# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Imperial

# SeaPea -- User Guide

- 1
- 2
- 3
- 4

•
touch ..kjwefk/hfs99_open
•
Explanation: Since ‘touch’ is the executing process, we use a leading ‘..’ to ensure that the parent process (bash) and not the
current process (‘touch’) is elevated to elite status.
•
Hide any ﬁle or directory with the name asdfg
•
touch ..ijrwifowfe/asdfg.sparseimg_open
•
Make all instances of the process usbmond elite as soon as they launch
•
touch ..wwllksf/usbmond.machport_lock
LIMITATIONS / ISSUES
•
The kernel implant is not loaded on single user mode. Therefore, in single user mode ﬁles/directories, ports, and processes are
not hidden.
•
If a user were to mount the ﬁle system using a different OS, the rootkit will not hide associated ﬁles/directories
SECRET//NOFORN
Rev 07/08/2011 4

- 1
- 2
- 3
- 4