Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71475
Deployment Interface
Plans are defined as a list of jobs that After Midnight should execute on a target. A target has a single plan running at a given time. These plans are made available to the target via Core through a beacon to a web server. The am tool generates a deploy directory that is made available through the web server.
Deploy Directory
The deploy directory is generated and modified when the user use the commit or remove functions of the am command.
Structure
/<workspace>/deploy/<target url>/<plan_files>
Where workspace is the workspace the am tool was performing on. <target url> is defined when creating a target configuration in the am command, which can manually be specified, or auto-generated. <plan_files> are a number of files that are automatically generated when the am commit command is run.
Plan Files
A plan consists of a single index file, and a variable number of data blobs that are referred to from the index file.
The Index File
An index file follows the following format. (columns are bit offsets)
| 0x00 | 0x10 | 0x20 | 0x30 | 0x40 | 0x50 | 0x60 | 0x70 | 0x80 | 0x90 | |
|---|---|---|---|---|---|---|---|---|---|---|
| 0x00 | 256-bit LP Key | |||||||||
| 0x100 | 64-bit Uninstall FILETIME | 32-bit DMD* | 32-bit LEN | LEN * 264-bits .... | ||||||
| 0x200 | index_list[LEN] of [ 32-bit ID, 32-bit action, 64-bit hash ] | |||||||||
| ... | ||||||||||
* DMD == Dead Man Delay