Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//ORCON//NOFORN
13.6.8 ICE Load
The load ICE command tells the target Implant to load the provided ICE DLL into
memory and execute it using the ICE V3 specification.
XML Example
<ICELoad>
<FeatureSet>forget</FeatureSet>
<Ordinal>10</Ordinal>
<CmdLine>append</CmdLine>
<FileSize>1m</FileSize>
<DLLPath>c:\test\ice-test.dll</DLLPath>
</ICELoad>
Field Definitions
Feature Set
The feature set field describes the feature set to use when loading and executing
the DLL. Assassin currently only supports the “fire” and “forget” ICE feature sets.
In the example above, the feature set field is set to “forget”.
Ordinal
The ordinal field describes the ordinal function that will be executed once the
DLL has been loaded into memory. For ICE V3 this value will be ingested from the
provided DLL’s metadata file.
In the example above, the ordinal field is set to 10.
Command Line
The command line field describes the command line arguments to pass to the
ordinal call on execution.
In the example above, the command line value “append” will be passed to the
ordinal.
File Size
The file size field describes the size of the DLL file that is going to be uploaded to
the target.
In the example above, the DLL file is one megabyte.
DLL Path
The DLL path field describes the local full path to the DLL file that is going to be
uploaded to the target.
In the example above, the local file “c:\test\ice-test.dll” will be uploaded to the
target.
171
SECRET//ORCON//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh