Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

UNCLASSIFIED//FOUO
// END Engine.cpp
// ////////////////////////////////////////////////////////////////////////////
Installer
Obfuscate function calls
Use ExpandEnvironmentStrings for all UTF8 encoded string from
configuration
Create directory if path does not exist – SHCreateDirectoryEx or similar
Ensure system can uninstall .dll and .dat files by setting ACL for installed files
(e.g. SDDL_NETWORK_SERVICE) – may be able to do this at uninstall time
Ensure system can uninstall registry keys by setting ACL for registry – may be
able to do this at uninstall time
SCM – stop/start/query
o Set service to autostart
o Remove SCM trigger on service (ChangeServiceConfig2)
Listening Post (Python)
The server is implemented as a python script running on Centos?? (will also work on
Ubuntu and Windows). The server must support a RESTful interface that can
receive files and transmit files via HTTPS. To create a new interface, it is
recommended to use bottle/cherrypy/pyopenssl for this low side tool.
Bottle – bottlepy.org – provides a simple stackless/WSGI interface for Apache
CherryPy – provides a minimalist python web framework
Pyopenssl – provides ssl support
Configuring Apache
http_proxy
Configuring IIS
Microsoft IIS requires additional support packages to install ARR and UrlRewriter.
Install the following components for the platform you are using.
Install Web Platform Installer
WebPlatformInstaller_3_10_amd64_en-US.msi
WebPlatformInstaller_3_10_x86_en-US.msi
Install Web Farm
WebFarm2_x64.msi
WebFarm2_x86.msi
Install Microsoft`s Application Request Router (ARR)
requestRouter_x64.msi
requestRouter_x86.msi
Install Url Rewriter
rewrite_2.0_rtw_x64.msi
UNCLASSIFIED//FOUO

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh