# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# SeaPea v2.0 - User Guide

6 November, 2008

- 1
- 2
- 3
- 4
- 5

1/7/09 8:49 AMbranches:udb:tools:mackernel:user_guide_2.0 [aed.net - wiki]
Page 2 of 5http://www.udb.net/wiki/doku.php?id=branches:udb:tools:mackernel:user_guide_2.0
Step 5 If a
failsafe-app
is desired, then create a directory that must be called “fsa.log” in the tools
directory. For example, type
mkdir ./operationTools/fsa.log
. Inside this directory, two files must be
included. The first file is the tool that will act as the fail-safe. The second is a plist file that will be used by
launchd to launch the tool. The plist name must be com.apple.bluetooth64.agent.plist. Optionally, any
configuration files can also be placed in the directory.
Fail-safe template for com.apple.bluetooth64.agent.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.apple.audio.autorund.bsd</string>
<key>ProgramArguments</key>
<array>
<string>***TOOL NAME***</string>
<string>arg1</string>
<string>arg2</string>
<string>arg3</string>
</array>
<key>RunAtLoad</key> <--- Optional, tells launchd to run the tool when the plist is initially loaded.
<true/>
<key>StartInterval</key> <--- Optional, tells launchd to run the tool every 60 seconds
<integer>60</integer>
<key>StandardErrorPath</key>
<string>/dev/null</string>
<key>StandardOutPath</key>
<string>/dev/null</string>
<key>ThrottleInterval</key>
<integer>0</integer>
<key>WorkingDirectory</key>
<string>/var/log/.fsa.log</string> <-- The working directory for tool execution
</dict>
</plist>
Step 6: Run the nvwc script with the tool directory as the argument. For example, sh nvwc
./operationTools. The installer script .r89 will have been created in the current directory. Note,
the installer is unclassified.
Install and Uninstall
NO MOUNT INSTALL OPTION: : Execute the script .r89 as a user with root privileges on the target box.
After the install script has run, SeaPea will be fully installed and loaded, all tools will launch based on their
launchd plist configuration, and on reboot, SeaPea and tools will remain persistent. Note, the installer
script will delete itself upon execution. With the NO MOUNT install, a successful install will have occurred
if “:::” is printed out to the terminal.
MOUNT INSTALL OPTION : This install is ideal for supply chain because the “first boot” state is
preserved, and an unsuspecting user would think that the OS has never been used. In other words the
user will be welcomed by all the first time settings when first turning the computer on. This can also be
used if the root password is not known on the target. To conduct this install, the hard drive must be
mounted without using the host OS, thereby avoiding the initial startup sequence, or the user login
screen. To do this, boot the OS from the OS X install CD by holding
option
on startup. Once the CD boots
up, go to utilities, and select the terminal.app from the drop down menu. Insert the USB thumb drive
containing the installer. Copy the installer to the /Volumes directory. Run the installer with the parameter
as the mount point of the target OS. For example, in the terminal type sh /Volumes/.r89
/Volumes/Leopard. Note, the installer script will delete itself upon execution. At this time, the only
way to detect a successful install is to ensure that the /etc/.ptm.log file structure exists.
To uninstall, run the ullin executable with root privileges. For example, as root,
/etc/.ptm.log/.pq/ullin. This will unload all schedules, and delete all associated rootkit files.
IMPORTANT NOTE: It will NOT, however, stop a tool process that has already begun running. This must be
done manually.
Persistence
SeaPea will remain on the system unless one of the following conditions are met:
1. The hard drive is reformatted
2. An upgrade to the next major version (i.e. 10.6)
3. An error is encountered, at which point SeaPea will remove itself

- 1
- 2
- 3
- 4
- 5