Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #14587667
Bumble - Test Notes
6/19/2015
- Installed HP MSR 4080 chassis in Rack 2/Pod 4.
- Installed MPU-100 (x2), and SPU-100 cards into MSR 4080 chassis.
6/23/2015
- Racked and Setup console access for Cisco 2911 and 3845 in Rack 2 to use for Bumble testing.
- Configure E1 cards in 2911:
HWIC0 (2E1): card type e1 0 0
HWIC1 (1E1): card type e1 0 1
- Configure E1 cards in 2911:
- Created RANCID project for Bumble network devices. Added 2911, 3845.
- Added static route to 10.9.8.0/24
- Setup MSR
- Configure static IP, static route to 10.9.8.0/24, NTPNetwork Time Protocol client
6/24/2015
- Requested POS card and E1 cables (MSR (DB15) <-> Cisco (RJ48C)) from User #73722.
7/10/2015
- Installed 4-port E1 card in MSR
- Racked Cisco 3825 (from old cabinet) and 2811 (from NDBNetwork Devices Branch lab). Configured console server and connected ethernet cables to TOR2 gi1/0/5-6.
- Backed up original 2811 config and connected to network (IP = 172.20.100.226)
7/16/2015
- Configured MSR to Cisco E1 links
7/17/2015
- Configured MSR to Cisco Mutilink ppp lines (3E1).
- Installed 1E1 HWIC into 2811. Upon reboot, the 2811 gives a memory error and will not boot.
7/18/2015
- Installed 2E1 HWIC in 3845. Removed old 1E1 HWIC.
- Configured 4E1 on 3845 (IP = 8.10.1.30) and MSR.
- Determine OSPFOpen Shortest Path First configuration in target config.
osfp 1
import-route direct # Redistribute networks of local active interfaces
import-route static #Redistribute static routes
area 0.0.0.0
network 192.168.168.4 0.0.0.3 #Enable OSPFOpen Shortest Path First on the interface attached to this network
7/30/2015
- Configured SNMPSimple Network Management Protocol on MSR and SolarWinds.
- Configured 3825 (NE40 surrogate).
7/31/2015
- Configured netstream on MSR. Confirmed int gi2/0/0 is being monitored by solardwinds.
- Completed SNMPSimple Network Management Protocol configuration on MSR.
- Configured lo0, 1, and 2 on 3825.
- Configured OSPFOpen Shortest Path First on 3825 and MSR.
8/3/2015
- Configured loopback interfaces on 3845, 2911, 3825.
- Configured ACLs on MSR.
8/4/2015
- Add NM ESW card to 3825 and configure host switchports. Advertised XXX.XXX.XXX.X (DNIC-RNET-192-100-100[US])/24 and XXX.X.XXX.X (JUMPSTART-5[US])/24 on OSPF.
- Created host VMs for Attack side of network.
- Spoke with GYSON regarding current test network setup.
8/5/2015
- Installed PoS card in ASR1002.
- Configured Mgt int on ASRAzure Site Recovery and added to RANCID. Configured NTPNetwork Time Protocol client.
- Configured loopbacks on ASR.
- Backup and replace 2811. Replaced CF card. Install and configure E1 card on new 2811.
8/10/2015
- Configured DelaySim using tc
### Since the following parameters are applied on both interfaces, the effective properties are as follows:
# Delay: 5s +/- 1s with a normal distribution (default)
# Packet Loss: 50% of packets will be randomly dropped and each successive probability depends by 25% on the last one
# Packet Duplication: 3%
# Packet Corruption: 1% of all traffic
# Packet Reordering: first 25% of packets (with a correlation of 50%) will get sent immediately
sudo tc qdisc add dev eth0 root netem delay 2.5s 0.5s loss 25% 25% duplicate 1.5% corrupt 0.5% reorder 12.5% 50%
sudo tc qdisc add dev eth1 root netem delay 2.5s 0.5s loss 25% 25% duplicate 1.5% corrupt 0.5% reorder 12.5% 50%
- Created Seeds VMs for 2911,2811,3845, and ASR.
- Configured and tested POS interfaces on ASRAzure Site Recovery (had to create 2 VRFs)
8/11/2015
- Configured TOR2 switch and vCenter with VLANs for IXIA connection
- Added FastEthernet HWIC to 2851 to used for Seeds/IXIA network.
- Upgraded 2851 IOSApple operating system for small devices to 15.0 in order to support Fa HWIC
8/12/2015
- Created/configured VMs for Bumble testing
- Updated MSR with target changes (specifically ACLs)
8/13/2015
- Configure QoS policy on MSR.
- Upgraded Cisco 3825 IOSApple operating system for small devices to 15.1. Installed Fa HWIC in 3825 (.111 and .112).
- Configured 3825
- Added 2 web servers behind 3825.
8/14/2015
- Unpack/rack H3C
- Ran patch cables from Core Rack (R3) to Rack 2 for Ixia testing.
8/17/2015
- Configure Windows Server 2003 VMVirtual Machine IP settings. Setup FTPFile Transfer Protocol server.
8/21/2015
- Installed Bumble on MSR.
- CT 2.4 which was delieved is not compatible with current ICON image (Debian 7.8)
8/24/2015
- Downloaded and installed Ubuntu Server 10.04. This is the library version that was delievered with Bumble.
- Performed smoke test of Bumble.
- Added survey commands:
tp survey create 192.0.0.0 255.0.0.0 0 0.0.0.0 0.0.0.0 0 icmp -en
tp survey create 192.0.0.0 255.0.0.0 0 0.0.0.0 0.0.0.0 0 tcp -en
- Added redir rules:
- redir create 10.1.243.2 255.255.255.255 0 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 255.255.255.255 0 0 tcp 10.1.243.2 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 0 0 -en
- Potential bug:
- Add survey and redir rule.
- redir create 10.1.243.2 255.255.255.255 0 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 255.255.255.255 0 0 tcp 10.1.243.2 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 0 0 -en
- tp survey create XXX.X.XXX.X (JUMPSTART-5[US]) 255.255.255.0 0 0.0.0.0 0.0.0.0 0 tcp -en
- Test redir.
- Run Ixia test.
- Test redir. If redir fails, then re-try this sequence, but this time without adding the survey rules. I wonder if the survey transaction log is filling causing the redir rule to stop working. The translog stopped at index 4000 (is this coincidence or is this the size of the buffer?).
- Add survey and redir rule.
8/25/2015
- Setup IXIA for testing through multiple interfaces.
8/26/2015
- Tweaked IXIA to test through MSR with endpoints on neighboring devices.
- Setup and began 72 hour test through all neighbors. Score was active on DUT, but no redir/survey rules were created.
8/31/2015
- Checked IXIA test. The test "failed" according to the IXIA, however, the H3C did not reboot/crash.
- Reconfigured interface - No observables.
9/1/2015
- Wrote expect scripts to install patch.bin file and add a redir rule.
| ID | Status | Task |
|---|---|---|
| 16 | incomplete | Potential Bug: When running my expect script, copying the patch.bin file timed out. Afterwards I attempted to reboot the H3C and it gave the following message: 
|
| 17 | incomplete | Potential Bug: It appears that if the patch.bin file exists on cfa0: and you attempt to copy it again, it "copies" indefinitely. Issuing the command "dir cfa0:" shows that the patch.bin file size is 0. This may occurr when the patch file was incompletely applied. |
9/3/2015
- MTU settings
- CT MTUMaximum Transmission Unit setting can not go below 120 bytes.
- Egress from Atk setting delaysim MTU<=108 and CTCounter Terrorism MTU<128 allows CTCounter Terrorism to connect, but states "currenct packet size restrictions are incompatible with selected Score protocol".
- Ingress to Atk MTU<=508Bytes.
- Phone Call with User #73721:
- score requires a minimum MTUMaximum Transmission Unit of 480Bytes for return traffic (from implant to CTCounter Terrorism).
- There is an undefined parameter in the ilm.txt file to configure the the Commx Rx size (CommsMaxIpRxSize)
- Performed individual commands while running tcpdump to capture return packets from implant to route. These captures depict each packet size for the UDPUser Datagram Protocol packets coming back in response to C2.
9/4/2015
- Modified expect scripts to automate the following: reboot MSR, install implant, and run score survey test.
- Add IXIA ports directly to MSR. Need to determine IPs to use (look at config).
- Configure IXIA "hosts" to test connectivity to WWW1 and WWW2 (XXX.X.XXX.XXX (JUMPSTART-5[US]) & .112).
- Backup MSR config
- Copy off MSR f/w
- Upload MSR f/w
Operator Notes
- Do not use survey and redirection at the same time.
ToDo:
| ID | Status | Task |
|---|---|---|
| 14 | incomplete | User #14587667 Delete default route on all routers (except MSR) after testbed complete (Not sure I should do this). May just test redirection traversing an ACL. Nieghboring routers probably have routes back to the H3C, however secondary neighbors may not have routes back. May be useful to re-configure testbed to have secondary routers that don't have routes back to H3C. |
| 15 | complete | User #14587667 Get 2800 router from NDBNetwork Devices Branch Lab (R6/U27) |
| 6 | complete | User #14587667 Put 1E1 HWIC in 2800 router |
| 7 | complete | User #14587667 Setup SNMPSimple Network Management Protocol on solarwinds and configure MSR. |
| 8 | complete | User #14587667 Setup loopbacks on MSR neighbor routes. Use downstream IPs from MSR static routes. |
| 5 | complete | User #14587667 Configure syslog server |
| 3 | complete | User #14587667 Configure OSPFOpen Shortest Path First on MSR |
| 10 | complete | User #14587667 Configure OSPFOpen Shortest Path First on Cisco (Grabe new router and use Gig int for OSPFOpen Shortest Path First - per target config). Use IP 192.168.168.5/30 on MSR and 192.168.168.6 on Cisco. |
| 2 | complete | User #14587667 Configure E1 links |
| 11 | incomplete | User #14587667 Configure netstream on MSR interface to TRCore (in-/out-bound). |
| 12 | incomplete | User #14587667 Configure netstream on MSR interface to 2911 (inbound). |
| 13 | complete | User #14587667 Confirm netflow is being collect by SolarWinds |