# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# SeaPea v2.0 - User Guide

6 November, 2008

- 1
- 2
- 3
- 4
- 5

1/7/09 8:49 AMbranches:udb:tools:mackernel:user_guide_2.0 [aed.net - wiki]
Page 3 of 5http://www.udb.net/wiki/doku.php?id=branches:udb:tools:mackernel:user_guide_2.0
Fail-safe mechanisms
SeaPea v2.0 has been designed to fail if it encounters problems. If SeaPea finds that it is unable to hide
file/directories, socket connections, or processes, it will immediately unload itself and then securely delete
itself and all tools from the filesystem. As an option, an operator can specify that a tool be left behind to
execute in “plain sight” in order to maintain persistence. This last option application will be referred to as
the
failsafe-app
.
The
failsafe-app
will persist through reboot, and will act in much the same manner as any of the other
tools in that it will be launched from a plist file by launchd. The fail-safe app, however, will NOT be able to
utilize the stealth capabilities provided by the rootkit since SeaPea will have removed itself from the
system due to failure. Refer to the “How to Create an Installer” section for more information on how to
incorporate the
failsafe-app
into the installer.
Directory Structure
The install script will create the following directory structure:
* /etc/.ptm.log <- root directory for SeaPea. (Referred to as $home)
* $home/.mod64t.tar <- SeaPea 10.4 Implant Tarball
* $home/.mod64l.tar <- SeaPea 10.5 Implant Tarball
* $home/.svlog <- tool schedule plists for launchd
* $home/.term32 <- tools are stored here
* $home/.cr12 <- Currently not used
* $home/.pq <- Directory for SeaPea upkeep files.
* $home/.module <- SeaPea Implant temporary loading directory. (the contents of this directory are deleted after each startup)
* $home/.framework <- Currently not used
* /System/Library/LaunchDaemons/com.apple.ptm.log.plist <- configuration file for launchd persistence. (becomes hidden when tool installed)
Process Types
SeaPea distinguishes among two different types of processes:
1. A non-elite process: All processes running on a computer are by default
non-elite
. A
non-elite
process
CANNOT see hidden files/directories, processes, or socket connections.
2. An elite process: This process and all socket connections associated with it will be hidden by SeaPea. Any of
its child processes will inherit its
elite
properties. However, even though it has an elevated status, an
elite
process CANNOT see hidden files/directories, processes, or socket connections. This provides the operator
a way of checking that his/her activities are being hidden without having to leave
elite
status.
If an
elite
process wants to be able to see hidden files/directories, processes, or socket connections, it
can turn on all-seeing mode.
(S) Commands for changing eliteness of shell terminal
touch .<non-existent-directory>/hfs99_open <---------- the shell terminal is now elite
touch .<non-existent-directory>/hfs99_close <---------- the shell terminal is not non-elite
touch .<non-existent-directory>/rev411_open <---------- the elite shell terminal is now all-seeing
touch .<non-existent-directory>/rev411_close <---------- the elite shell terminal no longer is all-seeing
NOTE: A command is executed successfully if nothing is returned in the terminal. If the touch command
prints a “file does not exist” error to the terminal, then the command did not execute. For example, if you are
elite, and you try and become elite again, the command will fail.
Features
(S)
Process Hiding
: A hidden or elite process is hidden from non-elite and non all-seeing processes.
When a non-elite or non all-seeing process executes ps, top, or Activity Monitor, all elite
processes will be hidden. An all-seeing user executing the same commands will be able to see those
hidden processes.
(S)
File/Directory Hiding
: When a non-elite or non all-seeing process executes commands ls or lsof;
or is using the Finder to browse directories/files, all files or directories containing the string “.ptm.log”
will be hidden – these files/directories will be referred to as “stealth files” or “stealth directories”. An all-
seeing process executing the same commands will be able to see those hidden files/directories, with
exception to hidden files viewed via the finder (don’t want to cache those files).
Important Note
: By default, Spotlight will not index files that begin with a dot (”.“) or end with
the suffix “.noindex“, or files located outside of user directories. For this reason, the default $home
is located in a non-user directory, and most files are preceded with a “.”. Any stealth files/directories
outside of $home should follow at least one of the conventions mentioned above.

- 1
- 2
- 3
- 4
- 5