# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Hive Infrastructure Installation and Configuration Guide

11 November, 2012

- 1
- 2
…
- 16
- 17
- 18

SECRET//NOFORN
(U) Test and Troubleshooting Hive Infrastructure Configuration Guide
6 (U) Test and Troubleshooting
(S//NF) After completing the previous sections, redirection should be established through the Blot proxy
to the cover server and tool handler. Attempting to access the public IP website with a web browser
should produce a valid web page from the cover server. Verifying this implies that any HTTP-based
beacon should reach the tool handler, barring any misconfiguration of the Blot proxy.
6.1 Unresponsive Cover Server
(S//NF) If a cover web page does not appear in this testing, here are some things to check.
• (S//NF) Use ifconfig on the VPS redirector and the Blot proxy to verify that a tunnel interface
(e.g. tun0) is present. If not, then openvpn is not operational. Recheck the configuration and
restart openvpn using the command: service openvpn restart. Look for problems in
the openvpn log file /var/log/openvpn.log.
• (S//NF) On the VPS redirector, verify that the iptables redirection script was executed by issuing
the command:
service redirection status
or
watch service redirection status
(S//NF) This will display the current firewall rules. By reissuing this command and comparing
the packet/byte counts displayed (or using the watch command to see it updated continually), it is
possible to get an idea of the packet flows when a web page is requested. The PREROUTING
chain in the nat table should increase for each web page requested, along with the related rules in
the FORWARD chain of the filter table.
• (S//NF) If there seems to be problems in establishing the tunnel between the VPS redirector and
the Blot proxy, verify the communications between them. Check the routing. While the default
route will likely be to the public-facing gateway, there must also be a route to get to the Blot
proxy.
6.2 Lost Beacons
(S//NF) If an implant beacon fails to arrive at the tool-handler, first follow the steps above in
section 6.1 to verify that the path to the Blot proxy is functional. If it is, then the problem is most
likely the Blot proxy configuration. Verify the parameters in /etc/blot/beastbox.cfg and the ITD
configuration file(s) in /etc/blot/itds. The port number(s) in the itd file files must match those
configured in the beastbox.cfg file.
12 SECRET//NOFORN//20371105 November 2012

- 1
- 2
…
- 16
- 17
- 18