# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Fulcrum User Manual v0.61

15 November, 2011

- 1
- 2
…
- 19
- 20
- 21
- 22
- 23

UNCLASSIFIED//LES
UNCLASSIFIED//LES Page21
9 KNOWNISSUES
 If the pivot machine is moved to another network while Fulcrum is running, the pivot machine
willnotbeabletoconnecttotheinternetorgenerallyusene tworkingservices.Thisisbecause
FulcrumplacesastaticARPentryforthedefaultgatewayinthepivotmachinesARP
table/neighborscachewhentheappl icationstartsup.Thiswillbeaddress edinfutureversions.
Fornow,therecommendedworkaroundisnottodeployFulcrumonmachinesthatarelikelyto
changenetworks,suchaslaptops andnetbooks.


MACaddressesmustbespecifiedintheformXX:XX:XX:XX:XX:XXusingcolons,notdashes.Ina
futureversionwewilllikelyaccepteither.


FulcrumShutdown only works if it is run as the same user with the same privileges th at Fulcrum
wasstartedwith.IfFulcrumisrunningasNT‐AUTHORITY\SYSTEMforexample,anormaluseror 
evenanadministratorcannotshut downFulcrumusingFulcrumShutdown. Inthecaseof
Fulcrumrunningasthesystemaccount,youcanrunFulcrumShut downusingSysinternals
psexectoolasthesystemaccountusin gth esflag.Forexample:psexecsfs32.exe


WinPcapleaksatwohandleseachtimeFulcrumisrunoneforaregistryHKEYandoneforthe
packet[nt|2k|vista].dll.EvenifFulcrumisrunthousandsoftimesinthesameprocess,thiswont
exhaustthehandleaddressspace.

 IfFulcrumisrunonapivotmachinewhichisactuallyavirtualmachineandthehostmachineis
runningLinuxandVMware,thenanotificationisdisplayedonthehostsystem.Thenotificatio n
isamessageboxthatstates:Thevirtualmachinesoperatingsystemhasattemptedtoenable
promiscuousmodeonadapterEthernet0.Thisisnotallowedforsecurityreasons.
 Fulcrumdoesnotmeasureitssuccessorfailurebasedonwaxsuccess.Fulcrumbasesitssuc cess
orfailureonwhetherthetargetmachinerequeststheinjectedURL.
 Ifthetargetmachinegoesofflineandthepivotmachinedoesntnoticefor anextendedperiod
oftimeORifthetargetmachineisonl inebutnotgeneratinganytrafficforanextendedperiod
oftime,thentheswitchthatthetargetandpivotarebothconnectedtomaybeginsendin gout
theARPspoofpacketstoallportsontheswitch.Thisisknownasfailingopenandisaresul tof
thetargetmachinesMACaddressexpiringoutoftheCAMtableontheswitch.Allother
machinesontheswitchwilldiscardthistrafficunlesstheirinterfaceisinpr omiscuousmode.
Eveniftheinterfaceisinpromiscuousmode,someoperatingsystemversionswillnotupdate
theirARPcachefromthesepacketsandthuswillnotbeARP spoofed.Finally,forthose
machinesthatdohavetheirinterfa cesinpromiscuousmodeandupdatetheirARPtablefrom
thesebroadcastedunicastARPspoo fpackets,Fulcrumwillstillnotfire onanyofthemandwill
simplyroutetheirtrafficontother ealgateway.

- 1
- 2
…
- 19
- 20
- 21
- 22
- 23