WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8
…
- 30
- 31

SECRET//NOFORN
(U) Hive 2.9.1 User's Guide (U) Overview
1 (U) Overview
(S) Hive is a software implant designed with “Ring 2” operations in mind. It has two primary
functions: beacon and interactive shell. By design, both are limited in features with the purpose of
providing an initial foothold for the deployment of other full featured tools.
Hive version 2.9 adds an internal DNS resolver to enable name resolution in MikroTik 6.x and the
ability for the user to define the directory path for the self-delete control files (.config and .log) so
that they can be placed in writable flash space. It also adds AVTech Network Video Recorders to the
list of supported platforms, but only those that are ARM v7; older ARM v5 devices are not
supported.
(S) Hive provides implants for the following target operating systems and processor architectures
See section 8 starting on page 29 for more details about available and tested versions.
Currently
Supported
Platforms
Latest Available
Version
Tested Untested
AVTech NVR ARMv7♠ 2.9.1
Linux x86 2.9.1
MikroTik MIPS 5.x 2.9.1
MikroTik MIPS 6.x 2.9.1
MikroTik PowerPC 5.x 2.9.1
MikroTik PowerPC 6.x 2.9.1
MikroTik x86 5.x 2.9.1
MikroTik x86 6.x 2.9.1
Ubiquiti AirOS 5.5
♣ 2.9.1
Legacy Platforms
Last Available
Version
Tested Untested
MikroTik MIPS 3.x - 2.9
MikroTik MIPS 4.x 2.9 -
MikroTik MIPSEL 3.x
♦
- 2.8.1*
MikroTik MIPSEL 4.x
♦
2.8.1 -
MikroTik PowerPC 3.x - 2.9
MikroTik PowerPC 4.x - 2.9
MikroTik x86 3.x - 2.9
MikroTik x86 4.x 2.9 -
Solaris SPARC 8 2.8.1 -
Solaris SPARC 9 2.8.1 -
Solaris SPARC 10 2.8.1 -
Solaris x86 8 - 2.8.1
Solaris x86 9 V2.8.1 -
Solaris x86 10 V2.8.1 -
Windows 2000 v2.4 -
Windows Server 2003 v2.4 -
Windows XP SP0-SP3 v2.4 -
* (S) Linksys WRT54G flashed with DD-WRT v24sp2 used as surrogate for testing MikroTik MIPSEL binaries. No
actual RouterBoard (i.e. MikroTik) hardware was used.
♦ (U//FOUO) MIPS platforms designated as MIPS are big-endian, whereas those designated as MIPSEL are little-
endian, per more common industry naming conventions.
♣ (S) Hive has only been tested on the Ubiquiti PicoStation M2-HP.
♠ (S) Limited testing of these platforms. ARMv5 models not supported.
NOTE: As of Hive version 2.9, Solaris and MIPS little-endian architectures are no longer supported.
SECRET//NOFORN//20401109 1

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8
…
- 30
- 31