WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Fulcrum User Manual v0.62

5 December, 2011

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8
…
- 22
- 23

UNCLASSIFIED//LES
UNCLASSIFIED//LES Page6

FIGURE1ARPSPOOF
FulcrumusesARPspoofingtogetinthemiddleofthetargetmachineandthedefaultgatewayonthe
LANsothatitcanmonitoralltrafficleavingthetargetmachine.ItisimportanttonotethatFulcrumonly
establishesitselfinthemiddleononesideofthetwowaycommunicationchannelbetweenthetarget
machineandthedefaultgateway.OnceFulcrumisinthemiddle,itforwardsallrequestsfromthetarget
machinetotherealgateway.
2.5.2 HTTPTRAFFICINJECTION
Onceallnetworktrafficfromthetargetmachineisroutedtothepivotmachine,Fulcrummonitorsfor
specificHyperTextTransportProtocol(HTTP)messages.Fulcrumwaitsforanopportunitytoariseto
directthetarget’sHTTPclienttoretrieveandrendercontentcontrolledbythepivotmachine.Whenthe
conditionoccurs(suchasanHTTPGETrequest),FulcrumrespondsbysendingaspeciallyformedHTTP
packettothetargetmachine.ItisimportanttonoteagainthatFulcrumisforwardingalltrafficfromthe
targetmachinetotherealgatewayandisonlyinthemiddleofonesideoftheconversation.Asaresult,
Fulcrum’sspeciallycraftedpacketmustbeattheresponsepacketfromtherealdestination(e.g.
www.somedomain.com).Iftheinjectedpacketarrivesaftertherealresponse,thetargetmachinewill
simplydiscarditandtheHTTPclientwillnotreceiveorrenderit.
3 SUPPORTEDENVIRONMENTS
NOTE:Althoughtheapplicationsmayrunproperlyinoperatingenvironmentsbeyondthoselisted
below,onlythoselistedarerequiredtoworkandwillreceivetesting.

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8
…
- 22
- 23