How Tor Browser knows that a directory server is legit? Does it have their certificates hardcoded?
I assume that you downloaded a valid copy of Tor or Tor Browser. The source code contains information about all current directory authorities. (
config.c). Currently there are nine authorities which you can also find within Atlas.
This file contains an IP address as well as the fingerprint of the authorities. When the client connects to the authorities it will check the fingerprint. It is not possible for an attacker to reproduce this fingerprint. Here are some further discussions about what happens when nodes are compromised or taken down.