Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
The Seven Seas Transport
Description
The seven seas trannsport (7Seas) is a transport for Galleon testing. Systems meeting the Galleon interface specification can use 7Seas as a transport for testing. It can modify files to create transport errors as a means to test system fault handling.
7Seas Components
This is some mid level detail about the programs, files, folders, and overall runtime structure. Once installed, only seasick is normally used directly. Your Galleon system will interact only with ship.py.
The seasick, setsail, and ship.py usage is described in following sections.
PROG is base program folder - defaults to /work
BASE is the base data folder - defaults to /work
DEST is a destination
SRC is a source
| Component | Type | Description | Location |
|---|---|---|---|
| install.sh | bash script | currently not executable, mostly notes on how to install and configure 7Seas | PROG |
| ship.sh | bash script |
implements Galleon transport interface for sending files. This is the program your system calls. |
PROG |
| 7seas | service script | starts, stops, transport monitor dockwork | /etc/init.d |
| SevenSeas | package | contains ahoythere.py and sail7seas.py | PROG |
| ahoythere.py | python script | Main monitoring program for .docks It uses pyinotify. It is imported by 7seas.py | PROG/SevenSeas |
| sail7seas.py | pyhton script | Main program for modifying, and transporting files. It is imported by 7seas.py |
PROG/SevenSeas |
| 7seas.py | python script |
Package level program for invoking sail7seas.py It is the target for soft links dockwork, atsea, seasick, and setsail |
PROG defaults to '/work' |
| atsea | soft link | called from setsail this invokes scp to transport the (modified) file | PROG |
| seasick | soft link |
Configuration of transport at the destination and/or destination/source level file modification settings. Also keeps scp compatible destination addresses. |
PROG |
| dockwork | soft link | Invoked by 7seas service, monitors files under DEST/.docks | PROG |
| setsail | soft link |
Invoked by dockwork, applies file modifications and coordinates transport of file. Invokes atsea to send file via scp |
|
| thirdparty | python package | cross process locking support | PROG |
| .docks | folder |
base folder monitored for write/close, delete, and move along with all its children destinations are subfolders, sources subfolders under destination folders |
BASE |
| .onboard | folder | work folder where dockwork transfers files before invoking setsail | BASE |
| DEST | folder | folder matching a Galleon destination label | BASE/.doc,s |
| SRC | folder | folder matching a Galleon source label | BASE/.docks/DEST |
| .treasuremap | text file |
one line text file. Required in destination folder or source folder or both. The format is a template for calling a subprocess whenever a file is moved or copied into a monitored folder - see installation for details |
BASE/.docks/DEST/SRC or BASE/.docks/DEST |
Seven Seas Programs
ship.sh
This is the program implementing the Galleon Send Interface. The interface specifies the last three parameters. The dock_path is the base directory where the .docks monitored folder tree was placed during installation. The program returns 1 if there are fewer than 3 parameters or if either/both of the source and destinations are not configured.
Usage
usage: ./ship.sh [dock_path] <source> <destination> <filepath>
Transports file to destination, with return address as source
Arguments:
dock_path path assigned to folder used for .docks folder tree
defaults to '/work'
destination Galleon destination label
source Galleon source label
seasick
This is the configuration program for the Seven Seas. The only required parameters to set (using config) is the destination address in scp format.
Usage
usage: seasick [-h] COMMAND ...
Seven Seas Transport Configuration
optional arguments:
-h, --help show this help message and exit
Commands:
COMMAND transport modification to make
config configure settings for destination or destination/source
list list settings for destination or destination/source
reset reset settings for destination or destination/source
delete delete destination or destination/source
Usage for config command
usage: seasick config [-h] [--delay DELAY] [--extradelay EXTRA] [--dup DUP]
[--drop DROP] [--corrupt CORRUPT] [--truncate TRUNCATE]
[--order OOO] [--address DEST_IP]
destination [source]
positional arguments:
destination destination
source source
optional arguments:
-h, --help show this help message and exit
--delay DELAY minimum number of seconds to delay (0 - 3,600)
--extradelay EXTRA average extra number of seconds to delay (0 - 1,800)
--dup DUP 'once' or num of transfers (of 1000) to dup
--drop DROP 'once' or num of transfers (of 1000) to drop
--corrupt CORRUPT 'once' or num of transfers (of 1000) to corrupt
--truncate TRUNCATE 'once' or num of transfers (of 1000) to truncate
--order OOO once' or number of out-of-order transfers (of 1000)
--address DEST_IP ip address or hostname of destination
Notes
config
Configuration must be done on each system, changes made to files are done on the sending side
Creates destination or destination/source if they do not exist, updates if they do. Be sure to check your spelling.
Destination and settings must be acceptable Linux folder names. The strings $SRC $DEST and $FILE are reserved, as is the character #
Any source level setting (e.g. dup) overrides any destination level setting
Settings are 0 - 1000, as in baseball hitting stats The represent the chance of each particular malady being applied
Maladies are cumulative, and applied in this precedence (x,x,x,)
Once (if) malady settings add up to 1000, one will be applied 100% of the time. Any malady after that point will never be applied. This is not error checked or reported.
drop deletes a file without sending it