# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Archimedes 1.3 Addendum

13 January, 2014

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8

SECRET//NOFORN
(U) NEW FEATURES
(S) SUPPORT FOR ADAPTERS WITH MULTIPLE ADDRESSES
(S//NF) Versions of Archimedes prior to 1.3 will fail silently when the tool is executed on a
computer with more than one IP address or gateway address assigned to a single network
adapter. This configuration is illustrated in the following figure:
>ipconfig
Windows IP Configuration
Ethernet adapter Local Area Connection 2:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 192.168.100.100
Subnet Mask . . . . . . . . . . . : 255.255.255.0
IP Address. . . . . . . . . . . . : 192.168.200.100
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 172.16.1.1
192.168.200.10
2.2.2.1
(S//NF) Note that this configuration illustrates a single network adapter that has been
configured with multiple IP and gateway addresses, not a computer with multiple network
adapters (the latter case is handled appropriately by all versions of Archimedes).
(S//NF) Archimedes 1.3 will attempt ARP resolution for the provided gateway MAC address in
order to identify the appropriate gateway IP address. For situations with multiple gateway
addresses and a single IP address, Archimedes 1.3 will operate without requiring any
additional configuration.
(S//NF) Adapters with multiple IP addresses require that the operator specify which IP
address should be used in the DNS cache injection attack. The operator should choose the IP
address that is on the same network segment as the gateway and victim that is being
targeted. The following sections describe how to specify this address from the command line
or in the configuration file.
(S) COMMAND LINE ADDRESS SPECIFICATION
(S//NF) Support for multiple IP addresses requires the use of the “-a” command line
argument.
ARCHIMEDES 1.3 USAGE
REQUIRED
-t [Target MACAddress]
-g [Gateway MACAddress]
OPTIONAL
-u [Injected URL, required except for SURVEY_ONLY (SO) method, No default]
-d [MILLISECONDS_BETWEEN_SPOOFS, Optional, Default: 1000]
-v [VERIFY_ROUTE (TRUE/FALSE), Optional, Default: FALSE]
-m [INJECTION_METHOD, Optional, Default: SO]
-p [PORT for HTTP monitoring, Optional, Default: 80]
4
SECRET//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8