Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #13205547
JQJTHRESHER
Date
Attendees
-
User #13205547, User #14587612, User #11629142, User #14587667, User #71467, User #1179928, User #1179907, User #14588536
Goals
Successfully test 2960-S in Test Range environment
Action Items
Item | Who | Notes |
---|---|---|
Coordinate with Bartwell | User #74502 / User #74499 |
|
Transfer VMs | User #74500 |
|
Get 2960S from PW | User #74501 |
|
Discuss test scope | Team |
|
Build out infrastructure | User #72905 / TR Team |
|
Progress / Notes
- TR team has performed initial review of configuration and Ops provided diagrams
- TR team is moving required VMs at this time
- Created Blot-Proxy, Blot-Onslaught, Blot-CoverWeb, ICON-CutThroat VMs. Copied Fedora10-hg2960-Seeds VMVirtual Machine from NDBNetwork Devices Branch Lab to use for seed traffic.
- Built test network with 2960S-24TS-L target switch, 3750G-24T Router and 3 2960-24TT-L switches.
- Upgraded IOSApple operating system for small devices on target 2960S switch to c2960s-universalk9-mz.122-55.SE7.bin. Updated confiugration to match config obtained from COG.
- Uploaded Aquaman delivery package to ICON-CutThroat VMVirtual Machine and installed in /home/ubuntu.
- Successfully attacked target 2960S switch with SSHIAC and installed Hun-Grrr. Note:
- On ICON-CutThroat VMVirtual Machine - had to move to Devlan temporarily to download the ia32-lib from the repo in order for SSHIAC to run
- Must enable the root account and su - root in each window you use when you attack with SSHIAC and use CutThroat
- Modified Seeds scripts on Fedora10-hg2960-Seeds VMVirtual Machine to generate ICMP/ARP, DNSDomain Name System and HTTPHypertext Transfer Protocol traffic in our test network.
- Working on getting comms up between Hun-Grrr and ICON-Cuthroat VM.
- IXIA added to the topology for traffic generation. Port 11 on IXIA to 0/1 on 3750 and IXIA Port 20 to 2960S 1/0/24
- Re-configured topology based on latest 2960 configs from BARTWELL