# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Fulcrum User Manual v0.61

15 November, 2011

- 1
- 2
- 3
- 4
- 5
- 6
- 7
…
- 22
- 23

UNCLASSIFIED//LES
UNCLASSIFIED//LES Page5
FULCRUMSHUTDOWNisahelperutilitywhich canbedeployedtotheP ivotMachineinorderto
explicitlyinitiateashutdownofthe
F ULCRUMapplication.
FULCRUMENCRYPTERisahelperutilityuse dontheDeploymentPreparationMachinetomanipulate
Fulcrumsconfigurationandlogfiles.
Fourhigh‐levelobjectiveswer eide ntifiedandprioritizedforthisproject.Inorderofhighesttolowest
priority,theyare:
1. CorrectnessCorrectTarget,CorrectNetwork,SuccessfulInjectio n
2. StabilityDontcrashthesystem,theapplication,ortheprocess.
3. Stea lthRemainimperceptibletotheuser,avoidPersonalSecurityProduct(PSP)Detection,
avoidIntrusionDetectionSystem(IDS)detection,anddontgetcaught.
4. UsabilityAvoidhumanerrors(easytoconfig ure,easytodeploy),Manag eApplicationSize
(largebinariespresentaproblem),ManageResourceUsage
2.5 ANATOMYOFTHEPIVOT
Therearetwobasiccomponentsto thispivotingtechnique:theARPbasedman‐in‐the‐middle(MITM)
andTCPsessionhijackforHTTPtrafficinjection.SpeciallycraftedHTTPresponsesaresent tothetarget
inresponsetoHTTPrequestsmadebythetargetbyhijackingtheTCPsession.Theseresponsesdeliver
theoriginallyrequestedcontentaswellasthewax.
2.5.1 AR P SPOOFINGTOGETINTHEMIDDLE
TheAddressResolution Protocol(ARP)isthenetworkprotocolusedtoresolveOSILayer3Network
Addresses(e.g.IPv4addresses)intoOSILayer2LinkAddresses(e.g.MACaddress).AlthoughARPhas
beenimplementedforanumberofcombinationsofLayer3andLayer2implementations,Fulcrumis
focusedonlyontheInternetProtocolVersion4(IPv4)andIEEE802.3(Ethernet)environment.The
combinationofIPv4andEthernetrepresentstheoverwhelmingmajorityofLocalAreaNetworks(LAN).
Whenacomputerwantstosendda tatoanothercomputeronanEthernetnetwork,itmustfirst
translatetheIPaddressoftheremotemachineinto itscorrespondingMACaddress.Thisinformationis
thenusedtoformanEthernetFramecontaining,amongotherthings,theIPpacketandthedata
payload.InaswitchedEthernetenvir onment(whichisthemostcommon),theMACaddress
informationintheEthernetFrameisthenusedtoroutetheframefromtherequestingmachinetothe
remote machine.AsaresultpeermachinesonaLANdonotseethevastmajorityoftrafficthatis
generatedbyeachother.
ARPSpoofingisatechniqueusedonaLANtoallowanattackersmachinetointerceptdataframesfrom
peermachinesthatwereintende dforotherdestinations.Thisplacestheattackersmachineinthe
middleofanytrafficfromthetargetsmachinetoanyotherdestinationandisknownmorecommonly
astheman‐in‐the‐middle.ARPSpoofing compromisesthetargetsmachines translationofIPv4
addressesintoMACaddressesbysendingspoofedARPpacketswhichassociatetheattackersMAC
address with IP address of another host (such as th e default gateway). Any traffic meant for that IP

- 1
- 2
- 3
- 4
- 5
- 6
- 7
…
- 22
- 23