Vault7: CIA Hacking Tools Revealed

Navigation: » Latest version

Owner: User #13205547

Testing Notes

TP Visit Notes

Need ADSL required equipment
Check baud rate if you want to console in vice web access
Attack is chatty.. CIConcern note
Deb 8.1 used as CP in testing
Turn off beacon by setting interval to 0
Start with section 5
Recommend not using survey / redir at the same time

Equipment Setup

DUT placed in rack six, TOP RF enclosure
Use APCAsynchronous Procedure Call to manage (10.9.8.211) device power
DSLAM + PPoE required for ADSL
Leverage Perseus testing setup
Spun up VMVirtual Machine on Cannoli LANLocal Area Network for initial setup
- VLAN 611
- New password = password
Initial power on CPU = 4%
Initial power on Memory Usage = 23%
Verified correct OSOperating System on the box
backed up existing configuration and loaded operational configuration with the assumption that operationally they used default LANLocal Area Network IP, lost access
Restored to factory default and reloaded backed up config
default password is admin

9-30-15

Continued infrastructure setup
Altered Perseus LANLocal Area Network setup - connect TOR 1/0/2 to ZyXEL LAN
Changed IP address of ZyXEL LANLocal Area Network to 192.168.88.17/24
Troubleshooting ADSL connectivity to DSLAM and PPoE VM
Using VMVirtual Machine #5 from Perseus setup to manage ZyXEL (also a flux node)
Attempted to alter Zexel config to match .sh file on PPoE VM, unsuccessful

10-1-15

Continued infrastructure setup
User #77447 helping troubleshoot
Config file on PPPoE VM is located in /etc/ppp/chap-secret

10-2-15

Infrastructure setup 95% complete
- ICON box for C2 using Debian 8.1
- 2 flux nodes - due to physical limitations, did not run the microtik directly to the LANLocal Area Network side of the ZyXel (only two total ports on RF enclosure)
- ZyXel WANWide Area Network through the DLSAM / PPoE server

10-5-15

Beginning Testing
**Operational Use Note -
In order for PandaSneeze to execute, the device must allow Telnet access from the attack host. This access is configurable to allow some combination of LANLocal Area Network and/or WANWide Area Network access. If the Range radio button is selected (only available when WANWide Area Network access is enabled), the attack host IP must fall within one of the listed ranges.

Begin with BuzFuz Operations Notes Document, section 5

Install PandaSneeze

Create a backdoor for C2 with the device
run initial attack from /attack directory (~/Tool CD/Binaries_UNCLASS/adhoc/attack# ./setup-eS2s1_340UL05 -I 192.168.88.17
Must specific password otherwise it will use device default (1234) and time out and you'll get - ERROR: Remote device timed-out, displaying the following message: ****
Used -p flag to specify "password" as correct password, successful connection (took approximately 5 minutes to complete)
device_id = 0xc0a85811 (should be changed n init file)
verified that system.log file is successfully created in the active working directory

Establish Command and Control
1. move into .. /adhoc/tp directory for C2
2. ./prep-ct.sh
3. launch CTCounter Terrorism - ./CutThroat
4. load libtpilm_Release.so
5. successfully ran "ilm connect ilm.txt" command
6. module show reveals paw and lbd available
  1. paw is active
  2. lbd STOPPED
7. Checked CPU and Memory stats of device - 2% CPU, 24% memory - normal ranges
Load PandaScoreLE Dynamicalyl

Ran - module add scorele -e - successfully loaded module
module show indicates scorele is active
Ran - tp cmd score ping successfully (validated comms with module)
looked through available commands, all referenced in documentation are present in module

Create and Test Survey Rule

ran continuous ping from perseus #5 to 4.4.4.4
created survey rule to capture all traffic (all 0's) - success
capture ID value of rule - 1
ran - redir enable 1 - successful
Question - is target using NAT? how does this impact test? maybe not at all since we're coming from LANLocal Area Network side
ran - tp showtrans - successfully displayed output of ping and other traffic - captured to desktop doc (end day 10-5)

Test Redirection
1. unable to browse to cnn.com / google.com and cover server
2. updated resolveconf file to include static entry for "nameserver 4.4.4.4"
3. made web request for www.google.com from Perseus #5 192.168.88.2 and observed web request in wireshark
  1. typical DNSDomain Name System A record request sent to nameserver
  2. standard TCPTransport Control Protocol setup and HTTPHypertext Transfer Protocol request
  3. web page resolved normally
4. re-established CTCounter Terrorism session with target
5. performed module show command, scoreLE is present
6. created rule to redirect all hosts on the LANLocal Area Network - redir create
7. Progress interrupted, tried to load operational config, guessed at LANLocal Area Network IP, failed, had to reset to factory default and use backup config to restore
8. Attempted CTCounter Terrorism session, failed, attempted to re-establish backdoor but failed - time out error
9. Connectivity to flux node #2 is through the ZyXel, when ZyXel is rebooted, need to rebuild flux node two - need to manually restart or build watchdog (set for 5 mins) (also need to rebuild bridge)
10. **Observation when running a module add socrele command - wireshark shows a bunch of UDPUser Datagram Protocol traffic on the fw0 interface coming from the GW flux node (192.168.88.2)
11. created redir reule to route traffic from BuzFuz host 192.168.88.2 destined to X.X.X.XX (LVLT-GOGL-8-8-8[US]) (www.google.com) to new destination web server 172.20.13.20 (cover server)
12. enable rule, browsed to www.google.com - successfully redirected to cover server 172.20.13.20
13. **Refreshed web page several times to observe CPU and memory - CPU up to 11%, memory up to 35%
14. **Observation with redirection enabled and actively in use - wireshark on local host (host being redirected) shows 6 DNSDomain Name System request packets sourced from local host to DNSDomain Name System server repeated several times. With redirection disabled, this does not occur.
15. Checked tp showtrans and saw correct entries
16. cleared trans table
Test Beacon
1. PandaMitt is the BuzFuz tool handler
2. Configured blot and blot proxy - 172.20.13.35 / 36
3. mounted share drive for access to gzip with pandamitt
4. adjusted beastbox settings on the proxy blot server and loaded pandamitt onto the tool handler
5. configured brawl.cfg and beastbox.cfg for communication with the implant (configs saved on VMVirtual Machine)
6. Updating the ilm.txt file to include correct "ScoreLE parameters" for DNSDomain Name System beacons
7. (if fluxnode goes down need to reset the bridge and gw)
8. performed "module stop scorele"
9. rebuilt ilm.txt with correct parameters
10. built new zone in bind server
  1. zone "buzfuz.com" { type master; file "/etc/bind/db.buzfuz.com";
  2. db.buzfuz.com
11. turned off iptables on proxy server
12. Successfully beaconed and reviewed beacon files
  1. /home/turbopanda/Mitt/data/c0a85811/Light/receive
  2. more 20151016183258_0000000326.rcvd
Test Uninstall

must stop scorele module - module stop scorele
uninstall successful - device stop
CPU / Memory returned to original values 4%/24% respectively
no entries recorded on device log

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks

Vault7: CIA Hacking Tools Revealed

Testing Notes

e-Highlighter