# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Infrastructure Switchblade

30 April, 2014

- 1
- 2
…
- 7
- 8
- 9
- 10

SECRET//NOFORN
Switchblade Overview
3 Switchblade Configuration
3.1 Nginx Configuration
A configuration file named ssl.conf is installed in the /etc/nginx/conf.d directory and contains a server
configuration section for each redirection domain.
The key configuration parameters are as follows:
➊ Listen address and port
➋ SSL certificate locations (and SSL configuration parameters)
➌ Redirection logic
The redirection logic checks the SSL client's certificate and, if valid, redirects the packets to the
Honeycomb tool-handler at the specified address and port number (172.16.64.100, port 4098). All other
traffic is sent to a corresponding cover server (address 172.16.64.12, port 44302).
3.2 Network Routing
Linux policy routing is used to sort routed packets and keep the implant beacon's source address intact.
SECRET//NOFORN//20390430 3
# HTTPS server
server {
listen 172.16.63.113:443 ssl; ➊
server_name nginx.edb.devlan.net;
ssl_certificate /etc/nginx/certs/domainA/server.crt;
➋ ssl_certificate_key /etc/nginx/certs/domainA/server.key;
ssl_client_certificate /etc/nginx/certs/domainA/ca.crt;
ssl_verify_client optional;
ssl_verify_depth 2;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
proxy_set_header Host $host:$proxy_port;
➌ location / {
if ($ssl_client_verify = SUCCESS) {
proxy_pass http://172.16.64.100:4098;
}
proxy_pass http://172.16.64.12:44302;
}
}

- 1
- 2
…
- 7
- 8
- 9
- 10