# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Fulcrum User Manual v0.61

15 November, 2011

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14
…
- 22
- 23

UNCLASSIFIED//LES
UNCLASSIFIED//LES Page12
Optionalparametersmaybesuppliedintheconfigurationfileandwillover ridethebuilt‐indefaults.
Eachconfigurationparameterissuppliedintheform
PARAMETER_NAME=<ParameterValue>
Hereisanexampleconfigurationfileinitsunencryptedform.
VICTIM_MAC=AA:AA:AA:AA:AA:AA
HIJACKED_MAC=BB:BB:BB:BB:BB:BB 
MILLISECONDS_BETWEEN_SPOOFS=1000
INJECTED_URL=http://www.cnn.com
INJECTION_METHOD=DOUBLE_FRA ME
USABLE_MEDIA_TYPES=text/html,*/*
USER_AGENT_WHITELIST=
USER_AGENT_BLACKLIST=
5.1.3 COMPILEDPARAMETERS
If no command‐line parameters and no configuration file are present, Fulcrum will use the data that w as
compiledintotheapplicationforitsrequiredparameters.Thisprovidesanothermethodofexecuting
Fulcrumandavoidstheconfiguration fileondiskorthecommand‐lineparametersappearingintheTask
Manager.Thiswasoriginallyaddedtosupportin‐memoryonly deploymentandexecution.While
Fulcrumitselfcanbedeployedandexecutedinanin‐memoryonlyfashion,theWPCAPProsupportDLL
willwritetemporaryfilestothediskandmakechangestotheregistry.Itisimportanttonotehowever,
thatthisinformationisstoredinplaintextinanun‐obfuscatedmannerin th ebinary.
Inordertochangethesevalues,itisnecessarytogetadeveloper tore‐compiletheapplication.The
operationalneedforthecontinuedsup portofthisfeaturewillbereviewed.Thenitmayeitherbe
removedfromfutureversionsoralteredtoallowforeasiereditingbytheend‐userswithoutrequiringa
developertobeinvolved.
5.1.4 CONFIGURATIONOPTIONS
ParameterName Description AcceptableValues DefaultValue
VICTIM_MAC TheMACaddressofthe
TargetMachineinthe
formof
XX:XX:XX:XX:XX:XX
00:00:00:00:00:01
FF:FF:FF:FF:FF:FE
inclusive
66:77:88:99:AA:BB
HIJACKED_MAC TheMACaddressofthe
HijackedMachine
(typicallytheDefault
gateway)intheformof
XX:XX:XX:XX:XX:XX

Thisparameterisalso
usedtoverifythatthe
00:00:00:00:00:01
FF:FF:FF:FF:FF:FE
inclusive
BB:CC:DD:EE:FF:00

- 1
- 2
…
- 10
- 11
- 12
- 13
- 14
…
- 22
- 23