WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 20
- 21
- 22
- 23
- 24
…
- 30
- 31

SECRET//NOFORN
(U) Hive 2.9.1 User's Guide (U) Idiosyncrasies & Limitations
5 (U) Idiosyncrasies & Limitations
5.1 (U) General
(S) On Linux, executing a GUI program without backgrounding the process (using an ampersand on
the command line following the command) may cause the interactive session to hang. Generally, it
is probably a bad idea to execute a GUI program on your target anyway.
(S) Files uploaded are written to the remote system with 644 permissions. After uploading an
executable and before executing it, make the file executable by using Hive to execute chmod a+x
<filename>.
(S) The patcher will support host names up to 256 characters long.
(S) Starting with Hive version 2.7, unique keying was implemented to help prevent TCP replay
attacks and provide the ability to distinguish between multiple implants within a given network.
However, multiple Hive implants within the same network can still be keyed alike if desired. Doing
so complicates communication in that the first implant responding to a trigger will get the
connection. For example, if a border router is implanted, as well as others deeper in the target
network, all triggers sent to any host (implanted or not) in that network will be first seen by the
border router and the operator will receive a callback from the Hive implant on the border router.
Therefore, best practice is to use independent keying for all implants.
(S) If the system time on target is reset or advanced 60 days into the future, the Hive implant will
self-delete. Also if the target machine is down for 60 days, the implant will self-delete on startup.
(S) When communicating with a shell window, any use of the control-C key will cause the window
to terminate. The operator will need to perform another shell open from the Cutthroat command
line to recreate the shell window.
SECRET//NOFORN//20401109 19

- 1
- 2
…
- 20
- 21
- 22
- 23
- 24
…
- 30
- 31