Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
AngerManagement
('toc' missing)
Components of AngerManagement
AngerManagement is the binary outputted to build the necessary plugins for Mission Control to target a particular Android mobile device. The plugin contains the necessary components (ie. remote exploit, privilege escalation, implant/survey tool, and etc.) to remotely exploit a mobile device. AngerManagement is currently outputted with a name called angerquake, but in the future, it will be renamed to be angermanagement to fit with the naming convention of all the plugins. The reason why the output is called angerquake is because the first plugin incorporated was Dugtrio, and as a Pokemon, Dugtrio's ability is to quake; therefore, it is named angerquake. This output is an executable python zip file.
To build the output of AngerManagement, angerquake, please see the "Build" section under "Angerquake."
To build a Mission Control Server based on AngerManagement, please see the section "How to Build Mission Control Server using AngerManagement."
Angerquake
Build
make clean
make dist
put it in build and dist directory
Angerquaker
docopt
Plugins
Bowtie
bowtie_ua
dugtrio_bowtie
helios_bowtie
Dugtrio (da)
Helios
Salazar(sa)
Salamander (sm)
Skor (sk)
Spearow (sp)
Starmie (sp)
-------------------------------------------------------------------------------
Mission Control
-------------------------------------------------------------------------------
* timeout
If the connection to Mission Control failed for the first time (due to slow
internet connection and etc), the device has to wait until the timeout
happens before it can reconnect to Mission Control. The default timeout is
set to 180 seconds, approximately 3 minutes.
* target id
If multiple devices have the same target id, whichever device connects to
Mission Control first, the other devices are not allowed to connect to
Mission Control until the timeout occurs.
* session id
If a device has already established a connection with Mission Control and it
talks with Mission Control without a session id, the communication with
Mission Control is terminated. Same vice versa. If it has a session id but
not a target id, communication is also terminated.
-------------------------------------------------------------------------------
Bowtie + Dugtrio
-------------------------------------------------------------------------------
status 2 = beachhead lands, but it doesn't call back to grab the implant
For Dugtrio and Bowtie (because Bowtie uses Dugtrio),
if the user performed the following actions before status 2, then subsequent
actions will NOT continue, and you need to restart the server.
* close the tab
* go to another webpage
* turn off Wi-Fi
* turn off device
* get out of the (browser) application using the center button
If the user performed the following actions before status 2, subsequent
actions will continue.
* device goes to lockscreen
For Bowtie,
if one of the files to collect did not exist, Bowtie will continue
until finish.
Bodybuilder
How to Build Mission Control Server using AngerManagement