Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//ORCON//NOFORN
4.4 Maintenance Tasks
The following tasks are used to maintain the health of the Implant and clean up
the Implant at the close of its operation.
get_status <run_mode> <status_mode> <options>
Request the current Implant configuration and status information.
run_mode
Code specifying the run mode, represented by combining the
following keys:
‘r’ - run the task on receipt
‘s’ - run the task on every Implant startup
‘p’ - push the task results to the LP immediately
status_mode
Type of configuration/status requested from target implant,
one of the following:
‘running’ - config currently used by the implant, may not be
persistent
‘persistent’ - config loaded and used by Implant at startup
‘factory’ - config Implant had at installation
options
Type of information requested from target implant, one or
more of the following:
‘all’ - all of the status information available
‘basic’ - basic Implant information, including:
* configuration block magic number
* hibernate configuration
* predicted time and date Implant will uninstall
* time and date that Implant was installed/first run
* time and date that Implant started
‘beacon’ - beacon configuration settings, including:
initial wait, default interval, jitter, maximum interval,
backoff multiple, maximum failures
‘comms’ - comms configuration, including:
chunk size and transport list
‘dirs’ - directories created and used by Assassin
‘dirs_files’ - files stored in Assassin directories
‘list’ - whitelist and blacklist configurations
clear_queue <run_mode>
Clear all files from the Implant upload queue.
The clear_queue task will delete all files from the output, push, and staging
directories on target. This may include chunks of files that have been partially
uploaded.
run_mode
Code specifying the run mode, represented by combining the
following keys:
‘r’ - run the task on receipt
‘s’ - run the task on every Implant startup
‘p’ - push the task results to the LP immediately
40
SECRET//ORCON//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh