WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 18
- 19
- 20
- 21
- 22
…
- 30
- 31

SECRET//NOFORN
(U) Deployment (U) Hive 2.9.1 User's Guide
hiveUpdater.py -b -f <Configuration File name>
where the Configuration File contains a line for the target File which contains the IP address of each
box being updated. In this case, “10.1.2.3” and “10.3.2.1” would both be on a separate line. Note
that this list may contain multiple target IP addresses, but all the Hive Updater Configuration
settings contained within the configuration file must be the same. Note that once these files are
created, they may be used again for all future updates as long as the parameters remain the same.
(S) Note that this python script also contains a reset option which will reset the .config timer file for
all devices. This reset script was also modified to retrieve passwords and create one directory on all
Mikrotik devices per guidance from COG based on their standard exploits. Passwords contained in
the /nova/store/user.dat and the /rw/store/user.dat files are stored in a pA.IPAddress and
pB.IPAddress files respectively for Mikrotik devices. The reset capability will also create a
/nova/etc/devel-login file that is used by COG to exploit the targeted device.
(S) It has been noted that this same update capability can and will be upgraded/expanded in future
versions of Hive to install other modules and tools for target exploitation in an automated fashion.
16 SECRET//NOFORN//20401109

- 1
- 2
…
- 18
- 19
- 20
- 21
- 22
…
- 30
- 31