Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

UNCLASSIFIED//LES
UNCLASSIFIED//LES Page12
Optionalparametersmaybesuppliedintheconfigurationfileandwillover ridethebuiltindefaults.
Eachconfigurationparameterissuppliedintheform
PARAMETER_NAME=<ParameterValue>
Hereisanexampleconfigurationfileinitsunencryptedform.
VICTIM_MAC=AA:AA:AA:AA:AA:AA
HIJACKED_MAC=BB:BB:BB:BB:BB:BB
MILLISECONDS_BETWEEN_SPOOFS=1000
INJECTED_URL=http://www.cnn.com
INJECTION_METHOD=DOUBLE_FRA ME
USABLE_MEDIA_TYPES=text/html,*/*
USER_AGENT_WHITELIST=
USER_AGENT_BLACKLIST=
5.1.3 COMPILEDPARAMETERS
If no commandline parameters and no configuration file are present, Fulcrum will use the data that w as
compiledintotheapplicationforitsrequiredparameters.Thisprovidesanothermethodofexecuting
Fulcrumandavoidstheconfiguration fileondiskorthecommandlineparametersappearingintheTask
Manager.Thiswasoriginallyaddedtosupportinmemoryonly deploymentandexecution.While
Fulcrumitselfcanbedeployedandexecutedinaninmemoryonlyfashion,theWPCAPProsupportDLL
willwritetemporaryfilestothediskandmakechangestotheregistry.Itisimportanttonotehowever,
thatthisinformationisstoredinplaintextinanunobfuscatedmannerin th ebinary.
Inordertochangethesevalues,itisnecessarytogetadeveloper torecompiletheapplication.The
operationalneedforthecontinuedsup portofthisfeaturewillbereviewed.Thenitmayeitherbe
removedfromfutureversionsoralteredtoallowforeasiereditingbytheenduserswithoutrequiringa
developertobeinvolved.
5.1.4 CONFIGURATIONOPTIONS
ParameterName Description AcceptableValues DefaultValue
VICTIM_MAC TheMACaddressofthe
TargetMachineinthe
formof
XX:XX:XX:XX:XX:XX
00:00:00:00:00:01
FF:FF:FF:FF:FF:FE
inclusive
66:77:88:99:AA:BB
HIJACKED_MAC TheMACaddressofthe
HijackedMachine
(typicallytheDefault
gateway)intheformof
XX:XX:XX:XX:XX:XX
Thisparameterisalso
usedtoverifythatthe
00:00:00:00:00:01
FF:FF:FF:FF:FF:FE
inclusive
BB:CC:DD:EE:FF:00

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh