WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 12
- 13
- 14
- 15
- 16
…
- 30
- 31

SECRET//NOFORN
(U) Deployment (U) Hive 2.9.1 User's Guide
Error
Code
Description
1 Insufficient permissions
2 Key options error
3 Cannot access key file
4 Key length too short
5 Path name too long
6 DNS server address too long (15 characters max)
7 DNS server address missing
8 Beacons enabled, but no interval specified
9 Beacon delay is too long
10 Beacon variance is out of bounds
11 ID key missing
12 Beacon address not specified
13 Beacon host name specified, but without a DNS server address to
resolve it
3.4 (U) Command and Control Client
(S) Command and control of the Hive implant is provided by the Cutthroat ILM client, a loadable
module used with Cutthroat.
3.4.1 (S) Cutthroat/Hive-ILM
(S) Cutthroat is the standardized management interface for controlling the Hive implants, versus the
executable hclient-linux binary. You should verify that your version of cutthroat is operational by
entering the command “./cutthroat”. To use cutthroat with Hive, you must also have hive (the
implant library module) and CCS.xml installed in the same directory as cutthroat. To start the Hive
implant library module, you must first enter the following commands: “./cutthroat hive” or
“./cutthroat” followed by “load hive”. It should be noted that two of Cutthroat's commands,
verbosity and mode are not used by the Hive implant and should be ignored.
(S) If the Hive ILM loads, the operator will see a “[success] Successfully loaded hive [load]”
message followed by cutthroat's standard greeting which includes cutthroat's version number on
the computer terminal. The operator may hit the “tab” key at any time to see a list of available
commands for the operator to select while operating cutthroat.
(S) Warning: When using two clients to separately handle trigger and listen, the
operator should start the listener first. The operator should assume failure unless the
operator receives a Success message via the cutthroat interface.
3.4.1.1 (S) ILM States and Commands
(S) The Hive ILM client can be in one of two states – connected or disconnected – each of which
have their own set of applicable commands.
10 SECRET//NOFORN//20401109

- 1
- 2
…
- 12
- 13
- 14
- 15
- 16
…
- 30
- 31