Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #3375130
User #3375130's Home
You may edit this page to include additional information about yourself.
E-mail: XXXXX@devlan.net
Hive Client Debugging Commands (Make sure iptables is not blocking any ports and target is listening on port specified for raw-tcp and raw-udp triggers...):
Client: gdb --args ./hclient-linux-x86-dbg ./coreClient -a 10.3.2.188 -t 10.3.2.188 -P raw-tcp -r 22 -k TestingTesting -p 4001 -m b
Hived: gdb --args ./hived-linux-x86-dbg ./coreHived -t 0 -a 10.2.5.191 -i 600 -d 10 -k TestingTesting
Linux/Unix Topics
info (Use "info info" command)
udev (Implementation may vary between distributions)
CentOs/Redhat
Rules for writing udev assignment rules: index.html
Configuration file = /etc/udev/udev.conf
Other directories = /usr/lib/udev, /dev/.udev, /etc/udev/rules.
MRR Notes:
Even after you modify the rules in /etc/udev/rules.d, these changes seem to have no effect until the system is rebooted.
- Command "udevadm monitor" is very useful for determining which device is being added/removed from the system.
Roundabout (RAB)
Creating a 32 bit virtual machine to compile and run RAB:
- Downloaded CentOS-6.2 32_bit version of LiveCD
- Created ssh keys using "ssh-keygen -t rsa" command for User #72220.
- Created "/etc/yum.repos.d/devlan.repo" file to pull from our repository.
- Added some package installs:
- yum install gcc gcc-c++
- yum install make
- yum install openssh-server
- yum install git-all
- Got RAB repository:
- Set ssh keys.
- mkdir code
- cd code
- git clone ssh://git@stash.devlan.net:7999/rab/roundabout.git
- Changed display to 1920x1200 resolution.
- Created /home/User #72220/RAB_External_sources folder to store additional packages required for new virtual machine.
Install Java 1.7.0
- yum install java-1.7.0-openjdk-devel
- Downloaded Java Unlimited Encryption Policy "UnlimitedJCEPolicyJDK7.zip" file to "/home/User #72220/RAB_External_sources" folder.
- cd /home/User #72220/RAB_External_sources
- unzip UnlimitedJCEPolicyJDK7.zip
- cd UnlimitedJCEPolicy
- Verified it contained to files "local_policy.jar" and "US_export_policy.jar" and one "README.txt" file
- Replace "local_policy.jar" and "US_export_policy.jar" in /usr/lib/jvm/jre/lib/security folder with the new ones downloaded in previous step.
- cd /usr/lib/jvm/jre/lib/security
- mkdir original_Limited_Encryption
- cp ./*.jar ./original_Limited_Encryption
- cp /home/User #72220/RAB_External_sources/UnlimitedJCEPolicy/*.jar .
- Verified RAB 1.4.2 Java app runs in this CentOS 6.2 32-bit machine
- Copied "Amber_v1.4.2_RC01_lib" folder and "Amber_v1.4.2_RC01.jar" file to /home/User #72220/Desktop directory.
- cd /home/User #72220 Desktop
- java -jar ./Amber_v1.4.2_RC01.jar
- Click on the Roundabout Java Window that pops up and select the "Task->Encryption Check" menu option.
-
Verify that a Dialog box reading "Unlimited encryption is available" with an "OK" radio button. If it does, you have a Java build that may be used to process RAB tasking and collected results files.
Anything else and an error has occurred.
Install Google's protocol buffers
- Copied "protobuf-2.6.1.tar.gz" to the "/home/User #72220/RAB_External_sources" folder.
- cd /home/User #72220/RAB_External_sources
- tar -xvzf protobuf-2.6.1.tar.gz
- cd protobuf-2.6.1
- ./configure
- make
- make check (Verified no failures).
- make install
Install eclipse packages
- Copied the "eclipse-cpp-mars-R-linux-gtk.tar.gz" and "eclipse-java-mars-R-linux-gtk.tar.gz" files to the "/home/User #72220/RAB_External_sources" folder
- cd /home/User #72220/RAB_External_sources
- tar -xvzf eclipse-cpp-mars-R-linux-gtk.tar.gz
- cd eclipse