Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//NOFORN
Switchblade Overview
3 Switchblade Configuration
3.1 Nginx Configuration
A configuration file named ssl.conf is installed in the /etc/nginx/conf.d directory and contains a server
configuration section for each redirection domain.
The key configuration parameters are as follows:
Listen address and port
SSL certificate locations (and SSL configuration parameters)
Redirection logic
The redirection logic checks the SSL client's certificate and, if valid, redirects the packets to the
Honeycomb tool-handler at the specified address and port number (172.16.64.100, port 4098). All other
traffic is sent to a corresponding cover server (address 172.16.64.12, port 44302).
3.2 Network Routing
Linux policy routing is used to sort routed packets and keep the implant beacon's source address intact.
SECRET//NOFORN//20390430 3
# HTTPS server
server {
listen 172.16.63.113:443 ssl;
server_name nginx.edb.devlan.net;
ssl_certificate /etc/nginx/certs/domainA/server.crt;
ssl_certificate_key /etc/nginx/certs/domainA/server.key;
ssl_client_certificate /etc/nginx/certs/domainA/ca.crt;
ssl_verify_client optional;
ssl_verify_depth 2;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
proxy_set_header Host $host:$proxy_port;
location / {
if ($ssl_client_verify = SUCCESS) {
proxy_pass http://172.16.64.100:4098;
}
proxy_pass http://172.16.64.12:44302;
}
}

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh