WikiLeaks - Triton v1.3

# Vault 7: Projects

### Dark Matter

# Triton v1.3

- 1
- 2
- 3
- 4

Triton 1.3 User Guide
DESCRIPTION
Triton is an automated implant for Mac OS X. For information about the diskless,
EFI-persistent version of Triton called Der Starke, see the Der Starke 1.3 Companion User
Guide.
SYSTEM REQUIREMENTS
Supported Build/Postprocessing Systems
Mac OS X 10.7 or 10.8 + lxml♦
Linux with Python-2.7 + lxml♦
•
Supported Target Systems: Mac OS X 10.7 or 10.8•
Listening Post: Tested with Apache/2.2 on Linux and OpenBSD•
BUILD INSTRUCTIONS
Run triton.pz create -h. Build options and help will appear1.
After building, a directory called TRITON-XXXX will be created; XXXX is the specified
target ID Notable contents of the build directory:
UNCLASSIFIED/APACHE_FILES/elf32..........32-bit LP CGI executable for Linux♦
UNCLASSIFIED/APACHE_FILES/elf64..........64-bit LP CGI executable for Linux♦
UNCLASSIFIED/APACHE_FILES/cgi.c..........CGI executable source code♦
UNCLASSIFIED/APACHE_FILES/vhost.sh.......LP installation helper script♦
UNCLASSIFIED/APACHE_FILES/XXX(.conf).....Apache vhost config file and keys
directory
♦
UNCLASSIFIED/TASKING/....................Directory containing tasking files for
the LP
♦
UNCLASSIFIED/inst.sh.....................Implant install script♦
UNCLASSIFIED/config.last.................Last config generated♦
UNCLASSIFIED/target.cert.................Implant certificate♦
UNCLASSIFIED/lp.txt......................The last LP specified♦
UNCLASSIFIED/survey.bundle...............Survey bundle for use with bundles
command
♦
UNCLASSIFIED/error.guid..................An internal identifier for the implant
used in updates
♦
UNCLASSIFIED/error.name..................An internal identifier for the implant
used in updates
♦
CLASSIFY/ca_key..........................Certificate for decrypting payloads
(can be classified)
♦
2.
INSTALLATION INSTRUCTIONS
Installation options:
Execute inst.sh on the target system as root♦
Use Dark Mallet to cause inst.sh to be executed on the next boot♦
Mount the target system's disk to /Volumes--inst.sh will install the implant on
each valid OS X file system found in /Volumes
♦
•
Install locations for Triton/on-disk version
/var/spool/uucpd/♦
/System/Library/LaunchDaemons/com.apple.nis.ypbnd.plist♦
•
CONFIGURATION PARAMETERS
ID: A number used to identify and manage the implant's files and keys•
LP (-l): The URL of the CGI script to which the implant will beacon. The URL should
not contain an IP address if using fully authenticated SSL
•
Beacon Interval (-b): The minimum number of seconds between beacon attempts. Random
jitter may increase any given beacon interval by up to 33% of the specified value
•
SECRET//NOFORN

- 1
- 2
- 3
- 4