WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 30
- 31

SECRET//NOFORN
(U) Overview (U) Hive 2.9.1 User's Guide
(S) The Hive release consists of the following files along with the unpatched binaries.
Filename Function
css.xml XML file for cutthroat's custom command set.
cutthroat Standardized interface for operators to run hclient.
hclient Linux executable. Used to send triggers to and interactively
communicate with the Hive implants. Has not been updated since
Hive v1.x, but most implant features still work with it.
hive Cutthroat ILM (i.e. module, shared library object). Provides the
client functionality to send triggers to, and interactively
communicate with, the Hive implants.
hive-patcher Linux executable. When run, it produces executables with
command line parameters patched-in.
hiveReset_v1_0.
py
Python script for updating existing hive implants on remote boxes
with a more recent version.
honeycomb.py Linux executable. Tool handler for Hive beacons. HTTPS beacons
validated by Swindle are passed to Honeycomb. Honeycomb
receives and logs the beacons.
swindle.cfg ASCII text file. Hive beacons use Loki's Blot DP/LP. Swindle is the
HTTPS proxy that verifies the beacons before forwarding to the
tool handler.
(S) Below is the list of files included in this release, along with their size and MD5 hash.
Filename
File Size
(bytes) MD5 Hash
CCS.xml 490235 1dd06dd5b74ceb7cab9b599a22f99975
cutthroat 1095780 caba38dc033c86f5f9daa837dfe4c2fa
hive 533444 ef8fc356ba582fd0adebb9559ae8d39e
hive-patcher 2523564 b739318baa62f03f3f80c31a431c4a3c
hiveReset_v1_0.py
58303 d3153e378e24f4bed0ceddfcab599fb8
honeycomb.py 16539 7594d6969c537c12b3cd51a55eaff12c
swindle.cfg 680 3b9185be038c826c39734f1be273b37f
Unpatched Binaries
hived-avtech-arm-unpatched 759040 ee1420c62e3de69295c32c2d407b8770
hived-linux-x86-unpatched 275057 482cb455a28ac64c8969c1bdbf3793cc
hived-mikrotik-mips-unpatched 411836 49bd4771e17790ee44f340e1fda54752
hived-mikrotik-ppc-unpatched 354828 c4b9cb11180d313fd4c96d86cc0d03fd
hived-mikrotik-x86-unpatched 290249 4eeabd7983f018cabbd9398948a8c389
hived-ubiquiti-mips-unpatched 411836 3bf908ec4ddb278335440275ff38c68f
2 SECRET//NOFORN//20401109

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
…
- 30
- 31