Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #14587667
Bumble 3.0.0 Test Notes
Test Summary
- Downloaded and installed Ubuntu Server 10.04. This is the library version that was delievered with Bumble.
- CT 2.4 which was delieved is not compatible with current ICON image (Debian 7.8)
- MTU settings
- CT MTUMaximum Transmission Unit setting can not go below 120 bytes.
- Egress from Atk setting delaysim MTU<=108 and CTCounter Terrorism MTU<128 allows CTCounter Terrorism to connect, but states "currenct packet size restrictions are incompatible with selected Score protocol".
- Ingress to Atk MTU<=508Bytes.
- score requires a minimum MTUMaximum Transmission Unit of 480Bytes for return traffic (from implant to CTCounter Terrorism).
-
Progress/Notes
- Added survey commands:
tp survey create 192.0.0.0 255.0.0.0 0 0.0.0.0 0.0.0.0 0 icmp -en
tp survey create 192.0.0.0 255.0.0.0 0 0.0.0.0 0.0.0.0 0 tcp -en
- Added redir rules:
- redir create 10.1.243.2 255.255.255.255 0 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 255.255.255.255 0 0 tcp 10.1.243.2 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 0 0 -en
- Potential bug:
- Add survey and redir rule.
- redir create 10.1.243.2 255.255.255.255 0 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 255.255.255.255 0 0 tcp 10.1.243.2 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 0 0 -en
- tp survey create XXX.X.XXX.X (JUMPSTART-5[US]) 255.255.255.0 0 0.0.0.0 0.0.0.0 0 tcp -en
- Test redir.
- Run Ixia test.
- Test redir. If redir fails, then re-try this sequence, but this time without adding the survey rules. I wonder if the survey transaction log is filling causing the redir rule to stop working. The translog stopped at index 4000 (is this coincidence or is this the size of the buffer?).
- Add survey and redir rule.
- Setup IXIA for testing through multiple interfaces.
- Setup and began 72 hour test through all neighbors. Score was active on DUT, but no redir/survey rules were created.
- Reconfigured interface - No observables.
ID | Status | Task |
---|---|---|
16 | incomplete | Potential Bug: When running my expect script, copying the patch.bin file timed out. Afterwards I attempted to reboot the H3C and it gave the following message: |
17 | incomplete | Potential Bug: It appears that if the patch.bin file exists on cfa0: and you attempt to copy it again, it "copies" indefinitely. Issuing the command "dir cfa0:" shows that the patch.bin file size is 0. This may occurr when the patch file was incompletely applied. |
- Add IXIA ports directly to MSR. Need to determine IPs to use (look at config).
- Configure IXIA "hosts" to test connectivity to WWW1 and WWW2 (XXX.X.XXX.XXX (JUMPSTART-5[US]) & .112).
- Backup MSR config
- Copy off MSR f/w
- Upload MSR f/w
Operator Notes
- Do not use survey and redirection at the same time.
ToDo:
ID | Status | Task |
---|---|---|
14 | incomplete | User #14587667 Delete default route on all routers (except MSR) after testbed complete (Not sure I should do this). May just test redirection traversing an ACL. Nieghboring routers probably have routes back to the H3C, however secondary neighbors may not have routes back. May be useful to re-configure testbed to have secondary routers that don't have routes back to H3C. |
15 | complete | User #14587667 Get 2800 router from NDBNetwork Devices Branch Lab (R6/U27) |
6 | complete | User #14587667 Put 1E1 HWIC in 2800 router |
7 | complete | User #14587667 Setup SNMPSimple Network Management Protocol on solarwinds and configure MSR. |
8 | complete | User #14587667 Setup loopbacks on MSR neighbor routes. Use downstream IPs from MSR static routes. |
5 | complete | User #14587667 Configure syslog server |
3 | complete | User #14587667 Configure OSPFOpen Shortest Path First on MSR |
10 | complete | User #14587667 Configure OSPFOpen Shortest Path First on Cisco (Grabe new router and use Gig int for OSPFOpen Shortest Path First - per target config). Use IP 192.168.168.5/30 on MSR and 192.168.168.6 on Cisco. |
2 | complete | User #14587667 Configure E1 links |
11 | incomplete | User #14587667 Configure netstream on MSR interface to TRCore (in-/out-bound). |
12 | incomplete | User #14587667 Configure netstream on MSR interface to 2911 (inbound). |
13 | complete | User #14587667 Confirm netflow is being collect by SolarWinds |
1 | incomplete |