WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 30
- 31

SECRET//NOFORN
(U) Pre-Deployment (U) Hive 2.9.1 User's Guide
any command line arguments. With the exception of the '-m' option, the patcher and the implant
accept the same options.
2.3.1 (U) Syntax
(S) The patcher command syntax is as follows. At a minimum, the address of the beacon server and
the ID key (or the name of the file containing the ID key) are the only parameters that must be
supplied.
hive-patcher -a <beacon address> [-p <port>] [-d <beacon delay>] \
[-i <beacon interval>] [-j <beacon jitter>] \
[-s <self-delete delay>] [-t <callback-delay>] \
[-P <file path> ] (-k <ID key>] | -K <ID key filename>) \
[-m <OS>] [-S <DNS Server IP>]
An explanation of the options are as follows:
-a <beacon addr> is the IP address or hostname of beacon server, that is, the Swindle proxy.
-p <beacon port> is the (optional) beacon port. Default is 443 for HTTPS which is the protocol
that the Hive implants and Swindle emulate.
-d <initial beacon
delay>
is the initial delay (in seconds) before the first beacon is sent. If set to 0, then
beacons will be disabled. (Default: 3 minutes)
-i <beacon interval> is the beacon interval or sleep time between beacons (in seconds). (Default:
0)
-j <beacon jitter> is the beacon jitter (as a percentage). That is, the amount of beacon variation
as a percentage of current beacon interval. (Range: 0-30%, Default: 3%)
-s <self-delete
delay>
is the self delete delay (in seconds). Amount of time since last successful
beacon or trigger allowed to pass before self-deletion occurs. If unused, the
default value is 60 days.
-t <callback delay> is the (optional) delay (in seconds) from when the trigger is received and the
callback +/- 30 seconds. (Default: 60 seconds)
-P <file path> directory path for the self-delete control/log files (.config and .log) (Default
location: “/var”). This option must be specified if /var is not writable,
otherwise self-deletion will occur.
-k <ID key> Trigger ID key with a minimum length of 8 characters and a maximum length
of 1000 characters. Quotes must be used if there are embedded spaces.
-K <ID key
filename>
The name of the file containing the ID key. The contents of this file must be
greater than 8 characters in length.(S) ID Keys File
4 SECRET//NOFORN//20401109

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 30
- 31