Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #14588054
TheIronBank 1.0
('details' missing)
Goals
- Collect all TCPTransport Control Protocol connections, all open TCPTransport Control Protocol ports, all open UDPUser Datagram Protocol ports, the ARPAddress Resolution Protocol table, the DNSDomain Name System cache, and the local routing table at set intervals on a target system.
Background and strategic fit
Why am I doing this? Because someone needed it.
Assumptions
- The keys that the users are going to be giving me are not RSAEncryption algorithm public/private pairs.
Requirements
File Requirements:
| ID | Status | Task |
|---|---|---|
| 1 | incomplete | A control DLLDynamic Link Library in the ICEIn-memory Code Execution format (Fire, Fire & Forget, and Fire & Collect (via ShellTerm)) |
| 2 | incomplete | A control DLLDynamic Link Library in the Winshell reflect load format (see WinShell User's Guide, Appendix F Reflectload DLLDynamic Link Library) |
| 3 | incomplete | A collection DLLDynamic Link Library in the ICEIn-memory Code Execution format (Fire, Fire & Forget, and Fire & Collect (via ShellTerm)) |
| 4 | incomplete | A collection DLLDynamic Link Library in the Winshell reflect load format (see WinShell User's Guide, Appendix F Reflectload DLLDynamic Link Library) |
Configuration Requirements:
| ID | Status | Task |
|---|---|---|
| 5 | incomplete | Able to configure the collection interval in seconds |
| 6 | incomplete | Able to configure the collection file location with capability for environment variables |
| 7 | incomplete | Able to configure the collection file name |
| 8 | incomplete | Tool shall create a receipt file |
| 9 | incomplete | The receipt shall have the configured key in it |
| 10 | incomplete | Provide the operator with the ability to perform key management with no default key. |
| 11 | incomplete | Provide the operator with a way to generate a new key |
| 12 | incomplete | Provide the operator with the ability to use an already generated key (not public/private key pairs) |
Control DLLDynamic Link Library Requirements:
| ID | Status | Task |
|---|---|---|
| 13 | incomplete | Provide the operator with the running status |
| 14 | incomplete | Provide the ability to command the running DLLDynamic Link Library to stop running |
| 15 | incomplete | Provide the ability to command the running DLLDynamic Link Library to write out any cached data |
| 16 | incomplete | Provide the ability for it to located in another process from the control DLL |
| 17 | incomplete | Provide the ability for it to be owned by/under a different user account from the control DLL |
Collection DLLDynamic Link Library Requirements:
| ID | Status | Task |
|---|---|---|
| 18 | incomplete | Shall collect all TCPTransport Control Protocol connections |
| 19 | incomplete | Shall collect all open TCPTransport Control Protocol ports |
| 20 | incomplete | Shall collect all open UDPUser Datagram Protocol ports |
| 21 | incomplete | Shall collect the ARPAddress Resolution Protocol table |
| 22 | incomplete | Shall collect the DNSDomain Name System cache |
| 23 | incomplete | Shall collect the local routing table |
| 24 | incomplete | Shall create a new collection file upon each start (each user login?) |
Post-Processor Requirements:
| ID | Status | Task |
|---|---|---|
| 25 | incomplete | Provide a Python based post-processor that outputs to a file |
| 26 | incomplete | Parse through the unencrypted file and look for unique connections (only if there's no query) |
| 27 | incomplete | Parse through the unencrypted file and combine the ARPAddress Resolution Protocol User #73998 (only if there's no query) |
| 28 | incomplete | Parse through the unencrypted file and combine the routing tables (only if there's no query) |
| 29 | incomplete | Allow for user based queries by destination port (output only the results) |
| 30 | incomplete | Allow for user based queries by destination IP address (output only the results) |
| 31 | incomplete | Allow for user based queries by source IP address (output only the results) |
Target Systems:
| ID | Status | Task |
|---|---|---|
| 32 | incomplete | Win XPWindows operating system (Version) Pro, 32-bit |
| 33 | incomplete | Win 7 Ultimate, 32-bit |
| 34 | incomplete | Win 7 Ultimate, 64-bit |
| 35 | incomplete | Win 8 Pro, 32-bit |
| 36 | incomplete | Win 8 Pro, 64-bit |
| 37 | incomplete | Win 8.1 Pro, 32-bit |
| 38 | incomplete | Win 8.1 Pro, 64-bit |
Questions
Below is a list of questions to be addressed as a result of this requirements document:
- When it says that it shall create a new collection file upon each start, does that mean on each collection or on each log-in for that user?