Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #14587667
Test Notes
Device: DUT2 (RB450G)
Test Notes
7/9/2015
- Setup ICON4 VMVirtual Machine for DUT2 testing
- Take baseline measurements of CPU, RAM, and disk space
- Throw CR, Tsh, Flx, and Perseus (Thu Jul 9 16:39:50 UTCCoordinate Universal Time 2015).
- Diff Pre- and Post-Implant resource variables.
7/10/2015
- Turned on console logging (/system logging add action=echo topics=!ntp,!dhcp,!rip)
- Identified Bug: PS-10 - Staring Flux generates Log message
7/13/2015
-
Performed strings on mips bins: startup, zeroize, mcc.ko. Suspicous strings/signatures
- startup: "/sys/kernel/mcc/a", "/sys/kernel/mcc/b", "/proc/%s/exe", "/sys/devices/system/cpu", kernel calls (kobject_put(), kobject_del(), kallsyms_lookup_name(), "/proc/kallsyms"), sys_open(), sys_close()
- zeroize: "/sys/devices/system/cpu", "/dev/null", "/proc/stat"
- mcc.ko: "srcversion=D7C542ACCFAAA60F3C374F7", "version=1.1.0.2", lots of kernel calls (OK for a .ko), "task_nice" (flag to suspend file hiding), "$LC0", "$LC1", "$LC2", "intree=Y", "vermagic=3.3.5"
- Anaylzed each file in Ghidra
- startup: Found installation of .ko in /sys/kernel//mcc (0x00401c58)
- Copied /flash/boot/hidden/busybox to /tmp/busybox
- /tmp/busybox netstat -p
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 172.20.100.10:http 172.20.12.101:33450 ESTABLISHED 226/www
tcp 0 0 172.20.100.10:http 172.20.12.101:33425 ESTABLISHED 226/www
tcp 0 0 172.20.100.10:12345 172.20.12.101:59187 ESTABLISHED -
tcp 0 0 router:http 192.168.20.2:36362 ESTABLISHED 226/www
tcp 0 0 172.20.100.10:47071 172.20.12.101:443 ESTABLISHED 450/bash
- 450/bash and - in the PID/Program (flux and tshd respectively) list is suspicous - bash does not open sockets, and blank should never be displayed for legitmate connections.
-
# /tmp/busybox nice -n +13 /tmp/busybox ps
444 root 140:39 /flash/boot/hidden/tshd-mipsbe
399 root 479267 ./mt-mipsbe-flx_node_icon4
202 root 0:47 /flash/boot/hidden/tshd-mipsbe
200 root 8993:2 /flash/boot/hidden/startup
/tmp/busybox nice -n +13 /tmp/busybox cat /proc/399/cmdline
./mt-mipsbe-flx_node_icon4# /tmp/busybox nice -n +13 /tmp/busybox ls -al /proc/399/cwd/
total 1498
drwxr-xr-x 1 root root 2048 Mar 6 06:17 .
drw-rw-rw- 1 root root 2048 Jan 1 00:00 ..
-rwxr-xr-x 1 root root 1124272 Mar 6 06:17 busybox
-rw-r--r-- 1 root root 11192 Mar 6 06:17 mcc.ko
-rwxr-xr-x 1 root root 97664 Mar 6 06:36 mt-mipsbe-flx_node_icon3
-rwxr-xr-x 1 root root 97664 Mar 7 01:05 mt-mipsbe-flx_node_icon4
-rwxr-xr-x 1 root root 93676 Mar 6 06:17 startup
-rwx--x--x 1 root root 42860 Mar 6 06:17 tshd-mipsbe
-rwxr-xr-x 1 root root 61112 Mar 6 06:17 zero- Can ls /proc/200 and see everything, however ls /proc does not show above PIDs
- /tmp/busybox top - none of the above processes shown
Brute force /proc:
#!/bin/ash
i=1;
while [ $i -lt 500 ]; do
/tmp/busybox echo -n "/proc/$i/cmdline: "
/tmp/busybox cat /proc/$i/cmdline;
/tmp/busybox echo;
let i=$i+1;
done
Result snip:
/proc/200/cmdline: /flash/boot/hidden/startup
/proc/202/cmdline: /flash/boot/hidden/tshd-mipsbe
/proc/399/cmdline: ./mt-mipsbe-flx_node_icon4
(more...)
/proc/421/cmdline: ./mt-mipsbe-flx_node_icon4