Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
UNCLASSIFIED//LES
UNCLASSIFIED//LES Page16
7 STEPBYSTEP
7.1.1 PREPAREACONFIGURATIONFILE
1. OnaWindowsmachine,createafilecalledf.cfg.decr.Youcanuseacopyofthef.cfg.example
filethatcomeswiththeproductasastartingpoint.
2. SupplyeachoftherequiredparametervaluesdescribedinSection5.1.4ConfigurationOptions
usingtheinformationgatheredduringtheprocessoutlinedinSection6.1.1Preparation.
3. Supplyanydesiredoptionalparametervalues
4. RefertoSection7.1.3EncryptingtheConfigurationFiletoencryptthefileforusewiththe
FULCRUMapplication.
7.1.2 UPDATEACONFIGURATIONFILE
WhenFulcrumisrunasanEXEwithcommandlineparameters,theparametervaluesincludingthe
injectionURLareavailableinplaintextviasimpletoolslikeTaskManagerorProcessExplorer.Compiling
theparametersintotheapplicationcanbetediouswhenyouwanttoreuseapivotmachinetotarget
multiplemachines.Youmaythenfinditusefultouseaconfigurationfilesothatyoucanjustuploadthe
newfileandrestartFulcrumtomovetothenexttarget.
1. FollowtheStepsinSection7.1.1PrepareaConfigurationFiletopreparethenewconfig
2. ShutdownFulcrumonthepivotmachine
3. Placethenewf.cfgfilenexttotheFulcrumbinary,overwritinganyexistingcopyifpresent
4. StartFulcrum
7.1.3 ENCRYPTINGTHECONFIGURATIONFILE
TheFulcrumconfigurationfilemustbeencryptingusingthe256bitkeyandtheAESalgorithminorder
fortheFulcrumapplicationtouseit.ThisiseasilyaccomplishedusingthesuppliedFULCRUMENCRYPTER
utility.Thisutilitywillcreateanencryptedcopyoftheconfigurationfile.
1. CopytheFULCRUMENCRYP TERbinary(FulcrumEncrypter32.exe)intothesamedirectoryasthe
configurationfile.
2. Openacommandprompt
3. Changedirectoriestothelocationofthef.cfg.decrfile
4. Encrypttheconfigurationfilebytypingthefollowingcommandintothecommandprompt:
FulcrumEncrypter32.exe–ef.cfg.decrf.cfg
7.1.4 DECRYPTINGTHECONFIGURATIONFILE
Ifyouneedtodecrypttheconfigurationfileforreason,suchasyouwanttoverifyitscontentsorupdate
itscontentsandyoudon’thavetheoriginaldecryptedversionhandy,youagainusthe
FULCRUMENCRYPTERutility.