WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 17
- 18
- 19
- 20
- 21
…
- 30
- 31

SECRET//NOFORN
(U) Hive 2.9.1 User's Guide (U) Deployment
will also kill the connection to an implant after 60 minutes of inactivity. Currently, there is
no notification in the client that a connection has been closed; however, when the next command is
entered the client will report that the command can not be completed.
3.4.2.5 (S) Trigger ID Keys
(S) ID keys are used to control triggering of implants so that only one or one set of implants will
respond to a given trigger. ID keys must be supplied to both the client(s) and server(s)
(implant(s)).It is important to ensure that the keys used on the client are identical to
those used in the implant. In particular, it is possible to start the implant with an ID key on the
command line and attempt to trigger the implant using an ID key file that, while it looks identical,
differs only by a newline character at the end. Some Linux-based text editors (e.g. vim)
automatically add a newline at the end of any line that doesn't include one.
3.5 (S) hiveReset_v1_0.py
(S) Since Hive has been installed and used on such a wide scale, an update capability was provided
for updating the Hive implants on remote boxes. This script requires Python 2.7 with a “pexpect”
module/capability. It is expected that Cutthroat and the Hive ILM also be located in the same
directory as the hiveReset_v1_0.py script. To update a remote box, you must first have the
following information:
Old implant file
name
Name of Hive implant currently running on the remote box.
Installation
directory
full path name that starts and ends with a “/” where the old Hive
implant is currently installed (e.g. /rw/pckg/).
Operating System Mikrotik MIPS BE, Mikrotik PPC, Mikrotik x86 or Linux. (Ubiquiti not
currently supported.)
Full busybox name For Mikrotik routers only. Includes the full path prefix with busybox
name (e.g. /rw/pckg/busybox).
New Hive implant
name
New Hive implant filename that was just created using the
hive-patcher program specified above.
Cutthroat
parameters
Callback IP and port, trigger type, remote IP (box with Hive implant
that will be updated), etc. as specified above.
(S) After the operator has determined all the above parameters and has the necessary files (new
Hive implant, Cutthroat, and Hive (ILM)), the operator may update a box using the following
command:
hiveReset_v1_0.py [-s, -b] -f <Configuration File name>
where the -s option means only a single box will be updated and the -b option refers to a batch
process where multiple boxes are updated. Note that the user may also use a -h option to display a
usage statement. If the configuration file does not exist, just give it a new name and it will be
created after the operator has answered a variety of questions.
(S) This same configuration file, can be used to update multiple Hive implants as long as they have
the same configuration. For example if two boxes with IP addresses of 10.1.2.3 and 10.3.2.1
respectively are running an old Hive implant (same name) in the same installation directory (same
full path name) with the same busybox name “e.g. /rw/pckg/busybox” both boxes could be updated
using the following command:
SECRET//NOFORN//20401109 15

- 1
- 2
…
- 17
- 18
- 19
- 20
- 21
…
- 30
- 31