Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Frog Prince Memory Load Command
Requirement(s)
4.1.17 The implant shall be capable of loading a DLLDynamic Link Library and calling DLLmain on that DLL. The implant shall not unload this DLLDynamic Link Library until command to by the operator.
Preparation
- Write scripts for user interface
- memload command for a DLL
- queue status to verify command was run
- Write a DLLDynamic Link Library that outputs a text file
- writes to known location e.g. c:\testload.txt when loaded
- writes to known location e.g. c:\testunload.txt when unloaded
- writes a known string e.g. "DLL load"
- name DLLDynamic Link Library something easy to identify
- NOTE - a Hello World DLLDynamic Link Library is already in test folder
- Write man-in-middle program to substitute for post-processor program
- MIM copies file received on C2 for use in test
- MIM passes original file to post-processor program
- create alternative .treasuremap for MIM setup
- pre-stage code and .treasuremap on LP
- Write simplistic publish program that simply moves published .gz file to work area
- update LPListening Post snapshot
MemLoad Test(s)
- memload test DLL
- verify text file is output to expected location
- verify text file for unloaded condition is not found i.e. DLLDynamic Link Library remains in memory