WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Fulcrum User Manual v0.61

15 November, 2011

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8
…
- 22
- 23

UNCLASSIFIED//LES
UNCLASSIFIED//LES Page6
addresswouldbemistake nlysenttotheattackerinstead.
1
RefertoFigure1‐ARPSpooftovisualizethe
technique.

FIGURE 1‐ARPSPOOF
FulcrumusesARPspoofing togetinthemiddleofthetargetmachineandthedefaultgate wayonthe
LANsothatitcanmonitoralltrafficleavingthetargetmachine.ItisimportanttonotethatFulcrumonly
establishesitselfinthemiddleononesideofthetwo‐waycommunicationchannelbetweenthetarget
machineandthedefaultgateway.OnceFulcrumisinthemiddle,itforwardsallrequestsfromthetarget
machinetotherealgateway.
2.5.2 HTTPTRAFFICINJECTION
Onceallnetworktraffic fromthetargetmachineisro utedtothepivotmachine,Fulcrummonitorsfor
specificHyperTextTransportProtocol(HTTP)messages.Fulcrumwaitsforanopportunitytoariseto
directthetargetsHTTPclienttoretrieveandrendercontentcontr olledbythepivotmachine.Whenthe
conditionoccurs(suchasa nHTTPGETrequest),FulcrumrespondsbysendingaspeciallyformedHTTP
packettothetargetmachine.ItisimportanttonoteagainthatFulcrumisforwardingalltrafficfromthe
targetmachinetotherealgatewayandisonlyinthemiddleofonesideoftheconversation.Asaresult,
Fulcrumsspeciallycraftedpacketmustbeattheresponsepacketfromtherealdestination(e.g.
www.somedomain.com
).Iftheinjectedpacketarrivesaftertherealresponse,thetargetmachinewill
simply discard it and the HTTP client will not receive or render it.

1
http://en.wikipedia.org/wiki/ARP_spoofing

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8
…
- 22
- 23