# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Fulcrum User Manual v0.62

5 December, 2011

- 1
- 2
…
- 19
- 20
- 21
- 22
- 23

UNCLASSIFIED//LES
UNCLASSIFIED//LES Page21
9 KNOWNISSUES
 IfthepivotmachineismovedtoanothernetworkwhileFulcrumisrunning,thepivotmachine
willnotbeabletoconnecttotheinternetorgenerallyusenetworkingservices.Thisisbecause
FulcrumplacesastaticARPentryforthedefaultgatewayinthepivotmachine’sARP
table/neighbor’scachewhentheapplicationstartsup.Thiswillbeaddressedinfutureversions.
Fornow,therecommendedworkaroundisnottodeployFulcrumonmachinesthatarelikelyto
changenetworks,suchaslaptopsandnetbooks.
 MACaddressesmustbespecifiedintheformXX:XX:XX:XX:XX:XXusingcolons,notdashes.Ina
futureversionwewilllikelyaccepteither.
 FulcrumShutdownonlyworksifitisrunasthesameuserwiththesameprivilegesthatFulcrum
wasstartedwith.IfFulcrumisrunningasNTAUTHORITY\SYSTEMforexample,anormaluseror
evenanadministratorcannotshutdownFulcrumusingFulcrumShutdown.Inthecaseof
Fulcrumrunningasthesystemaccount,youcanrunFulcrumShutdownusingSysinternal’s
psexectoolasthesystemaccountusingthe–sflag.Forexample:psexec–sfs32.exe
 WinPcapleaksatwohandleseachtimeFulcrumisrun–oneforaregistryHKEYandoneforthe
packet[nt|2k|vista].dll.EvenifFulcrumisrunthousandsoftimesinthesameprocess,thiswon’t
exhaustthehandleaddressspace.
 IfFulcrumisrunonapivotmachinewhichisactuallyavirtualmachineandthehostmachineis
runningLinuxandVMware,thenanotificationisdisplayedonthehostsystem.Thenotification
isamessageboxthatstates:“Thevirtualmachine’soperatingsystemhasattemptedtoenable
promiscuousmodeonadapterEthernet0.Thisisnotallowedforsecurityreasons.”
 Fulcrumdoesnotmeasureitssuccessorfailurebasedonwaxsuccess.Fulcrumbasesitssuccess
orfailureonwhetherthetargetmachinerequeststheinjectedURL.
 Ifthetargetmachinegoesofflineandthepivotmachinedoesn’tnoticeforanextendedperiod
oftimeORifthetargetmachineisonlinebutnotgeneratinganytrafficforanextendedperiod
oftime,thentheswitchthatthetargetandpivotarebothconnectedtomaybeginsendingout
theARPspoofpacketstoallportsontheswitch.Thisisknownas“failingopen”andisaresultof
thetargetmachine’sMACaddressexpiringoutoftheCAMtableontheswitch.Allother
machinesontheswitchwilldiscardthistrafficunlesstheirinterfaceisinpromiscuousmode.
Eveniftheinterfaceisinpromiscuousmode,someoperatingsystemversionswillnotupdate
theirARPcachefromthesepacketsandthuswillnotbeARPspoofed.Finally,forthose
machinesthatdohavetheirinterfacesinpromiscuousmodeandupdatetheirARPtablefrom
thesebroadcastedunicastARPspoofpackets,Fulcrumwillstillnotfireonanyofthemandwill
simplyroutetheirtrafficontotherealgateway.



- 1
- 2
…
- 19
- 20
- 21
- 22
- 23