Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #14587667
DUT6 - RB800 - v1.3.0 Notes
IP: 172.20.100.38/30
VLAN: 620 (TOR6 gi1/0/14)
ROS: 6.30
Console Server Rack 6 Port 6
LAN VLAN: 621 (TOR6 gi1/0/15)
Tool Versions Used:
ChimayRed 4.12
TshPatcher 1.0.4
Perseus 1.3.0
Generate Perseus (from ICON3):
cd $GENERATED_TOOLS_DIR
python $PERSEUS_BIN -f /flash/rw/hidden -f /flash/etc/rc.d/run.d/S99mcc -f /flash/etc/rc.d/run.d/S99tsh -d /flash/rw/hidden -p /flash/rw/tmp/tshd -S /flash/rw/hidden/startup -s 2 -r /flash/rw/hidden/dont_panic -P /ram/zero -m /flash/rw/small_file.txt -l /flash/rw/large_file.txt $PERSEUS_DEPLOY_PREFIX
Operator Notes:
- Include limitations from Developer's Quick Start Guide
- /proc/pid/stat indicates name of binary
- /proc/pid/smaps reveals the location of the hidden binary
- /proc/pid/exe is a symlink to hidden binary
Test timeline
2/10/2016
- Started configuring scripts to beging Perseus 1.3 testing
2/11/2016
- Netinstall ROS 6.30
Tests to Run:
| ID | Status | Task |
|---|---|---|
| 28 | incomplete | Issue "find /" before and after implanting. Diff the results. |
find / > before.txt
find / > after.txt
bb grep -Fxv -f after.txt before.txt
mcc is visible
| ID | Status | Task |
|---|---|---|
| 1 | complete | lsmod | grep mcc # mcc will appear in list |
| 2 | complete | ls /lib/modules/3.3.5 #no mcc |
| 3 | complete | ls /ram/pckg #no mcc |
Inconsistent hiding
| ID | Status | Task |
|---|---|---|
| 4 | complete | ls /sys/module | grep mcc #mcc should be visible |
| 5 | complete | ls /sys/kernel | grep mcc # mcc should be hidden |
Check netstat for PID/Program name
| ID | Status | Task |
|---|---|---|
| 15 | complete | bb netstat -p |
Check if kallsyms shows 'mcc' and its symbols
| ID | Status | Task |
|---|---|---|
| 16 | complete | cat /proc/kallsyms | bb grep mcc - YES |
Flux appears in firewall connections
| ID | Status | Task |
|---|---|---|
| 6 | incomplete | /ip firewall connection print |
Sequential listing of /proc/pid reveals hidden directories.
| ID | Status | Task |
|---|---|---|
| 7 | complete | Run following script: ./iterate_proc_pids.sh - YES |
#!/bin/ash
i=1
#echo "PIDs in /proc/" > proc_dirs
while [ $i -lt 1000 ];
do
test -d /proc/$i && echo $i >> proc_dirs
i=$((i+1));
done
bb ls -1v /proc > ls_dirs
bb grep -Fxv -f ls_dirs proc_dirs
Check if connection is attempted to cloud.mikrotik.com
| ID | Status | Task |
|---|---|---|
| 8 | incomplete | /system logging add action=echo topics=!ntp,!dhcp,!rip,!snmp |
Inspect Memory (before and after removing Perseus) Haven't figure out way to dump memory on PPC.
| ID | Status | Task |
|---|---|---|
| 9 | incomplete | |
| 10 | incomplete | |
| 11 | incomplete | |
| 12 | incomplete | |
| 13 | incomplete | |
| 14 | incomplete |
|
Verify Files Hidden
| ID | Status | Task |
|---|---|---|
| 0 | complete | bb ps ax | bb grep "[s]tartup" |
| 17 | complete | bb ps ax | grep "[t]sh" |
| 18 | complete | bb ps ax | grep "[f]lx" |
Check if startup scripts appear when TAB pressed: No
| ID | Status | Task |
|---|---|---|
| 24 | complete | cd /flash/etc/rc.d/run.d |
| 25 | complete | ls <tab> |
Check that flux works at gateway
| ID | Status | Task |
|---|---|---|
| 19 | complete | Set flux as gateway. Open browser and go to http://172.20.11.104/whatismyip.php and make sure it returns the IP of your flux node. |
| ID | Status | Task |
|---|---|---|
| 20 | complete | Reboot and check if processes still exist |
| 21 | incomplete | Remove Perseus and inspect for remnants |
| 22 | incomplete | Remove Peseus and check if current running tshd and flx are present |
| 27 | incomplete | Check for zombies processes after deleting Perseus |
| ID | Status | Task |
|---|---|---|
| 23 | incomplete | Re-install Perseus if Perseus is already installed - Perseus will self-delete |
| ID | Status | Task |
|---|---|---|
| 26 | complete | Compare pre- and post-exploit CPU, memory, and disk usage |
- system resource print
- system resource monitor
- system resource print
Pre-Implant resource usage: Post-Implant resource usage:
Note: The disk space used is due to the large version of busybox that was uploaded.