WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# SeaPea v2.0 - User Guide

6 November, 2008

- 1
- 2
- 3
- 4
- 5

1/7/09 8:49 AMbranches:udb:tools:mackernel:user_guide_2.0 [aed.net - wiki]
Page 4 of 5http://www.udb.net/wiki/doku.php?id=branches:udb:tools:mackernel:user_guide_2.0
(S)
Network/Port Hiding
: A socket initiated by an elite process is hidden from non-elite or non all-seeing
processes. When a non-elite or non all-seeing process executes the commands netstat or lsof -i
-P, all elite socket connections will be hidden. An all-seeing process that executes the same commands
will be able to see those hidden sockets. SeaPea hides both foreign and local ports. SeaPea also hides
listening server sockets.
Sockets created by an elite process are AUTOMATICALLY hidden. Socket connections inherited from an
elite parent retain there stealth properties.
Scheduler
SeaPea 2.0 uses OS X’s launchd system daemon for scheduling and launching tools. Launchd is the first
process launched in OS X and it is responsible for launching all other system app’s for OS X. To read more
about it, refer to the man page. Using launchd offers a wide variety of advantages. First, being a native OS X
app, it is stable and reliable. Second, it offers a number of scheduling options granting operators a full range
of flexible launch schedules. Third, Apple has suggested on numerous occasions that launchd will be the way
of the future... so expect it to be in future releases. And fourth, because it has been built into the system,
those apps that have a schedule to launch but are currently not running, do not take up system resources.
Rather that resource intensive polling methods, launchd uses a notification method for launching apps.
1. IMPORTANT: Currently do NOT use the KeepAlive functionality of Launchd. It will respawn continuously.
Limitations and Gotchas
The kernel implant is not loaded on single user mode. Therefore, in single user mode files/directories,
ports, and processes are not hidden. We are currently researching methods of achieving this.
The OS X firewall for 10.5 has three settings: Allow all “incoming connections, Allow only essential
services, and Set access for specific services and applications. If the user has the last option set, then the
user will be prompted if an application opens a listening socket.
Keep in mind that the terminal app logs keystrokes. If ever conducting sensitive operations using terminal
app, be sure to securely delete the .bash_history file located in the current users home directory.
Tested Applications
None yet
Examples Tool Schedulers
Example of Schedule Interval
Example of a Schedule listening for a directory modification

- 1
- 2
- 3
- 4
- 5