WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 13
- 14
- 15
- 16
- 17
…
- 30
- 31

SECRET//NOFORN
(U) Hive 2.9.1 User's Guide (U) Deployment
3.4.1.1.1 (S) Disconnected State
(S) While in a disconnected state, the following commands are available:
ilm listen listen for reverse connect from remote
host
ilm
trigger
send trigger to remote host
ilm
connect
combines functions of trigger and
listen.
quit exits the cutthroat application
verbosity unused
mode unused
3.4.1.1.2 (S) Disconnected State: Listen
(S) To start the listener, enter:
ilm listen <port number>
where <port number> is any number from 1 through 65535. For example, to listen on port 4567
enter the following at the command prompt:
> ilm listen 4567
Listening for connection on port 4567 ...
(S) The listener will continue listening on the assigned port until it receives a response from the
implant or the operator kills the current process.
3.4.1.1.3 (S) Disconnected State: Trigger
(S) To start the trigger, enter:
ilm trigger <triggerFileName>
where the <triggerFileName> is the name of any file in the directory where cutthroat is running. If
the trigger file does not exist, it will be created and the operator prompted for the following
information:
Listener's IP
Address
IP address used by the implant to connect back to the Listener.
Listener's Port
Number
Open port on the Listener waiting for the implants callback
Target IP Address IP address where the implant is currently installed.
trigger protocol trigger protocol: raw-tcp or raw-udp (Required for triggers.)
raw port Raw Port number in the range of 1 through 65535 where the
raw-tcp or raw-udp trigger will be sent.
(S) Additional information on the trigger file can be found below in section 3.4.1.2.
SECRET//NOFORN//20401109 11

- 1
- 2
…
- 13
- 14
- 15
- 16
- 17
…
- 30
- 31