# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Fulcrum Mission Manager Brief v0.6

5 July, 2011

- 1
- 2
- 3
- 4
- 5
- 6

UNCLASSIFIED//LES
 ThepivotmachineandthetargetmachinemustbothbeontheLANthatcorrespondstothe
MACaddressofthegatewayprovidedtoFulcrum(e.g.ifthehomeLANMAC isprovided,
FulcrumwontexecuteifthemachineisonthelocalcoffeeshopsLAN)
 Thetargetmachinemustgeneratewe btraffic(i.e.HTTPrequests)
 Thepivotmachinemustbeonandconnectedtothenetworkatthesametimethetarget
machineisonlineandgeneratingHTTPrequests.
3 RISKSANDCAVEATS
ThissectionidentifiesknownrisksandcaveatsintheuseofFulcrum.Eachriskisidentifiedand
describedandanyrecommendedmitigationstepsareenumeratedwherev erpossible.
3.1 FULCRUMDOESNOTMEASURESUCCESSORFAILURE BASEDONWAXSUCCESS
Description:Fulcrumdoesnotmeasureitssuccessorfailurebase donwaxsuccess.Fulcrumbasesit
successorfailureonwhetherthetargetmachinerequeststheinjectedURL.
Reason:MeasuringthesuccessorfailureofthewaxviaFulcrumispossiblehoweveritwouldrequire
Fulcrumtocontaintoomuchsensitiveinformationinordertodoso.
RecommendedMitigatio n:Ifthewaxsuccessrateislowenoughtocauseconcernforasuccessful
injectionbutafailedwax,thentherearetwooptions.Thefirstoptionistouseawaxwithahigher 
successrate,ifavailable.Thesecondoptionistoconsiderusinga notherdeliverymethodinplaceof
Fulcrum.
AdditionalNotes:
3.2 PIVOTMACHINEWILLBEDENIEDNETWORKCONNECTIVITYIFITCHANGES
NETWORKSWHILEFULCRUMISRUNNING.
Description:Ifthepivotmachine ismovedtoanothernetworkwhileFul crumisrunning,thepivot
machinewillnotbeabletoconnecttotheInternetorusenetworkingi ngeneral.
Reason:ThisisbecauseFulcrumplacesastaticARPentryforthedefaultgatewayinthepivotmachines
ARPtablewhentheapplicationstartsu p.Themachinemayswitchnetworksinanynumberofways,
includingswitchingnetwor kcablesorwirelessnetworks,orsleeping/hibernatingthemachineand
movingittoadifferentlocation.Whenitdoesso,thestaticA RPentryforthedefaultgateway willbe
wrongandnoneoftheirtrafficwillberouted.
RecommendedMitigatio n:Dont usemachinesthatarelikely toswitchnetworksasapivotmachine.
Thisincludeslaptopswhichmightbeputtosleeporintohiber nationandmovedfromlocationto
location.Anymachinewhichisinalocationthathasmultiplenetworksinuseshouldalso becarefully
reviewedbeforebeingchosenasapivotmachine.
AdditionalNotes:Ifthepivotmachineisrebooted,thestaticARPentrywi llnolongerbepresentand
Fulcrumwillnotberunning,sonetwor kconnectivitywillbereturnedtonormal.Ifthepivotmachine
UNCLASSIFIED//LES 
Page4

- 1
- 2
- 3
- 4
- 5
- 6