# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Archimedes 1.2 Addendum

23 August, 2013

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8

SECRET//NOFORN

4
SECRET//NOFORN
shouldbenospacesbetweenURLs.ThefollowingisanexampleofspecifyingtheHOST_WHITELISTinthe
configurationfile:
 HW=www.badguys.com,target.com,www.target.com 
(S//NF)Intheexampleab ove,theusehasspecifiedthreetargetsthatcan beinjectedagainst:
“www.badguys.com”,“target.com”,and“ www.target.com”.Whitelistmatchesarecaseinsensitive,butexact.In
thisexample,notethatArchimedeswillnotidentifythefollowinghostsasmatch es:“badguys.com”,
“web.target.com”,“site.www.target.com”.Atthisti me,thereisnosupportforwildcardorregularexpression
matchinginthew hitelistprocessing.
(C)FIREANDFORGETSUPPORT
(S//NF)FireandForget(v.2)sup porthasbeenupdatedtorequirethenewcommandlineswitchesasdescribed
previously.
(U)CHANGESTO APPLICATION DEFAULTS
(S//NF)ThedefaultvalueforINJECTION_METHOD(IM)ischangedtoSO(SURVEY_ONLY).
(S//NF)ThedefaultvalueforVERIFY_ROUTE(VR)hasbeenchangedtoFALSE.
(S//NF)Themaximumnumberofinjectionsthat willbeattemptedbeforequitt inghasbeenreducedfrom10to5. 
(S//NF)TheAESkeythatArchimedesusestoencrypt/decrypttheconfigurationfileandthesurveyresults(andthe
debuglog,forthedebugversion)hasbeenchan gedandthereisnobackwards/ forwardscompatibilitybetween
versions.
(U)TROUBLESHOOTING
(S//NF)Version1.2requiresthatthenewnames(asdescribedinthe“ RenamedConfigurationItems”sectionare
usedintheconfiguration fileandfortheINJECTION_METHODasspecifiedonthecommandline.Forexample,one
mustuse“mDF”fortheDOUBLE_FRAMEmethod.UsingtheoldstylenamewillcauseArchimedestofail.
(S//NF)Archimedesverifiesasuccessfulinjectionagainstatargetbymonitoringth eH TTPtrafficforthetarget’s
requestthatcontainsth einjectedURL.Unfortunately,iftheinjectedURLusesanSSLconnectionorusesaport
otherthanthemonitoredport,thentheinjectedURLwillneverbeseen.Afterwaitingafewseconds,
Archimedeswillresetitselfandperformthein jectio nattackagain.Thiswilloccur5timesb eforethetoolgivesup
andquits.ItishighlyrecommendedthattheoperatorstopsArchimedes(usingtheappropriatestopEXE/DLL)once
asuccessfulattackhasbeenperformed(asdeterminedbyobservingthecallin totheattackserver).
(S//NF)CertainHTMLtagsdesignedtoprotectusersagainstcrosssitescriptingattacksareincompatiblewiththe
HTMLinjectedby someofth einjectionmethods.Thesetags,whichpreventtheuseofFRAMEsorIFRAMEs,will
causeablankpagetoloadonthetargetorawarnin gtoappearinthebrowser.Ithasbeenobservedthatseveral
popularwebsites(e. g.
www.google.com)employthesetags,sothepurposeofthesurveymodeandwhitelististo
allowanoperatortospecifya(small)setofexploitablesitesbasedonobservedtraffic.

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8