# Notes from the latest ShadowBrokers Equation group dump

Please read this bit first:
- To people dropping by - if you wish to contribute please login.

- Completed 1st pass on oddjob. Working on Windows. Swift is next.
- Need to come back and do analysis on implants in OJ.

## Top level folders
- oddjob - https://hackmd.io/OwVgbAZghsBMsFoDGSCMEEBYAmYwIE50NUDsDYIwpYoAOVIA
- swift - (not started yet)
- windows - (not started yet) https://hackmd.io/CwRgpghgxgJiBsBaYYYDNkgBxcVgTAOwBGixADFggJz4hQCsxDQA

### oddjob
**./Binaries/Payloads**
List of payloads to include in binaries created through **oddjob_builder**
The \*_payload.bin files appear to be generic and non-malicious. These are potentially used to verify the correct behaviour during testing (see ODDJOB_Testing.docx)

**./Binaries/Payloads/greha_dll_x64.dll**
*Notes:*
No apparent network capability (?)
Possibly just used to verify RCE.

Presumably the 64 bit counterpart of greha_dll_x86.dll

Pseudo code from the .text section at 0x180000fff
> Get the TEMP folder location from environment variable
> Concat the string "\ran_dll_64.txt" to it
> Create the file
> Close the file

*SHA256: 2575181b866921f2bccc6d57d720fda6ba9f8f53953cffeae2faf3e0a86aa10d

**./Binaries/Payloads/zero_byte_payload.bin**
Empty file

**./Binaries/Payloads/five_minute_beacon.bin**
The entire contents of the file in hex:
0001 0000 012c 0000 0000 0000 0000

**./Binaries/Payloads/process_list.bin**
The entire contents of the file in hex:
0003 0000 0000 0000 0000 0000 0000 0000

**./Binaries/Payloads/one_byte_payload.bin**
One byte - 0001

**./Binaries/Payloads/greha_dll_x86.dll**
Same as the x64 variant including the output file name/location.

*SHA256
f8f6251a8166fb32612a696fd63e67afdc41efb7fcf4fecd45b3231d00d9e002

**./Binaries/Payloads/bigpayload.bin**
Exactly 1000000 'A' characters

**./Binaries/Payloads/OJ_Deleter_2.4.exe**
TODO: Deletes the dropped files (?)
Interestingly this appears to be for version 2.4 whereas the supplied version is 3.X. Perhaps the same cleanup is required.

**./Binaries/Payloads/two_minute_beacon.bin**

**./Binaries/Payloads/one_minute_beacon.bin**

**./Binaries/oddjob_builder**
Builds the binaries.
Payloads are from the Payload folder

**./Binaries/oddjob_builder/bin**
This appear to contain the actual beacon binaries.
These binaries appear to have placeholders (like ABABABABABABABABABAB.dll) which get replaced with the parameters passed into BUilder.hta via the oddjob_config_v3.exe file.

**./Binaries/oddjob_builder/bin/oddjob_v3_x86.dll**

**./Binaries/oddjob_builder/bin/oddjob_v3_x64.exe**

**./Binaries/oddjob_builder/bin/oddjob_v3_x64.dll**

**./Binaries/oddjob_builder/bin/oddjob_v3_x86.exe**

**./Binaries/oddjob_builder/ODDJOB_BUilder_v3.hta**
VB driven web page - used to help build the exploit.
You have to create a folder called "Projects" in the *builder* folder for it not to error on startup.


According to the How_to_setup_IIS_7_for_ODDJOB.docx doc this is Windows 2008 compatible.

Page also handles handling:

1. Survey data
2. Payload Encryption
3. Encrypting/Decrypting process list (?)
4. Dumping implant configuration data
5. Generation of public/private key to be put into implant code (for encrypting/signing (?)).


>
**./Binaries/oddjob_builder/builder**

**./Binaries/oddjob_builder/builder/oddjob_config_v3.exe**

This is the worker. The VB HTA page builds the payload by calling out to oddjob_config_v3.exe as so:

>"C:\Users\Administrator\Desktop\oddjob\Binaries\oddjob_builder\builder\oddjob_config_v3.exe" -configure "builder\Projects\SomeTest\20170415-005805\sometest.ex_" "Wu Update Client " http://192.168.56.101/sometest/pingback "Upload" "4393update.xml" http://www.yahoo.com .cab .cab 0 14400 540 2592000 14400 1 start 1
configuring implant

**./Testing-Docs**

**./Testing-Docs/tungsten_flame.txt**
Basically just states for each oddjob[dll|exe] what AV engine, country and signature the binaries have been tested against.
Speculation: Tungsten_flame is codeword for an internal system/project that tests binaries against AV engines (similar to Virustotal)

**./Testing-Docs/ODDJOB_Testing.docx**
Describes testing methodology for version 3.4.0.0.
Special mention of PSP testing and how 2 scripts were used to check for correct behaviour.

**./Not-For-Release**

Holds text files which detail the hashes and the output of 'strings' for each of the 4 implants.

**./Not-For-Release/oddjob_v3_x86.dllstrings.txt**
**./Not-For-Release/hashes.txt**
**./Not-For-Release/oddjob_v3_x86.exestrings.txt**
**./Not-For-Release/oddjob_v3_x64.exestrings.txt**
**./Not-For-Release/oddjob_v3_x64.dllstrings.txt**

**./User-Docs**

**./User-Docs/BITSversions.xlsx**
Describes which version of BITS is included for each Windows OS.
Spreadsheet includes this string:
>"This is a worst case estimate for which Windows releases will work with ODDJOB. An updated version of bits is available as a download for many of these releases, such as XP SP1. Also, ODDJOB v3 will fallback gracefully from HTTPS to HTTP. So, when in doubt, throw HTTPS at the target."

**./User-Docs/How_to_setup_IIS_7_for_ODDJOB.docx**
Some interesting points:
* Implants report back exclusively (?) over BITS
* Some beacons are non-https
* OJ is fine with HTTP and HTTPS
* OJ has issues with '+' characters in the base64 encoded sent by beacons.
* The OJ builder is just one way to create the implants. Another system called FELONYCROWBAR also exists.
* The author has a sense of humor:
* "Play Minesweeper on Target."
* "Drink a beer because you're done. Hey, you're just following directions."