Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//ORCON//NOFORN
15.4 Automation
Log collection may be automated by setting a Cron job on the C2 or LP to
periodically invoke the collector. A job on the LP can invoke the Log Collector
directly. A job on the C2 can invoke the collector by sending it a dummy file via the
Galleon Transport interface.
An example of automating log collection from the C2 is provided below. It will invoke
the Log Collector on the LP from the C2 every 3 minutes.
crontab (root)
*/3 * * * * /work/gibson/collect_logs.sh
/work/gibson/collect_logs.sh
#!/bin/bash
# setup environment
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# invoke collector
foo="/work/gibson/foo"
transport="/work/transport/client"
echo foo > $foo
$transport cron logcollect $foo
130
SECRET//ORCON//NOFORN