11 ms·

EquationGroup Tool Leak – ExtraBacon Demo

147 points by ianhawes 10y ago

shishiwakamaru 10y ago
without the enable password, you can't do much
- agnokapathetic 10y ago
  except pivot into a higher-privileged management network full of juicy--and typically totally unpatched--Out-of-Band management equipment (consoles, IPMI, industrial gear)
- Zombieball 10y ago
  Could you elaborate to those of us not familiar with Cisco routers? My understanding is this exploit disables password authentication and allows you to access the device. A seperate command allows you to re-enable it. Would this re-enabling kill your current connection? Is the password later needed to change settings on the router (like if you typed sudo and are forced to re-authenticate)?
  - XORcat 10y ago
    In my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.
  - tmm 10y ago
    The "enable" password is sort of like the root account on Cisco gear. When you first connect, you're in a low-priv state where you can do simple things like see the uptime of the device, interface info, etc. But to make any changes to the settings on the router, you have to run the "enable" command which typically asks for a password which is separate from the login password. I guess the name comes from enabling admin functionality, but I don't know why Cisco didn't call the command admin. Anyway, this enable is different from enabling/disabling the login authentication.
  - a2tech 10y ago
    On a Cisco router you login via SSH or Telnet, then you run a command to become 'enabled'. enable is a command like sudo on Linux-it elevates your permission level so you can make changes (although not all changes require you to be enabled, most do). If you used ExtraBacon to clear the login user/password you would get a basic shell on connection. This would open at least 2 options to you as an attacker-1) using a local exploit to become an enabled user and 2) you can now send traffic to ALL the networks that the firewall/router knows about-for example, a non-internet connected management network that might be filled with never upgraded KVM/OOB control equipment.
    - Zombieball 10y ago
      Thanks! #2 definitely seems like a big issue. I can imagine many "internal" services that are potentially insecure.
      - Vendan 10y ago
        My fav is IPMI. Many devices allow you to log in using cipher 0... basically, if you know the username, you get access. The rest... well, IMPI has a hash disclosure built into the protocol. If you can guess a username, you can get (and try to crack) the password.
    - eth1 10y ago
      So, I just did this. this is how i gained access to the ASA. ssh alsjfailjgfakjndfakldflkajd@10.1.1.1 and I was in. Then i did: en it asked for a password, and i typed: al;kdf;aklfjglkadfjglkadjfgljfglksjdf and i was in. kind of scary
  - raphman_ 10y ago
    For those without `showdead` on: (@dang / @sctb: this seems to be a false positive) > XORcat 18 minutes ago [dead] [-] > In my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.
    - deleted 10y ago
      [deleted]
    - moyix 10y ago
      Instead of copying & pasting, you should be able to click on the timestamp of the comment and then click "Vouch" (which I just did for XORcat's comment).
      - schoen 10y ago
        Maybe you need a certain minimum karma level to have access to vouch?
        Phlarp 10y ago
        This seems to be the case, at 926 karma I have comment downvotes but no vouch button yet.
      - raphman_ 10y ago
        Thanks for the tip and the vouching - as schoen suggests, it seems like I need a little bit more karma for this.
mrb 10y ago
Ha! Someone sent 1.5 BTC (~800 USD) to the hacker's address 19BY2XCgbDe6WtTVbTyzM9eR3LYr6VitWK to bid on eqgrp_auction_file.tar.xz.asc. He sent it from a vanity bitcoin address starting with "1nice" ;-) https://blockchain.info/tx/c44b40b6d845d9cc256e21606821569dbe7232ffeab4cd7c65b037ca7e38abd1 https://blockchain.info/tx/c44b40b6d845d9cc256e21606821569db...
- abrkn 10y ago
  It embeds a Bitmessage[1] address using the OP_RETURN[2] opcode as EquationGroup requested: BM-2cXe6wAT7yTgoxGCpDMmdWq2xxWcdmL3Ek [1] https://bitmessage.org/wiki/Main_Page https://bitmessage.org/wiki/Main_Page [2] https://en.bitcoin.it/wiki/OP_RETURN https://en.bitcoin.it/wiki/OP_RETURN
  - ryan-c 10y ago
    This one[0] has cryptome's GPG fingerprint. The same person seems to have sent several others, including one listing cryptome's email address and several rude[1] and vulger[2] messages. Charming. 0. https://blockchain.info/tx/8974f9ba743f073bfe18a2f1505ad993401a0f8ea02406c8633741be61b07a26 https://blockchain.info/tx/8974f9ba743f073bfe18a2f1505ad9934... 1. https://blockchain.info/tx/8e1e3cda1caf23e2f3071595efdbc794b9775c8cbd750cdac14494f01d12eaf1 https://blockchain.info/tx/8e1e3cda1caf23e2f3071595efdbc794b... 2. https://blockchain.info/tx/527202542acc7d87a763bafa5fc66a0a96e4cf5c338d7701a552124c9a776fae https://blockchain.info/tx/527202542acc7d87a763bafa5fc66a0a9...
- svenfaw 10y ago
  Could be the hackers themselves for all you know.
meeper16 10y ago
"ExtraBaconDemo" Ok, this is going to be hilarious.
waterside81 10y ago
So I downloaded the files and poked around the Python code. The code looked positively amateurish, not in its functionality (I'm sure it works) but in the coding style. I'm not sure what I expected, but the formatting, the types of comments, it all looked like it was written by someone who just started out with Python. Maybe it was written very hastily, I don't know, but I encourage others to take a look. It's interesting to see the source for this kind of stuff.
- chinathrow 10y ago
  Maybe the coding style was done on purpose to defend against attribution?
  - verroq 10y ago
    Most hardcore reversers/exploit devs are not software engineers.
    - msane 10y ago
      Be careful what you say.
  - angry_octet 10y ago
    Surely a better way to defend against that is to perform some automated program transformation? Like this minifier: https://liftoff.github.io/pyminifier/ https://liftoff.github.io/pyminifier/ It would be interesting to see how various stylistic fingerprints analysis points survive lexical washing, a la https://freedom-to-tinker.com/blog/aylin/anonymous-programmers-can-be-identified-by-analyzing-coding-style/ https://freedom-to-tinker.com/blog/aylin/anonymous-programme...
- StavrosK 10y ago
  Here's a sample: https://www.pastery.net/fcugdj/ https://www.pastery.net/fcugdj/
- klue07 10y ago
  Many people in infosec generally learn programming on their own and only code for their own need. They don't care about coding style, small optimizations, programming best practices, etc.
searine 10y ago
https://en.wikipedia.org/wiki/Equation_Group https://en.wikipedia.org/wiki/Equation_Group FYI
nneonneo 10y ago
Source code from the leak, if anyone's curious: https://github.com/nneonneo/eqgrp-free-file/tree/master/Firewall/EXPLOITS/EXBA https://github.com/nneonneo/eqgrp-free-file/tree/master/Fire...
djsumdog 10y ago
Someone at Kiwicon (2015, I think?) went through breaking into a CISCO router. Newer Cisco hardware actually runs a Linux kernel and one, massive (I think it was like 50MB) binary. There's only one ethernet device too because the others are controlled by user-space PCI devices within that binary. For what I could tell, it looked like Cisco use to have a full independent OS (ios) and when they switched to Intel hardware, it was easier for them to just build a shim layer between Linux and their OS so they could run on cheaper/newer hardware without a massive rewrite. Anyway, that guy responsibly disclosed and his exploit was patched, but it did give full access to everything, including the ability to create new routes and filters that wouldn't even be visible from within ios.

147 points by ianhawes 10y ago

shishiwakamaru 10y ago

without the enable password, you can't do much

agnokapathetic 10y ago
except pivot into a higher-privileged management network full of juicy--and typically totally unpatched--Out-of-Band management equipment (consoles, IPMI, industrial gear)
Zombieball 10y ago
Could you elaborate to those of us not familiar with Cisco routers? My understanding is this exploit disables password authentication and allows you to access the device. A seperate command allows you to re-enable it. Would this re-enabling kill your current connection? Is the password later needed to change settings on the router (like if you typed sudo and are forced to re-authenticate)?
- XORcat 10y ago
  In my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.
- tmm 10y ago
  The "enable" password is sort of like the root account on Cisco gear. When you first connect, you're in a low-priv state where you can do simple things like see the uptime of the device, interface info, etc. But to make any changes to the settings on the router, you have to run the "enable" command which typically asks for a password which is separate from the login password. I guess the name comes from enabling admin functionality, but I don't know why Cisco didn't call the command admin. Anyway, this enable is different from enabling/disabling the login authentication.
- a2tech 10y ago
  On a Cisco router you login via SSH or Telnet, then you run a command to become 'enabled'. enable is a command like sudo on Linux-it elevates your permission level so you can make changes (although not all changes require you to be enabled, most do). If you used ExtraBacon to clear the login user/password you would get a basic shell on connection. This would open at least 2 options to you as an attacker-1) using a local exploit to become an enabled user and 2) you can now send traffic to ALL the networks that the firewall/router knows about-for example, a non-internet connected management network that might be filled with never upgraded KVM/OOB control equipment.
  - Zombieball 10y ago
    Thanks! #2 definitely seems like a big issue. I can imagine many "internal" services that are potentially insecure.
    - Vendan 10y ago
      My fav is IPMI. Many devices allow you to log in using cipher 0... basically, if you know the username, you get access. The rest... well, IMPI has a hash disclosure built into the protocol. If you can guess a username, you can get (and try to crack) the password.
  - eth1 10y ago
    So, I just did this. this is how i gained access to the ASA. ssh alsjfailjgfakjndfakldflkajd@10.1.1.1 and I was in. Then i did: en it asked for a password, and i typed: al;kdf;aklfjglkadfjglkadjfgljfglksjdf and i was in. kind of scary
- raphman_ 10y ago
  For those without `showdead` on: (@dang / @sctb: this seems to be a false positive) > XORcat 18 minutes ago [dead] [-] > In my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.
  - deleted 10y ago
    [deleted]
  - moyix 10y ago
    Instead of copying & pasting, you should be able to click on the timestamp of the comment and then click "Vouch" (which I just did for XORcat's comment).
    - schoen 10y ago
      Maybe you need a certain minimum karma level to have access to vouch?
      - Phlarp 10y ago
        This seems to be the case, at 926 karma I have comment downvotes but no vouch button yet.
    - raphman_ 10y ago
      Thanks for the tip and the vouching - as schoen suggests, it seems like I need a little bit more karma for this.

mrb 10y ago

Ha! Someone sent 1.5 BTC (~800 USD) to the hacker's address 19BY2XCgbDe6WtTVbTyzM9eR3LYr6VitWK to bid on eqgrp_auction_file.tar.xz.asc. He sent it from a vanity bitcoin address starting with "1nice" ;-) https://blockchain.info/tx/c44b40b6d845d9cc256e21606821569dbe7232ffeab4cd7c65b037ca7e38abd1 https://blockchain.info/tx/c44b40b6d845d9cc256e21606821569db...

abrkn 10y ago
It embeds a Bitmessage[1] address using the OP_RETURN[2] opcode as EquationGroup requested: BM-2cXe6wAT7yTgoxGCpDMmdWq2xxWcdmL3Ek [1] https://bitmessage.org/wiki/Main_Page https://bitmessage.org/wiki/Main_Page [2] https://en.bitcoin.it/wiki/OP_RETURN https://en.bitcoin.it/wiki/OP_RETURN
- ryan-c 10y ago
  This one[0] has cryptome's GPG fingerprint. The same person seems to have sent several others, including one listing cryptome's email address and several rude[1] and vulger[2] messages. Charming. 0. https://blockchain.info/tx/8974f9ba743f073bfe18a2f1505ad993401a0f8ea02406c8633741be61b07a26 https://blockchain.info/tx/8974f9ba743f073bfe18a2f1505ad9934... 1. https://blockchain.info/tx/8e1e3cda1caf23e2f3071595efdbc794b9775c8cbd750cdac14494f01d12eaf1 https://blockchain.info/tx/8e1e3cda1caf23e2f3071595efdbc794b... 2. https://blockchain.info/tx/527202542acc7d87a763bafa5fc66a0a96e4cf5c338d7701a552124c9a776fae https://blockchain.info/tx/527202542acc7d87a763bafa5fc66a0a9...
svenfaw 10y ago
Could be the hackers themselves for all you know.

meeper16 10y ago

"ExtraBaconDemo" Ok, this is going to be hilarious.

waterside81 10y ago

So I downloaded the files and poked around the Python code. The code looked positively amateurish, not in its functionality (I'm sure it works) but in the coding style. I'm not sure what I expected, but the formatting, the types of comments, it all looked like it was written by someone who just started out with Python. Maybe it was written very hastily, I don't know, but I encourage others to take a look. It's interesting to see the source for this kind of stuff.

chinathrow 10y ago
Maybe the coding style was done on purpose to defend against attribution?
- verroq 10y ago
  Most hardcore reversers/exploit devs are not software engineers.
  - msane 10y ago
    Be careful what you say.
- angry_octet 10y ago
  Surely a better way to defend against that is to perform some automated program transformation? Like this minifier: https://liftoff.github.io/pyminifier/ https://liftoff.github.io/pyminifier/ It would be interesting to see how various stylistic fingerprints analysis points survive lexical washing, a la https://freedom-to-tinker.com/blog/aylin/anonymous-programmers-can-be-identified-by-analyzing-coding-style/ https://freedom-to-tinker.com/blog/aylin/anonymous-programme...
StavrosK 10y ago
Here's a sample: https://www.pastery.net/fcugdj/ https://www.pastery.net/fcugdj/
klue07 10y ago
Many people in infosec generally learn programming on their own and only code for their own need. They don't care about coding style, small optimizations, programming best practices, etc.

searine 10y ago

https://en.wikipedia.org/wiki/Equation_Group https://en.wikipedia.org/wiki/Equation_Group FYI

nneonneo 10y ago

Source code from the leak, if anyone's curious: https://github.com/nneonneo/eqgrp-free-file/tree/master/Firewall/EXPLOITS/EXBA https://github.com/nneonneo/eqgrp-free-file/tree/master/Fire...

djsumdog 10y ago

Someone at Kiwicon (2015, I think?) went through breaking into a CISCO router. Newer Cisco hardware actually runs a Linux kernel and one, massive (I think it was like 50MB) binary. There's only one ethernet device too because the others are controlled by user-space PCI devices within that binary. For what I could tell, it looked like Cisco use to have a full independent OS (ios) and when they switched to Intel hardware, it was easier for them to just build a shim layer between Linux and their OS so they could run on cheaper/newer hardware without a massive rewrite. Anyway, that guy responsibly disclosed and his exploit was patched, but it did give full access to everything, including the ability to create new routes and filters that wouldn't even be visible from within ios.