# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Imperial

# SeaPea -- User Guide

- 1
- 2
- 3
- 4

target reformats the disk drive, then the stop ﬁle will be deleted, and Savina will put SeaPea back on the target
computer, which is the desired behavior.
•
-p
‣
Update Install: The installer will remove all existing SeaPea ﬁles, and then write the new ﬁles. The changes will take
effect on reboot. The old version of SeaPea will run until then.
•
-z
‣
No Delete: Disable installer self-delete
Installation Failure Codes
If an install fails, a failure status code is printed to STDOUT in the format ===###=== N, where N is the numeric ID of the status
code. The codes are referenced below.
1.Root access is required for rootkit installation
2.The Mac OS X kernel version was not compatible with SeaPea
3.A version of SeaPea is already installed on this target (do an update install instead)
4. A valid Mac OS X volume was not found. Installation Failed.
5.Update failed due to a non-existent working directory
6.Self-test failure. The rootkit installed, but then detected a functional issue, so it uninstalled itself. The speciﬁc self-test that failed
should have also been printed in the form zz1:X and zz2:Y, where X, Y will indicate to the developer the exact issue.
Uninstall
•
Run the Loader (aka FirewallActiveAgent64) with the -u option.
‣
For example, as root run “/etc/.ptm.log/.pq/FirewallActiveAgent64 -u”. This will delete all associated rootkit ﬁles.
‣
IMPORTANT NOTE: The rootkit will still be running until reboot.
STARTING SEAPEA
The ‘launchd’ process invokes the SeaPea loader (FirewallActiveAgent64) on system boot (via the plist found at /System/Library/
LaunchDaemons/com.apple.ptm.log.plist). The loader performs the following steps:
•
First, the loader checks speciﬁcally for kernel panics that have been caused by the rootkit. If three such kernel panics have
occurred in succession, the loader will uninstall SeaPea.
•
Next, the loader determines the OS / kernel version. If the kernel version is ‘10’, the SnowLeopard-compatible rootkit is loaded. If
the kernel version is ’11’, the Lion-compatible rootkit is loaded. Otherwise, the rootkit uninstalls itself.
•
Last, the loader initiates a self-diagnostic, a cursory test that the core rootkit functionality is working properly. In quick succession,
ﬁle hiding, process hiding, and socket hiding mechanisms are tested. If something is not hidden as expected, the loader will
initiate an uninstall.
•
Note that in the event of an uninstallation after the rootkit has been loaded, the rootkit will persist in memory until the next system
boot.
ROOTKIT PROCESS CATEGORIES
•
The rootkit operates by assigning processes to one of three categories, as described below:
‣
Normal: A normal process is the default category for any process. The activity of a normal process is not hidden by the
rootkit.
‣
Elite: An elite process is hidden from normal processes and elite processes. That means that an elite process cannot
see its own activity.
‣
Super-Elite: A super-elite process is a type of elite process. A super-elite process is hidden from normal processes and
elite processes, but not super-elite processes. This means that a super-elite process can see all activity. Only an elite
process can become super-elite.
•
To change a processes category (either elevate or lower it), a speciﬁc command must be run by the process. The command can
be any utility/function that uses the open system call. For example touch can be used if using a shell script, or the open system
call can be used directly if writing a C program. In some cases, the operator might want the current process to change its
category of “eliteness”, and in other cases the operator might want the parent process to change its “eliteness”. For the current
process use a preceding “.”. For the parent process use a preceding “..”. See the COMMANDS section below for syntax and
example usage.
•
Inheritance: The “eliteness” of a process is inherited by its children
SECRET//NOFORN
Rev 07/08/2011 2

- 1
- 2
- 3
- 4