Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #14587667
Test Notes
Device: DUT2 (RB450G)
Test Notes
7/9/2015
- Setup ICON4 VMVirtual Machine for DUT2 testing
- Take baseline measurements of CPU, RAM, and disk space
- Throw CR, Tsh, Flx, and Perseus (Thu Jul 9 16:39:50 UTCCoordinate Universal Time 2015).
- Diff Pre- and Post-Implant resource variables.
7/10/2015
- Turned on console logging (/system logging add action=echo topics=!ntp,!dhcp,!rip)
- Identified Bug: PS-10 - Staring Flux generates Log message
7/13/2015
-
Performed strings on mips bins: startup, zeroize, mcc.ko. Suspicous strings/signatures
- startup: "/sys/kernel/mcc/a", "/sys/kernel/mcc/b", "/proc/%s/exe", "/sys/devices/system/cpu", kernel calls (kobject_put(), kobject_del(), kallsyms_lookup_name(), "/proc/kallsyms"), sys_open(), sys_close()
- zeroize: "/sys/devices/system/cpu", "/dev/null", "/proc/stat"
- mcc.ko: "srcversion=D7C542ACCFAAA60F3C374F7", "version=1.1.0.2", lots of kernel calls (OK for a .ko), "task_nice" (flag to suspend file hiding), "$LC0", "$LC1", "$LC2", "intree=Y", "vermagic=3.3.5"
- Anaylzed each file in Ghidra
- startup: Found installation of .ko in /sys/kernel//mcc (0x00401c58)
- Copied /flash/boot/hidden/busybox to /tmp/busybox
- /tmp/busybox netstat -p
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 172.20.100.10:http 172.20.12.101:33450 ESTABLISHED 226/www
tcp 0 0 172.20.100.10:http 172.20.12.101:33425 ESTABLISHED 226/www
tcp 0 0 172.20.100.10:12345 172.20.12.101:59187 ESTABLISHED -
tcp 0 0 router:http 192.168.20.2:36362 ESTABLISHED 226/www
tcp 0 0 172.20.100.10:47071 172.20.12.101:443 ESTABLISHED 450/bash
- 450/bash and - in the PID/Program (flux and tshd respectively) list is suspicous - bash does not open sockets, and blank should never be displayed for legitmate connections.