WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Hive Beacon Infrastructure

- 1
- 2
…
- 12
- 13
- 14
- 15
- 16

14
Hive Beacon Test Infrastructure
SECRET//NOFORN
SECRET//NOFORN
VPS Server
IPTABLES Forwarding
10.3.2.174
10.3.2.185
172.16.63.101
172.16.63.1
172.16.63.131
VPS Server IPTABLES Configuration
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -p OUTPUT DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
DNAT
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 1024:65535 -d 10.3.2.174 --dport 53 -j DNAT --to-destination 172.16.63.101:443
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 1024:65535 -d 10.3.2.174 --dport 80 -j DNAT --to-destination 172.16.63.101:443
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 1024:65535 -d 10.3.2.174 --dport 443 -j DNAT --to-destination 172.16.63.101:443
FORWARDING
iptables -A FORWARD -i eth0 -o p3p2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i p3p2 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o p3p2 -p tcp --sport 1024:65535 -d 172.16.63.101 --dport 53 -m state --state NEW -j ACCEPT
iptables -A FORWARD -i eth0 -o p3p2 -p tcp --sport 1024:65535 -d 172.16.63.101 --dport 80 -m state --state NEW -j ACCEPT
iptables -A FORWARD -i eth0 -o p3p2 -p tcp --sport 1024:65535 -d 172.16.63.101 --dport 443 -m state --state NEW -j ACCEPT
SNAT
iptables -t nat -A POSTROUTING -o p3p2 -j MASQUERADE
eth0
p3p2
Target domain: vhost1.edb.devlan.net
Target domain: vhost2.edb.devlan.net
Implanted
Host
Implanted
Host
Honeycomb
Tool Handler
10.3.2.125
Blot Proxy
with:
VPN Server
Apache Server
10.2.4.119
Cover
Server
172.16.64.10
172.16.64.1
10.3.2.113

- 1
- 2
…
- 12
- 13
- 14
- 15
- 16