EquationGroup Tool Leak – ExtraBacon Demo

https://xorcatt.wordpress.com/2016/08/16/equationgroup-tool-leak-extrabacon-demo/

by ianhawes • 10 years ago

147 33 10 years ago

xorcatt.wordpress.com

without the enable password, you can't do much

except pivot into a higher-privileged management network full of juicy--and typically totally unpatched--Out-of-Band management equipment (consoles, IPMI, industrial gear)

Zombieball2• 10 years ago

Could you elaborate to those of us not familiar with Cisco routers?

My understanding is this exploit disables password authentication and allows you to access the device. A seperate command allows you to re-enable it.

Would this re-enabling kill your current connection? Is the password later needed to change settings on the router (like if you typed sudo and are forced to re-authenticate)?

XORcat• 10 years ago

In my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.

tmm• 10 years ago

The "enable" password is sort of like the root account on Cisco gear. When you first connect, you're in a low-priv state where you can do simple things like see the uptime of the device, interface info, etc. But to make any changes to the settings on the router, you have to run the "enable" command which typically asks for a password which is separate from the login password.

I guess the name comes from enabling admin functionality, but I don't know why Cisco didn't call the command admin. Anyway, this enable is different from enabling/disabling the login authentication.

a2tech• 10 years ago

On a Cisco router you login via SSH or Telnet, then you run a command to become 'enabled'. enable is a command like sudo on Linux-it elevates your permission level so you can make changes (although not all changes require you to be enabled, most do).

If you used ExtraBacon to clear the login user/password you would get a basic shell on connection. This would open at least 2 options to you as an attacker-1) using a local exploit to become an enabled user and 2) you can now send traffic to ALL the networks that the firewall/router knows about-for example, a non-internet connected management network that might be filled with never upgraded KVM/OOB control equipment.

raphman2• 10 years ago

For those without `showdead` on: (@dang / @sctb: this seems to be a false positive)

XORcat 18 minutes ago [dead] [-]
In my lab, re-enabling did not kill the current connection, so it could be a very quick switch flick, login, revert to try and avoid detection.

mrb• 10 years ago

Ha! Someone sent 1.5 BTC (~800 USD) to the hacker's address 19BY2XCgbDe6WtTVbTyzM9eR3LYr6VitWK to bid on eqgrp_auction_file.tar.xz.asc. He sent it from a vanity bitcoin address starting with "1nice" ;-) https://blockchain.info/tx/c44b40b6d845d9cc256e21606821569db...

abrkn• 10 years ago

It embeds a Bitmessage[1] address using the OP_RETURN[2] opcode as EquationGroup requested:

    BM-2cXe6wAT7yTgoxGCpDMmdWq2xxWcdmL3Ek

[1] https://bitmessage.org/wiki/Main_Page [2] https://en.bitcoin.it/wiki/OP_RETURN

ryan-c• 10 years ago

This one[0] has cryptome's GPG fingerprint.

The same person seems to have sent several others, including one listing cryptome's email address and several rude[1] and vulger[2] messages. Charming.

0. https://blockchain.info/tx/8974f9ba743f073bfe18a2f1505ad9934...

1. https://blockchain.info/tx/8e1e3cda1caf23e2f3071595efdbc794b...

2. https://blockchain.info/tx/527202542acc7d87a763bafa5fc66a0a9...

svenfaw• 10 years ago

Could be the hackers themselves for all you know.

meeper16• 10 years ago

"ExtraBaconDemo" Ok, this is going to be hilarious.

waterside81• 10 years ago

So I downloaded the files and poked around the Python code. The code looked positively amateurish, not in its functionality (I'm sure it works) but in the coding style. I'm not sure what I expected, but the formatting, the types of comments, it all looked like it was written by someone who just started out with Python. Maybe it was written very hastily, I don't know, but I encourage others to take a look. It's interesting to see the source for this kind of stuff.

chinathrow• 10 years ago

Maybe the coding style was done on purpose to defend against attribution?

verroq• 10 years ago

Most hardcore reversers/exploit devs are not software engineers.

angry_octet• 10 years ago

Surely a better way to defend against that is to perform some automated program transformation? Like this minifier: https://liftoff.github.io/pyminifier/

It would be interesting to see how various stylistic fingerprints analysis points survive lexical washing, a la https://freedom-to-tinker.com/blog/aylin/anonymous-programme...

StavrosK• 10 years ago

Here's a sample: https://www.pastery.net/fcugdj/

klue07• 10 years ago

Many people in infosec generally learn programming on their own and only code for their own need. They don't care about coding style, small optimizations, programming best practices, etc.

DavidWanjiru• 10 years ago

I'm curious if this has to do with their generally broken English, as I read on what I think was their blog post. Does English proficiency affect coding "fluency", seeing as you are coding in English?

sailingparrot• 10 years ago

They didn't author this. They state they stole it from the NSA.

Udik• 10 years ago

I don't think that the English of that message is real. Looks made up, maybe too give a better aura of mystery and possibly to avoid the risk of being recognised by some writing style analysis software.

segmondy• 10 years ago

It looks exactly like I expect. It looks like what was written by a hacker. The end goal is to solve a problem. This code was not generated from a business requirements. It was not written for others to maintain. It's not going to be changing. It doesn't need tests. The author understands it and needs minimal comments. There is no need to make it object oriented, use design patterns or make it fancy. There are lots of such sources online. Here is an exploit for the stagefright/python code https://github.com/jduck/cve-2015-1538-1/blob/master/Stagefr...

Here is another exploit in ruby, https://github.com/jduck/addjsif/blob/master/add_js_interfac...

MatthiasP• 10 years ago

If we assume that the code really comes from a member of the "Equation Team" and we trust the conclusion from Kaspersky that those people are among the upper echelons of NSA hacker groups it is maybe a good point in time that we give our expectations a reality check.

What counts in the real world is that it gets the job done, unfortunately no time for fancy pythonic delicacies or experiments in functional coding paradigms.

Sorry for the little rant and nothing personal, I just find critizicing other people's code without considering the constraints under it was created an extremely annoying habit among my fellow coders.

searine• 10 years ago

https://en.wikipedia.org/wiki/Equation_Group

FYI

nneonneo• 10 years ago

Source code from the leak, if anyone's curious: https://github.com/nneonneo/eqgrp-free-file/tree/master/Fire...

djsumdog• 10 years ago

Someone at Kiwicon (2015, I think?) went through breaking into a CISCO router. Newer Cisco hardware actually runs a Linux kernel and one, massive (I think it was like 50MB) binary. There's only one ethernet device too because the others are controlled by user-space PCI devices within that binary.

For what I could tell, it looked like Cisco use to have a full independent OS (ios) and when they switched to Intel hardware, it was easier for them to just build a shim layer between Linux and their OS so they could run on cheaper/newer hardware without a massive rewrite.

Anyway, that guy responsibly disclosed and his exploit was patched, but it did give full access to everything, including the ability to create new routes and filters that wouldn't even be visible from within ios.

EquationGroup Tool Leak – ExtraBacon Demo

Related Stories