Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #13205547
Testing Notes
TP Visit Notes
- Need ADSL required equipment
- Check baud rate if you want to console in vice web access
- Attack is chatty.. CIConcern note
- Deb 8.1 used as CP in testing
- Turn off beacon by setting interval to 0
- Start with section 5
- Recommend not using survey / redir at the same time
Equipment Setup
- DUT placed in rack six, TOP RF enclosure
- Use APCAsynchronous Procedure Call to manage (10.9.8.211) device power
- DSLAM + PPoE required for ADSL
- Leverage Perseus testing setup
- Spun up VMVirtual Machine on Cannoli LANLocal Area Network for initial setup
- VLAN 611
- New password = password
- Initial power on CPU = 4%
- Initial power on Memory Usage = 23%
9-30-15
- Continued infrastructure setup
- Altered Perseus LANLocal Area Network setup - connect TOR 1/0/2 to ZyXEL LAN
- Changed IP address of ZyXEL LANLocal Area Network to 192.168.88.17/24
- Troubleshooting ADSL connectivity to DSLAM and PPoE VM
- Using VMVirtual Machine #5 from Perseus setup to manage ZyXEL (also a flux node)
- Attempted to alter Zexel config to match .sh file on PPoE VM, unsuccessful
10-1-15
- Continued infrastructure setup
- User #75473 helping troubleshoot
- Config file on PPPoE VM is located in /etc/ppp/chap-secret
10-2-15
- Infrastructure setup 95% complete
- ICON box for C2 using Debian 8.1
- 2 flux nodes - due to physical limitations, did not run the microtik directly to the LANLocal Area Network side of the ZyXel (only two total ports on RF enclosure)
- ZyXel WANWide Area Network through the DLSAM / PPoE server
10-5-15
- Beginning Testing
- **Operational Use Note -
In order for PandaSneeze to execute, the device must allow Telnet access from the attack host. This access is configurable to allow some combination of LANLocal Area Network and/or WANWide Area Network access. If the Range radio button is selected (only available when WANWide Area Network access is enabled), the attack host IP must fall within one of the listed ranges.
Begin with BuzFuz Operations Notes Document, section 5
- Install PandaSneeze
- Create a backdoor for C2 with the device
- run initial attack from /attack directory (~/Tool CD/Binaries_UNCLASS/adhoc/attack# ./setup-eS2s1_340UL05 -I 192.168.88.17
- Must specific password otherwise it will use device default (1234) and time out and you'll get - ERROR: Remote device timed-out, displaying the following message: ****
- Used -p flag to specify "password" as correct password, successful connection (took approximately 5 minutes to complete)
- device_id = 0xc0a85811 (should be changed n init file)
- verified that system.log file is successfully created in the active working directory