# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Archimedes 1.3 Addendum

13 January, 2014

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8

SECRET//NOFORN
INJECTION_METHOD as specified on the command line. For example, one must use “-m DF”
for the DOUBLE_FRAME method. Using the old style name will cause Archimedes to fail.
(S//NF) Archimedes verifies a successful injection against a target by monitoring the HTTP
traffic for the target’s request that contains the injected URL. Unfortunately, if the injected
URL uses an SSL connection or uses a port other than the monitored port, then
the injected URL will never be seen. After waiting a few seconds, Archimedes will reset
itself and perform the injection attack again. This will occur 5 times before the tool gives up
and quits. It is highly recommended that the operator stops Archimedes (using the
appropriate stop EXE/DLL) once a successful attack has been performed (as determined by
observing the call-in to the attack server).
(S//NF) Certain HTML tags designed to protect users against cross-site scripting attacks are
incompatible with the HTML injected by some of the injection methods. These tags, which
prevent the use of FRAMEs or IFRAMEs, will cause a blank page to load on the target or a
warning to appear in the browser. It has been observed that several popular websites (e.g.
www.google.com) employ these tags, so the purpose of the survey mode and whitelist is to
allow an operator to specify a (small) set of exploitable sites based on observed traffic.
(S//NF) Archimedes and Fulcrum only inject into HTTP requests that reference the root of the
document directory. For example, http://www.test.com/ but not
http://www.test.com/subdir/index.html . This continues to be true when targeting proxied
network connections.
(S//NF) The DEBUG binaries are classified SECRET//NOFORN and can be used to
obtain additional information in a classified lab environment.
6
SECRET//NOFORN

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8