# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Hive Infrastructure Installation and Configuration Guide

11 November, 2012

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
…
- 17
- 18

SECRET//NOFORN
Hive Infrastructure Configuration Guide (S//NF) Blot Proxy
• External IP: There can be only one external IP address on which the proxy will listen.
• Tool handler name (th): There must be a tool handler configured for each ITD defined below
and the tool-handler names must match.
• Server names – must be unique
• ITD number: The ITD number used in the itd declaration must match the code that is baked-
into the implant.
The following shows the ITD configuration file for Swindle (HTTPS). Here the port numbers must
reflect the ports that the ITD will listen to for an implant beacon. The Vortex (HTTP) and Brawl (DNS)
ITD configurations will be similar.
(S//NF) NOTE: Beastbox is very sensitive to the configuration file. A syntax error, the use of the wrong
version number and other such anomalies will cause the Beastbox proxy to die silently without any
output to the console or log file. Here are key items to note.
4.3 (S//NF) OpenVPN
(S//NF) OpenVPN is used to tunnel the connections between the VPS redirectors and the Blot proxy.
4.3.1 (U) Software Installation
(S//NF) The following software packages are required:
• openvpn version 2.2.2 or later
(S//NF) To install these, install epel-release-5-4.noarch.rpm. If this is not available in the Yum
repository, get it by using:
wget http://download.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm
and then install it using:
rpm -ivh epel-release-5-4.noarch.rpm
(S//NF) Then install OpenVPN using:
yum install openvpn
(S//NF) This should install the lzo compression software as a dependency.
(S//NF) Setup OpenVPN so that it will start after booting by using chkconfig.
chkconfig --add openvpn
November 2012 SECRET//NOFORN//20371105 7
<itd version="1.2">
<ports>
<port protocol="tcp">44301</port>
<port protocol="tcp">44302</port>
</ports>
<certFilePath>/etc/blot/itds/swindle/swindle.crt</certFilePath>
</itd>

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
…
- 17
- 18