Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//ORCON//NOFORN
10.4.5 Maintenance Tasks
The following tasks are used to maintain the health of the Implant and clean up
the Implant at the close of its operation. Tasks are provided to check Implant
status, manage the upload queue, modify persistence, or uninstall completely.
get_status <run_mode> <status_mode> <options>
Request the current Implant configuration and status information.
run_mode
Code specifying the run mode, represented by combining the
following keys:
‘r’ - run the task on receipt
‘s’ - run the task on every Implant startup
‘p’ - push the task results to the LP immediately
status_mode
Type of configuration/status requested from target implant,
one of the following:
‘running’ - config currently used by the implant, may not be
persistent
‘persistent’ - config loaded and used by Implant at startup
‘factory’ - config Implant had at installation
options
Type of information requested from target implant, one or
more of the following:
‘all’ - all of the status information available
‘basic’ - basic Implant information, including:
* configuration block magic number
* hibernate configuration
* predicted time and date Implant will uninstall
* time and date that Implant was installed/first run
* time and date that Implant started
‘beacon’ - beacon configuration settings, including:
initial wait, default interval, jitter, maximum interval,
backoff multiple, maximum failures
‘comms’ - comms configuration, including:
chunk size and transport list
‘dirs’ - directories created and used by Assassin
‘dirs_files’ - files stored in Assassin directories
‘list’ - whitelist and blacklist configurations
clear_queue <run_mode>
Clear all files from the Implant upload queue.
The clear_queue task will delete all files from the output, push, and staging
directories on target. This may include chunks of files that have been partially
uploaded.
run_mode
Code specifying the run mode, represented by combining the
following keys:
‘r’ - run the task on receipt
‘s’ - run the task on every Implant startup
‘p’ - push the task results to the LP immediately
108
SECRET//ORCON//NOFORN