# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# NightSkies v1.2 - User Guide

1 December, 2008

- 1
- 2
…
- 13
- 14
- 15
- 16

SECRET//20330530
PTYPE_PUT PSUB_FILENAME <destination name> Specifies destination of
a file to upload to
target. Must be
followed by
PSUB_FILE
PTYPE_PUT PSUB_FILE <src file on localhost> specifies local file to
upload.
PTYPE_PUT PSUB_CONFIG <config key>=<config
value>
Modify a configuration
value. If configuration
value is invalid, this will
force the implant to
remove itself.
PTYPE_CMD PSUB_EXECFILENAME <command to execute> Executes a command
on the host
Example usage:
• To download a file
• Use PTYPE_GET and PSUB_FILENAME to retrieve a file from target.
• To upload a file:
• Use PTYPE_PUT and PSUB_FILENAME with data set to the full path of the
destination
• Use PTYPE_PUT and PSUB_FILE with data set to the source file on the local host.
• To upgrade NightSkies:
• Use the above commands to upload a new binary
• Use the PTYPE_CMD and PSUB_EXECFILENAME to execute a “killall phoned”.
This will stop the current running process. Once stopped, the persistence mechanism
will relaunch the new binary code.
Refer to sample_config.xml and sample_upgrade.xml for more examples.
(S) iPhone File Reference
Location Filename Function
/var/mobile/Library
/Address Book AddressBook.sqlitedb Address Book entry database
AddressBookImages.sqlitedb Contact image database
/Calendar Calendar.sqlitedb Calendar entry database
/Call History call_history.db Call history database
/Installer LocalPackages.plist Lists already installed
applications
/Keyboard Dynamic_text.dat User-specific, learned portion of
keyboard application
/Mail Accounts.plist Mail account settings
Envelope\ Index Indexes mail
/SMS sms.db SMS message database
/Safari Bookmarks.plist Bookmark properties
SECRET//20330530
12

- 1
- 2
…
- 13
- 14
- 15
- 16