# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Fulcrum User Manual v0.62

5 December, 2011

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14
…
- 22
- 23

UNCLASSIFIED//LES
UNCLASSIFIED//LES Page12
PARAMETER_NAME=<ParameterValue>
Hereisanexampleconfigurationfileinitsunencryptedform.
VICTIM_MAC=AA:AA:AA:AA:AA:AA
HIJACKED_MAC=BB:BB:BB:BB:BB:BB
MILLISECONDS_BETWEEN_SPOOFS=1000
INJECTED_URL=http://www.cnn.com
INJECTION_METHOD=DOUBLE_FRAME
USABLE_MEDIA_TYPES=text/html,*/*
USER_AGENT_WHITELIST=
USER_AGENT_BLACKLIST=
5.1.3 COMPILEDPARAMETERS
Ifnocommandlineparametersandnoconfigurationfilearepresent,Fulcrumwillusethedatathatwas
compiledintotheapplicationforitsrequiredparameters.Thisprovidesanothermethodofexecuting
FulcrumandavoidstheconfigurationfileondiskorthecommandlineparametersappearingintheTask
Manager.Thiswasoriginallyaddedtosupportinmemoryonlydeploymentandexecution.While
Fulcrumitselfcanbedeployedandexecutedinaninmemoryonlyfashion,theWPCAPProsupportDLL
willwritetemporaryfilestothediskandmakechangestotheregistry.Itisimportanttonotehowever,
thatthisinformationisstoredinplaintextinanunobfuscatedmannerinthebinary.
Inordertochangethesevalues,itisnecessarytogetadevelopertorecompiletheapplication.The
operationalneedforthecontinuedsupportofthisfeaturewillbereviewed.Thenitmayeitherbe
removedfromfutureversionsoralteredtoallowforeasiereditingbytheenduserswithoutrequiringa
developertobeinvolved.
5.1.4 CONFIGURATIONOPTIONS
ParameterName
Description
AcceptableValues
DefaultValue
VICTIM_MAC
TheMACaddressofthe
TargetMachineinthe
formof
XX:XX:XX:XX:XX:XX
00:00:00:00:00:01
–FF:FF:FF:FF:FF:FE
inclusive
66:77:88:99:AA:BB
HIJACKED_MAC TheMACaddressofthe
HijackedMachine
(typicallytheDefault
gateway)intheformof
XX:XX:XX:XX:XX:XX

Thisparameterisalso
usedtoverifythatthe
applicationisrunningon
thecorrectnetwork.
00:00:00:00:00:01
–FF:FF:FF:FF:FF:FE
inclusive
BB:CC:DD:EE:FF:00
MILLISECONDS_BETWEEN_SPOOFS
Thenumberof
0–2,147,483,647
1000

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14
…
- 22
- 23