# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Fulcrum Mission Manager Brief v0.6

5 July, 2011

- 1
- 2
- 3
- 4
- 5
- 6

UNCLASSIFIED//LES
2 INTRODUCTION
Fulcrumisapro‐activeca pabilitywhichfacilitatestheuseofacontrolledmachinetopivottoanother
uncompromisedtargetmachinethatisonthesameremoteLA N.Theapplicationwillperfo rmaman‐in‐
the‐middleattackonthetargetcomputer.TheapplicationwillthenmonitorthetargetmachinesHTTP
trafficandredirectthetargettotheprovidedURLwhentheproperconditionsaremet.
Tobeclear,Fulcrumisnotisanexploitoraworm.Itwillnotgainarbitrarycod eexecutiononaremote
machinenorwillitperformprivilegeescalationonthepivotmachine.Fulcrumwillnotreplicatei tselfor
automatically target machines on a LAN nor will it work across a router boundary (i.e. broadcast
domain).Simplyput,Fulcrumwill dire ctatargetmachinesHTTPclienttraffictotheURLofthe
attackerschoice.
2.1 TERMINOLOGY
 PivotMachineThemachinewhereFulcrumwillrun.
 Ta rgetMachineThemachinethatFulcrumwilltargetwithitsma n‐in‐th e‐middleandHTTP
trafficinjectioncapabilities.
 DeploymentPreparationMachineThemachinewhereFulcru mispreparedandconfigured
fordeployment.
2.2 ANATOMYOFTHEPIVOT
Therearetwobasiccomponentstothispivotingtechnique:theARPbased man‐in‐the‐middle(MITM)
andTCPsessionhijackforHTTPtrafficinjection.SpeciallycraftedHTTPresponsesaresenttothetarget
inresponsetoHTTPrequestsmadebythetargetbyhijackingtheTCPsession.Theseresponsesdeliver
theoriginallyrequestedcontentaswellasthewax.
2.3 REQUIREMENTSFORASUCCESSFULPIVOT
Thefollowingaretherequirementsforasuccessfulpivot.Someoftherequirementsaredueto
technicallimitationsofthetechniqueingeneral(e.g.bothmachines onlineatthesametime)andsome
arelimitationsofthecurrentimplementation(e.g.English‐onlymachines).
 TheabilitytodeliverFulcrumtothepivotmachine.
 TheabilitytoexecuteFulcrumwithAdministratorprivilegesonthepivotmachine.
 ThepivotmachinemustberunningWindowsXP,Vista,or7.
 ThepivotmachinemustbeusingtheEnglishlocale(i.e.noCyrillicorChinese)
 TheLANmustuseIPv4andEthern et.
 TheMACaddressoftheLANgatewayfo rthenetwork.
 TheMACaddressofthetargetmachine.
 TheURLtodirectthetargetmachineto.
 ThepivotmachinemustbeonthesameLANasthetargetmachine.
UNCLASSIFIED//LES 
Page3

- 1
- 2
- 3
- 4
- 5
- 6