Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
AngerManagement
Last updated: 6 March 2015
('toc' missing)
How to get the AngerManagement project
Using Quaffle's Hammer (NEW):
- In Stash, go to angermanagement_manifest project and copy the Clone HTTPSHypertext Transfer Protocol Secure on the right hand side.
- ie. https://username@stash.devlan.net/scm/droid/angermanagement_manifest.git
- In your desired directory, repo init -u https://username@stash.devlan.net/scm/droid/angermanagement_manifest.git
- repo sync
Using Mission Control (OLD):
- In Stash, go to remoterage_manifest project and copy the Clone HTTPSHypertext Transfer Protocol Secure on the right hand side.
- ie. https://username@stash.devlan.net/scm/droid/remoterage_manifest.git
- In your desired directory, repo init -u https://username@stash.devlan.net/scm/droid/remoterage_manifest.git
- repo sync
All my bowtie changes are in remoterage_manifest's branch note4. You can check out the note4 branch by going to .repo/manifests and "git checkout -b note4 origin/note4."
Caution: Multiple files/directories with the same name
When looking through the AngerManagement project, please do not be confused with multiple directories of the same name. Understand that refactoring is necessary to be done.
Here is a list of multiple files/directories with the same name and what's their differences:
- remoterage
- In the past, AngerManagement directory might be called remoterage. Within this directory, there might be another directory called remoterage. This remoterage is the remoterage.git. Do not get confused with AngerManagement directory that might use remoterage_manifest.git.
- bowtie
- TODO
- Connector.java
- TODO
- packager.py
- TODO
Components of AngerManagement
AngerManagement is the binary outputted to build the necessary plugins for Mission Control to target a particular Android mobile device. The plugin contains the necessary components (ie. remote exploit, privilege escalation, implant/survey tool, and etc.) to remotely exploit a mobile device. AngerManagement is currently outputted with a name called angerquake, but in the future, it will be renamed to be angermanagement to fit with the naming convention of all the plugins. The reason why the output is called angerquake is because the first plugin incorporated was Dugtrio, and as a Pokemon, Dugtrio's ability is to quake; therefore, it is named angerquake. This output is an executable python zip file.
To build the output of AngerManagement, angerquake, please see the "Build" section under "Angerquake."
To build a Mission Control Server based on AngerManagement, please see the section "How to Build Mission Control Server using AngerManagement."
Angerquake (aq)
Build
make clean
make dist
put it in build and dist directory
Angerquaker
docopt
Plugins
Bowtie
bowtie_ua
dugtrio_bowtie
helios_bowtie
Dugtrio (da)
Helios
Salazar(sa)
Salamander (sm)
Skor (sk)
Spearow (sp)
Starmie (sp)
-------------------------------------------------------------------------------
Mission Control
-------------------------------------------------------------------------------
* timeout
If the connection to Mission Control failed for the first time (due to slow
internet connection and etc), the device has to wait until the timeout
happens before it can reconnect to Mission Control. The default timeout is
set to 180 seconds, approximately 3 minutes.
* target id
If multiple devices have the same target id, whichever device connects to
Mission Control first, the other devices are not allowed to connect to
Mission Control until the timeout occurs.
* session id
If a device has already established a connection with Mission Control and it
talks with Mission Control without a session id, the communication with
Mission Control is terminated. Same vice versa. If it has a session id but
not a target id, communication is also terminated.
-------------------------------------------------------------------------------
Bowtie + Dugtrio
-------------------------------------------------------------------------------
status 2 = beachhead lands, but it doesn't call back to grab the implant
For Dugtrio and Bowtie (because Bowtie uses Dugtrio),
if the user performed the following actions before status 2, then subsequent
actions will NOT continue, and you need to restart the server.
* close the tab
* go to another webpage
* turn off Wi-Fi
* turn off device
* get out of the (browser) application using the center button
If the user performed the following actions before status 2, subsequent
actions will continue.
* device goes to lockscreen
For Bowtie,
if one of the files to collect did not exist, Bowtie will continue
until finish.
Bodybuilder
Bowtie
Deps
DroidMake
Webutils
Downloader
Makedeps
MCPlugins
MissionControl
RRCommon
Rooters
EerieIndiana
Freedroid
HGH
T2
Sporker
Sepol (SE Policy fixes)
How to Add New Plugins
How to Build Mission Control Server using AngerManagement