# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Cherry Blossom

# CherryBlossom -- x86 Flytrap - Users Manual

28 February, 2011

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
- 16
- 17

SECRET//20350112
Cherry Bomb Program x86 Flytrap User’s Manual
(U) The user first selects the desired “Mode” – either “Bridge” or “Router”. In bridge
mode, the x86 FT operates as a layer 2 bridge. In router mode, the x86 FT operates as
a layer 3 router.
(U) Bridge mode is more transparent to the wireless client (i.e. the x86 FT uses the
original AP for DHCP), and is easier to configure. The down side is that some AP’s do
not support bridging. In this case, router mode must be used. Bridge mode also does
not support the VPN Proxy action (but does support the VPN Link action).
(U) Router mode is more robust (i.e., does not require bridging support on the original
AP). The down side is that the x86 FT is less transparent to the wireless client (i.e. the
wireless client will be on a subnet that is different than the original AP’s), and requires
more configuration (i.e. DHCP information must be configured).
(U) In bridge mode, the user only has to set the “beacon address” to the desired value.
(S) To beacon through the Milan Point of Presence (PoP), the user enters either
“www.hitmeterlive.com” or “208.178.94.148”. ) To beacon through the New York Point of
Presence (PoP), the user enters either “www.statcounterpro.com” or “208.49.237.148”.
(U) In router mode, the x86 Flytrap must host its own DHCP server (i.e., in bridge mode,
the x86 Flytrap uses the original AP’s DHCP service). As such, the user must also in the
“Repeater Interface” block enter the IP address, netmask, and DHCP range. Suggested
values (shown in the figure above) are:
IP Address = 10.127.254.1
Netmask = 255.255.255.0
DHCP Range = 10.127.254.2 to 10.127.254.254
(U) In router mode, the user may also configure in the “Backhaul Interface” block (i.e.,
the interface used for internet connectivity) an IP address, Netmask, and Nameservers
Typically, this information should be retrieved via DHCP, but the user can if desired set
static information here. In this case, the user must also set the “Address” field in the
“Gateway” block to the IP address of the internet gateway.
SECRET//20350112
13

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
- 16
- 17