Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//ORCON//NOFORN
10.4.3 Execution Commands
The task sub-shell provides the following commands that will add Assassin code
execution commands to the task being created.
Code is executed directly from Assassin and will have the same permissions as
the Implant on the target.
execute_bg EXE_PATH [ARGS]
Execute an EXE file on the target in the background.
By running in the background, the Implant will continue operation immediately.
The standard output and return code of the program are ignored.
EXE_PATH
path of EXE file to execute
ARGS
command line arguments to the executable (default = *)
execute_fg EXE_PATH [ARGS]
Execute an EXE file on the target in the foreground.
By running in the foreground, the Implant will wait for the program to exit. The
standard output and return code of the program are collected and returned.
EXE_PATH
path of EXE file to execute
ARGS
command line arguments to the executable (default = *)
load_faf MODULE_PATH [ARGS]
Load and execute a Fire-And-Forget v2 (FAF) DLL in memory.
The DLL is loaded and executed in a separate thread and, based on the ordinal
return value, it will be unloaded or it will be "forgotten" and remain running.
The Implant will continue to operate while the DLL executes.
MODULE_PATH
local path of the FAF module to load and execute
ARGS
command line arguments to the FAF module (default = "")
load_ice MODULE_PATH [ARGS]
Load and execute an ICE v3 (ICE) DLL in memory.
The DLL is loaded and executed in a separate thread based on the feature set
selected. Assassin currently supports the Fire and the Forget feature sets.
The Implant will continue to operate while the DLL executes.
Note: The ICE META.xml file must be provided with module, as required by the
ICE specification.
MODULE_PATH
local path of the FAF module to load and execute
98
SECRET//ORCON//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh