Latvenergo RIGAS HES-2 HACKED!

[Zhang Xinghu <zhangxinghu () rocketmail com>]

Latvenergo RIGAS TEC-2 软件漏洞分析技术

http://www.latvenergo.lv/pls/portal/docs/PAGE/LATVIAN/IMAGES/razosana_tec_r.jpg
RIGAS TEC-2 (Heat Power Plant)

Latvian Energy Grid
http://upload.wikimedia.org/wikipedia/en/6/68/Latvian_grid.png

SCADA:
http://img197.imageshack.us/i/11845309.png/
http://img853.imageshack.us/i/82004790.png/
http://img835.imageshack.us/i/11297056.png/
http://img811.imageshack.us/i/24628503.png/
http://img708.imageshack.us/i/46434198.png/
http://img42.imageshack.us/i/69536191.png/
http://img268.imageshack.us/i/91060646.png/
http://img573.imageshack.us/i/20665870.png/
http://img705.imageshack.us/i/91159778.png/
http://img850.imageshack.us/i/21524239.png/

http://83.136.143.114/ and http://85.15.193.254/

login: henriks
password: :henry50

--------------------------------------------------------------------------------------

rb-aciems 83.136.143.114
username cisco privilege 15 secret 5 $1$FKKk$t2NOQP.vSScMbwJWERNU0/ (password "cisco")
username henriks privilege 15 secret 5 $1$o8TS$N/hEZX99OrJYekQGffJOK0 (password "henriks")
username alfreds privilege 15 secret 5 $1$oezl$miNkMEnzGLy4CVwT3XA7y/
username ugis privilege 15 secret 5 $1$yL4P$ErYRu.UU1lcireNDTvA2T1
username agritis privilege 15 secret 5 $1$bPCB$p8PoLDo6JydfwhqmksEJb/
username normis privilege 15 secret 5 $1$xOvT$E6SYwEiiZw4iXSKPwdd3V.

rb-aciems 85.15.193.254
username cisco privilege 15 secret 5 $1$FKKk$t2NOQP.vSScMbwJWERNU0/
username henriks privilege 15 secret 5 $1$o8TS$N/hEZX99OrJYekQGffJOK0
username alfreds privilege 15 secret 5 $1$oezl$miNkMEnzGLy4CVwT3XA7y/
username ugis privilege 15 secret 5 $1$yL4P$ErYRu.UU1lcireNDTvA2T1
username agritis privilege 15 secret 5 $1$bPCB$p8PoLDo6JydfwhqmksEJb/
username normis privilege 15 secret 5 $1$xOvT$E6SYwEiiZw4iXSKPwdd3V.

rb-ast63 83.136.143.77
username cisco privilege 15 secret 5 $1$K3qC$bgVeSjpVpmWtgFX8roEpc. (password "cisco")
username henriks privilege 15 secret 5 $1$o8TS$N/hEZX99OrJYekQGffJOK0 (password "henry50")
username alfreds privilege 15 secret 5 $1$oezl$miNkMEnzGLy4CVwT3XA7y/
username ugis privilege 15 secret 5 $1$yL4P$ErYRu.UU1lcireNDTvA2T1
username agritis privilege 15 secret 5 $1$bPCB$p8PoLDo6JydfwhqmksEJb/
username normis privilege 15 secret 5 $1$xOvT$E6SYwEiiZw4iXSKPwdd3V.
username aivars privilege 15 secret 5 $1$Ez4w$eLBbFOCZpm1//M1D9Qysa1 (password "sunset")
username arnis privilege 15 secret 5 $1$mBOT$6U31Bpe.2ye4lCBoJl.wX.

rb-jwl 83.136.137.253
username henriks privilege 15 secret 5 $1$o8TS$N/hEZX99OrJYekQGffJOK0 (password "henry50")
username alfreds privilege 15 secret 5 $1$oezl$miNkMEnzGLy4CVwT3XA7y/
username ugis privilege 15 secret 5 $1$yL4P$ErYRu.UU1lcireNDTvA2T1
username agritis privilege 15 secret 5 $1$bPCB$p8PoLDo6JydfwhqmksEJb/
username normis privilege 15 secret 5 $1$xOvT$E6SYwEiiZw4iXSKPwdd3V.
username arnis privilege 15 secret 5 $1$L0oT$eUM9yV8Yb8NT/xJaou8CR/

rb-tec2-ibedro 83.136.143.66 (85.15.200.1)
username cisco privilege 15 secret 5 $1$2gKA$AkkCIcEviInzKmgA9uYY.1 (password "cisco")
username henriks privilege 15 secret 5 $1$o8TS$N/hEZX99OrJYekQGffJOK0 (password "henry50")
username alfreds privilege 15 secret 5 $1$oezl$miNkMEnzGLy4CVwT3XA7y/
username ugis privilege 15 secret 5 $1$yL4P$ErYRu.UU1lcireNDTvA2T1
username agris privilege 15 secret 5 $1$4yfS$GmtMLYEvnMmNLimx3cIEs.
username agritis privilege 15 secret 5 $1$bPCB$p8PoLDo6JydfwhqmksEJb/
username normis privilege 15 secret 5 $1$EGe6$n09ZOVK0/Z47LY5QOrmly0
username gints privilege 15 secret 5 $1$Qkow$2epiPs8stbDFNXk35KIiG. (password "wttpc")
username arnis privilege 15 secret 5 $1$pzmn$iIoY5KsH/KicXQcnihQwe0

-----------------------------------------------------------------------------------------
Rigas TEC-2 Router configuration: 

Current configuration : 8665 bytes
!
! Last configuration change at 18:36:17 EET-EDT Mon May 1 2011 by henriks
! NVRAM config last updated at 21:11:22 EET-EDT Mon May 1 2011
!
version 12.4
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
!
hostname rb-tec2-ibedro
!
boot-start-marker
boot-end-marker
!
logging buffered 32768 debugging
enable secret 5 $1$1Jog$NgC5Ve1J4ZV4d.Ns4cYuK/
!
no aaa new-model
!
resource policy
!
clock timezone EET 2
clock summer-time EET-EDT recurring last Sun Mar 3:00 last Sun Oct 3:00
clock calendar-valid
ip subnet-zero
!
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.40.8.0 10.40.8.1
!
ip dhcp pool IP-phones
   network 10.40.8.0 255.255.255.128
   default-router 10.40.8.1
   dns-server 10.0.37.1 10.0.37.2
   domain-name int.letcom.lv
   option 150 ip 10.0.38.1 10.0.38.2
   lease 7
!
!
ip vrf LE_Inet
 rd 29600:76
!
ip vrf MGMT
 rd 29600:74
!
ip domain name int.letcom.lv
ip host letccm1.int.letcom.lv 10.0.38.1
ip host letccm2.int.letcom.lv 10.0.38.2
ip name-server 10.0.37.1
ip name-server 10.0.37.2
!
voice-card 0
 no dspfarm
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto pki trustpoint TP-self-signed-667169674
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-667169674
 revocation-check none
 rsakeypair TP-self-signed-667169674
!
!
crypto pki certificate chain TP-self-signed-667169674
 certificate self-signed 01
  3082024D 308201B6 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 36363731 36393637 34301E17 0D303631 30313230 38313835
  365A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
  532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3636 37313639
  36373430 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
  A0F4672C 6EF80F91 9D851665 82D889B2 80B941CF 83D43B3B 4FB12E26 6275EC81
  6B8DCEBC 31A61E8C BDC16231 06483344 A72D8E7F 6A599EEA EB1289C7 F0F38C0F
  AE7B9658 329F7576 1DB562B1 DBABCB63 3C659189 213BD2AD C63BF833 5B56E96D
  8D97B277 01B887ED 4C144C2F 518D68A7 5017A4AE 9220ED74 41A7F894 6B176679
  02030100 01A37730 75300F06 03551D13 0101FF04 05300301 01FF3022 0603551D
  11041B30 19821779 6F75726E 616D652E 796F7572 646F6D61 696E2E63 6F6D301F
  0603551D 23041830 16801433 BBC541C9 12011912 3A3411C7 21226E63 E1054730
  1D060355 1D0E0416 041433BB C541C912 0119123A 3411C721 226E63E1 0547300D
  06092A86 4886F70D 01010405 00038181 0029FB38 3C4E3003 559F8E97 114C14D4
  058CD8AB A10E34B1 9A596DB7 0118BDC1 2E057694 E274966D 4328410E B6DE0433
  A8DDFEA3 8331D8B5 0108ECE6 B72A86DE 3100A6B5 6E4C40FE 7C3D67D8 29E27DC1
  070E7AAF AD4E89DB C584A12A DA889080 36AEF818 171F4CFB C84723DD 00AEA553
  7FC6B43A A3D5954C 4C093C54 6FD742F5 22
  quit
username cisco privilege 15 secret 5 $1$2gKA$AkkCIcEviInzKmgA9uYY.1
username henriks privilege 15 secret 5 $1$o8TS$N/hEZX99OrJYekQGffJOK0
username alfreds privilege 15 secret 5 $1$oezl$miNkMEnzGLy4CVwT3XA7y/
username ugis privilege 15 secret 5 $1$yL4P$ErYRu.UU1lcireNDTvA2T1
username agris privilege 15 secret 5 $1$4yfS$GmtMLYEvnMmNLimx3cIEs.
username agritis privilege 15 secret 5 $1$bPCB$p8PoLDo6JydfwhqmksEJb/
username normis privilege 15 secret 5 $1$EGe6$n09ZOVK0/Z47LY5QOrmly0
username gints privilege 15 secret 5 $1$Qkow$2epiPs8stbDFNXk35KIiG.
username arnis privilege 15 secret 5 $1$pzmn$iIoY5KsH/KicXQcnihQwe0
!
!
!
!
interface FastEthernet0/0
 description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE 0/0$
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet0/0.74
 encapsulation dot1Q 74
 ip vrf forwarding MGMT
 ip address 10.33.1.22 255.255.255.252
 no snmp trap link-status
!
interface FastEthernet0/0.75
 description VoIP
 encapsulation dot1Q 75
 ip address 10.40.255.30 255.255.255.252
 no snmp trap link-status
!
interface FastEthernet0/0.76
 encapsulation dot1Q 76
 ip vrf forwarding LE_Inet
 ip address 83.136.143.66 255.255.255.252
 no snmp trap link-status
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet0/1.2
 encapsulation dot1Q 2
 ip vrf forwarding MGMT
 ip address 10.100.15.113 255.255.255.240
 no snmp trap link-status
!
interface FastEthernet0/1.3
 encapsulation dot1Q 3
 ip vrf forwarding LE_Inet
 ip address 85.15.200.1 255.255.255.248
 no snmp trap link-status
!
interface FastEthernet0/1.4
 description VoIP
 encapsulation dot1Q 4
 ip address 10.40.8.1 255.255.255.128
 no snmp trap link-status
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.40.255.29
ip route vrf LE_Inet 0.0.0.0 0.0.0.0 83.136.143.65
ip route vrf MGMT 0.0.0.0 0.0.0.0 10.33.1.21
!
!
no ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
logging 10.1.37.7
access-list 23 permit 10.10.10.0 0.0.0.7
snmp-server community r05n3pcom RO
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps vrrp
snmp-server enable traps ds1
snmp-server enable traps tty
snmp-server enable traps eigrp
snmp-server enable traps xgcp
snmp-server enable traps flash insertion removal
snmp-server enable traps ds3
snmp-server enable traps envmon
snmp-server enable traps icsudsu
snmp-server enable traps isdn call-information
snmp-server enable traps isdn layer2
snmp-server enable traps isdn chan-not-avail
snmp-server enable traps isdn ietf
snmp-server enable traps ds0-busyout
snmp-server enable traps ds1-loopback
snmp-server enable traps atm subif
snmp-server enable traps bgp
snmp-server enable traps bulkstat collection transfer
snmp-server enable traps cnpd
snmp-server enable traps config-copy
snmp-server enable traps config
snmp-server enable traps dial
snmp-server enable traps dsp card-status
snmp-server enable traps entity
snmp-server enable traps event-manager
snmp-server enable traps frame-relay
snmp-server enable traps frame-relay subif
snmp-server enable traps hsrp
snmp-server enable traps ipmobile
snmp-server enable traps ipmulticast
snmp-server enable traps mpls ldp
snmp-server enable traps mpls traffic-eng
snmp-server enable traps mpls vpn
snmp-server enable traps msdp
snmp-server enable traps mvpn
snmp-server enable traps ospf state-change
snmp-server enable traps ospf errors
snmp-server enable traps ospf retransmit
snmp-server enable traps ospf lsa
snmp-server enable traps ospf cisco-specific state-change nssa-trans-change
snmp-server enable traps ospf cisco-specific state-change shamlink interface-old
snmp-server enable traps ospf cisco-specific state-change shamlink neighbor
snmp-server enable traps ospf cisco-specific errors
snmp-server enable traps ospf cisco-specific retransmit
snmp-server enable traps ospf cisco-specific lsa
snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message
snmp-server enable traps pppoe
snmp-server enable traps cpu threshold
snmp-server enable traps rsvp
snmp-server enable traps rtr
snmp-server enable traps syslog
snmp-server enable traps l2tun session
snmp-server enable traps vsimaster
snmp-server enable traps vtp
snmp-server enable traps voice poor-qov
snmp-server enable traps voice fallback
snmp-server enable traps dnis
snmp-server enable traps dnis
snmp-server host 10.0.19.49 r05n3pcom
snmp-server host 10.2.0.49 r05n3pcom
!
!
!
control-plane
!
!
!
voice-port 0/3/0
 cptone FI
!
voice-port 0/3/1
 cptone FI
!
voice-port 0/3/2
 cptone FI
!
voice-port 0/3/3
 cptone FI
!
ccm-manager redundant-host LETCCM1
ccm-manager mgcp
no ccm-manager fax protocol cisco
ccm-manager music-on-hold
ccm-manager config server LETCCM1 LETCCM2
ccm-manager config
!
mgcp
mgcp call-agent LETCCM2 2427 service-type mgcp version 0.1
mgcp dtmf-relay voip codec all mode out-of-band
mgcp rtp unreachable timeout 1000 action notify
mgcp modem passthrough voip mode nse
mgcp modem passthrough voip codec g711alaw
mgcp package-capability rtp-package
no mgcp package-capability res-package
mgcp package-capability sst-package
no mgcp package-capability fxr-package
mgcp package-capability pre-package
no mgcp timer receive-rtcp
mgcp sdp simple
mgcp fax t38 inhibit
mgcp rtp payload-type g726r16 static
!
mgcp profile default
!
!
!
dial-peer voice 999030 pots
 service mgcpapp
 port 0/3/0
!
dial-peer voice 999033 pots
 service mgcpapp
 port 0/3/3
!
dial-peer voice 999031 pots
 service mgcpapp
 port 0/3/1
!
!
dial-peer voice 999032 pots
 service mgcpapp
 port 0/3/2
!
!
!
line con 0
 login local
line aux 0
line vty 0 4
 privilege level 15
 login local
 transport input telnet ssh
line vty 5 15
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler allocate 20000 1000
ntp server 10.33.1.21
!
end
-------------------------------------------------------------------------------------
China Youth Hackers Alliance

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/