# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# SeaPea v2.0 - User Guide

6 November, 2008

- 1
- 2
- 3
- 4
- 5

1/7/09 8:49 AMbranches:udb:tools:mackernel:user_guide_2.0 [aed.net - wiki]
Page 1 of 5http://www.udb.net/wiki/doku.php?id=branches:udb:tools:mackernel:user_guide_2.0
##################### CLASSIFICATION: SECRET #####################
Last Updated: 11/06/08
SeaPea v2.0 for Mac OSX 10.4.X - 10.5.X
Developer: IOC/EDG/AED/UDB
Version: SeaPea v2.0
Introduction
SeaPea is an OS X Rootkit that provides stealth and tool launching capabilities
Requirements: Mac OS X 10.4.X and 10.5.X Intel Operating System; IPV4 Compatible
Delivery
An unclassified shell script named “nvwc”. This script when executed will create an installer that is
intended to execute on the target.
How to create an Installer
Summary: The nvwc file is a script that creates an installer shell script that will be called .r89. The .r89
script will infect the target box with SeaPea and any bundled tools (if bundled tools are desired). If bundled
tools are NOT desired, just run the nvwc script by typing sh ./nvwc. The .r89 file will be created in the
current directory. If bundled tools are desired, follow the steps below:
Step 1: Create a tool directory. The name of this directory does not matter. For example, mkdir
operationTools.
Step 2: Inside the tool directory place all tool binaries and/or scripts.
Step 3: Now, we must decide when the tools are to launch. To do this we create a directory called svlog
inside of the tools directory. For example, mkdir ./operationTools/svlog.
Step 4: For each tool, a launchd plist file must be created inside of the svlog subdirectory. The plist will
be launched by the launchd service of OS X. The plist will contain all information on how and when the
tool will be launched. Information on how launchd plist files work can be found by typing man
launchd.plist inside the terminal. The tool scheduler template follows. Only modify those lines
encapsulated by double stars. All other lines below must be included to prevent the execution of the tool
from showing up in the system log. Additional key/value’s can be added for scheduling purposes
according to the man page.
Tool Scheduler Template
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.apple.linkagent.l64.**XXXX**</string> <-- replace the last 4 characters with you own unique characters
<key>ProgramArguments</key>
<array>
<string>../.pq/scr</string>
<string>**./TOOL_NAME**</string>
<string>**TOOL_ARG1**</string>
<string>**TOOL_ARG2**</string>
<string>**TOOL_ARG_i**</string>
<string>**TOOL_ARG_n**</string>
</array>
<key>RunAtLoad</key> <--- Optional, tells launchd to run the tool when the plist is initially loaded.
<true/>
<key>StartInterval</key> <--- Optional, tells launchd to run the tool every 60 seconds
<integer>60</integer>
<key>StandardErrorPath</key>
<string>/dev/null</string>
<key>StandardOutPath</key>
<string>/dev/null</string>
<key>ThrottleInterval</key>
<integer>0</integer>
<key>WorkingDirectory</key>
<string>/etc/.ptm.log/.term32</string>
</dict>
</plist>

- 1
- 2
- 3
- 4
- 5