_ip
    return socket.inet_ntoa(struct.pack('<L',b_cnc_ip))
    
####

def main():
    parser = argparse.ArgumentParser(description="Script for finding XOR value used to calculate CnC's IP")
    parser.add_argument('--host', dest="orig_host",default=None, help="Queried Host", required=True)
    parser.add_argument('--cnc', dest="cnc_host",default=None, help="C&C Host")
    parser.add_argument('--xorval', dest="cnc_xorval",default=None, help="XOR value used to resolve C&C IP")
    args = parser.parse_args()
    orig_hostname = args.orig_host
    xorv = None
    if args.cnc_xorval is not None:
        xorv = int(args.cnc_xorval,16)
        print "XOR = %x" % xorv
    
    orig_ip = socket.gethostbyname(orig_hostname)
    print "Queried IP: %s" % (orig_ip)
    if args.cnc_host:
        xorv = get_xor(orig_hostname, args.cnc_host)
        print "XOR = %x" % xorv
    
    target_ip = c2_ip(orig_hostname, xorv)  
    print "C&C: %s" % (target_ip)

if __name__ == '__main__':
    sys.exit(main())