# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Athena

# Athena (Developer Kick-Off)

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
…
- 22
- 23

UNCLASSIFIED//FOUO
// END Engine.cpp
// ////////////////////////////////////////////////////////////////////////////
Installer
• Obfuscate function calls
• Use ExpandEnvironmentStrings for all UTF8 encoded string from
configuration
• Create directory if path does not exist – SHCreateDirectoryEx or similar
• Ensure system can uninstall .dll and .dat files by setting ACL for installed files
(e.g. SDDL_NETWORK_SERVICE) – may be able to do this at uninstall time
• Ensure system can uninstall registry keys by setting ACL for registry – may be
able to do this at uninstall time
• SCM – stop/start/query
o Set service to autostart
o Remove SCM trigger on service (ChangeServiceConfig2)
Listening Post (Python)
The server is implemented as a python script running on Centos?? (will also work on
Ubuntu and Windows). The server must support a RESTful interface that can
receive files and transmit files via HTTPS. To create a new interface, it is
recommended to use bottle/cherrypy/pyopenssl for this low side tool.
Bottle – bottlepy.org – provides a simple stackless/WSGI interface for Apache
CherryPy – provides a minimalist python web framework
Pyopenssl – provides ssl support
Configuring Apache
http_proxy
Configuring IIS
Microsoft IIS requires additional support packages to install ARR and UrlRewriter.
Install the following components for the platform you are using.
Install Web Platform Installer
WebPlatformInstaller_3_10_amd64_en-US.msi
WebPlatformInstaller_3_10_x86_en-US.msi
Install Web Farm
WebFarm2_x64.msi
WebFarm2_x86.msi
Install Microsoft`s Application Request Router (ARR)
requestRouter_x64.msi
requestRouter_x86.msi
Install Url Rewriter
rewrite_2.0_rtw_x64.msi
UNCLASSIFIED//FOUO

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
…
- 22
- 23