Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
UNCLASSIFIED
Cherry Bomb Program Cherry Blossom Internal Test Procedures
Ensure the appropriate processes are running. Execute ‘ps -ef | grep cbuser’ and
ensure that a java process is running for both CherryTree and CherryWeb
(cherrytree/cherryweb) as well as the /home/cbuser/bin/sync-{IP_address}.sh script.
Pass/Fail: The test passes if all three verification methods pass.
5.50 Status Alert Pruning
Description: Tests that the zakura server prunes CherryWeb status alerts that are
older than a week.
Setup: Perform the following steps to modify the CherryTree database to ensure that
an old entry exists.
From a terminal window, connect to the cherrytree database by executing: ‘mysql
--user=cbuser --password={cbuser password} cherrytree’
Get the list of status messages currently in the system by executing: ‘SELECT
Status_ID, Status_Date FROM Status WHERE WAN_MAC=”77:77:77:77:77:77”’.
If there are at least two messages, update the status date of the oldest one so that it
is older than one week. This can be done by executing: ‘UPDATE Status SET
Status_Date=”{new_date}” WHERE Status_ID=”{id}”’. The {new_date} value should
be in the format ‘YYYY-MM-DD HH:MM:SS’, however, you can leave out the time
component and have it automatically be set to ‘00:00:00’. The {id} value should be
the Status_ID to update.
If at least two status messages don’t exist, create them by executing the
check_cherrytree script against zakura multiple times. Verify the status messages
exists by re-running step 2, and then running step 3 to force a message to have a
date older than a week ago.
Procedure: Perform the following steps to ensure that CherryWeb status alerts are
successfully deleted. These steps must be performed on the server hosting zakura.
From a terminal window, connect to the cherrytree database by executing: ‘mysql
--user=cbuser --password={cbuser password} cherrytree’
Get the list of status messages currently in the system by executing: ‘SELECT
Status_ID, Status_Date FROM Status WHERE WAN_MAC=”77:77:77:77:77:77”’.
Take note of the Status_ID of the message older than one week.
Restart CherryTree by executing: ‘service cherrytree restart’. This will force the
parsing scrip to run.
Run ‘SELECT Status_ID, Status_Date FROM Status WHERE Status_ID={id}’ where
{id} is the Status ID you noted in step 2. Verify that no results are returned.
UNCLASSIFIED
69