g01exploit-dga.rb

#! /usr/bin/env ruby

DOMAINS = %w(.doesntexist.com .dnsalias.com .dynalias.com)

DICT = %w(as un si speed no r in me da a o c try to n h call us why q
          k old j g how ri i net t ko tu host on ad portal na order b ask l s d
          po cat for m off own e f p le is)

DICT_LEN = DICT.length        
                
ts = Time.now.utc

c0 = ts.hour
c1 = ts.day   + c0
c2 = ts.month + c1 - 1
c3 = ts.year  + c2

d0 = c0 % DICT_LEN
d1 = c1 % DICT_LEN
d2 = c2 % DICT_LEN
d3 = c3 % DICT_LEN

d1 = (d1 + 1) % DICT_LEN if d0 == d1
d2 = (d2 + 1) % DICT_LEN if d1 == d2
d3 = (d3 + 1) % DICT_LEN if d2 == d3

domain    = DOMAINS[c0 % DOMAINS.length]
subdomain = [ d0, d1, d2, d3 ].map { |x| DICT[x] }.join

name = subdomain + domain

puts name