WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
…
- 30
- 31

SECRET//NOFORN
(U) Hive 2.9.1 User's Guide (U) Deployment
3 (U) Deployment
3.1 (S) Beacons
(S) Patched or unpatched implants are provided by the generator application. In the case of
unpatched implants, the implant is started on target using the same command line arguments as
the patcher, less the patcher's '-m' option (see Section 2.3). Implants will detach from the user's
terminal and fork into the background.
(S) The goal is for the operator to have a consistent user experience, regardless of the implant's
operating system. On the wire, the implant mimics a SSLv3 handshake with Swindle (LP) and then
sends a small amount of encrypted data to the tool handler. The encrypted beacons consist of the
Swindle Tool ID, system uptime, and MAC address*. Hive version 2.0 added additional survey
information to the beacon. This data includes a process listing, ipconfig/ifconfig, "netstat -rn", and a
"netstat -an". In the event the survey fails, the RSI file will show an empty data element in the XML.
(S) *NOTE: Linux and MikroTik implants typically use the MAC assigned to the eth0
interface. At this time, the MAC address is used only as a unique identifier for tracking
implants.
(S) The beacon parameters cannot be changed dynamically by the hive tool handler. To change the
beacon parameters, the implants need to be re-patched with new parameters and re-deployed, or
in the case of unpatched implants, they need to be restarted with new command line arguments.
3.2 (S) Triggers
(S) The Hive client establishes an interactive session with the implant by sending it a trigger.
Starting with Hive version 2.7 only two trigger types are supported: raw-tcp and raw-udp.
(S) The raw-udp trigger can be sent to any UDP port on the target system. The raw-tcp trigger can
be sent to any open and listening port on the target system.
(S) The Hive implant watches for trigger packets in the incoming flow of network traffic. This
“sniffer” behavior can be slightly different on each operating system. On Linux and MikroTik, Hive
listens on all physical interfaces.
(S) Once the implant receives a valid trigger, it pulls the callback IP address and port from the
trigger packet, waits a default delay, and then calls back to the listening Hive client. Once
connected, the implant and Hive client perform a TLS handshake and initializes an AES encrypted
session. See (U) Idiosyncrasies & Limitations on page 19 for special situations.
3.3 (S) Implant Execution
The patched Hive implant is copied onto the target in a location from which the code is executable
using a suitable name for hiding in plain sight. When execution fails, the a number of error
messages may result and/or exit codes might be possible from the shell using the command “echo
$?”. Most of these errors should be caught by the patcher. Here are the possible exit codes:
SECRET//NOFORN//20401109 9

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
…
- 30
- 31