Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71494
Caterpillar ICE Command-Line Parser Notes, Plans, Etc.
Task Description
The ICEIn-memory Code Execution spec outlines the ability to pass command line arguments into the tool being kicked off by ICE. Caterpillar uses a config file burned in at deployment time via Builderpillar.py. The Operators would like the ability to use the command line arguments specified in the Builderpillar documentation to override portions of the burned-in configuration.
Commands That Need to Be Implemented:
- chunksize
- collect
- id
- ip
- kill
- mtu
- max
- port
- rate
- redundancy
- state
New Commands To Be Created:
- uncollect - give the operators the opportunity to remove a GLOB specified in the config from collection
Implementation Plans:
- Get the command line options in the ICEIn-memory Code Execution arguments struct from ICE_Entry() down into the thread running caterpillar_main()
- Parse out the command line arguments from the args->cmdline stuct member
- Need to store the command strings obfuscated in some way to not bake a bunch of exfil-related literals into Caterpillar. User #77807 mentioned "obfustring" earlier.
- patch the burned in config after it is recovered from the resource by get_config_data()
- Allow Caterpillar to execute normally thereafter.