Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71494
Caterpillar ICE Command-Line Parser Notes, Plans, Etc.
Task Description
The ICEIn-memory Code Execution spec outlines the ability to pass command line arguments into the tool being kicked off by ICE. Caterpillar uses a config file burned in at deployment time via Builderpillar.py. The Operators would like the ability to use the command line arguments specified in the Builderpillar documentation to override portions of the burned-in configuration.
Specific conditions and constraints
- Persistence of config edits is not necessary.
- I can expect there to be a command line arguments whenever edits need to be made.
- Operators should be able to modify everything, except the baked-in RC4 key.
Commands That Need to Be Implemented:
- id <number>
- chunksize <number>
- kill file
- state file
- completion file
- mtu <packet_size>
- redundancy <percentage>
- rate <rate>
- max <bytes>
- add destination <address>,<port>,<type>
- remove destination <address>,<port>,<type>
- add collection target <filename>, <start index>,<end index>
- remove collection target <filename>,<start index>,<end index>
Implementation Plans:
Legend: To do, In Work, Complete
- Get the command line options in the ICEIn-memory Code Execution arguments struct from ICE_Entry() down into the thread running caterpillar_main()
- Add 11 new methods to CatepillarConfig and 3 to TransmitterRTPConfig which will allow a command line parser to directly operate on the burned in config after it has been loaded from the buffer produced by Builderpillar. Other modifications will be required in deeper-in objects to pass the updates along to them as well.
-
Create a parser which calls the appropriate update functions in the read-in config object. This will also have the joy of validating the user input.
-
Add tests for the 14 new methods.
- Validate the re-configured config and allow Caterpillar to proceed on it's way.
- Build, run, test, fix bugs
Decision Points (for team input):
- Do I parse the input string and validate the user input directly in Caterpillar or do I write a small command line tool in Python to be run off target to generate the command line string for Caterpillar?
- Pros of on target:
- One stop shopping
- User simplicity
- More agile for repeated runs
- Cons
- Increased size of parsing and validating user input.
- Not many ways to provide constructive feedback on commands via ICEIn-memory Code Execution when a command is malformed
- possible introduction of signatures since I have to match on command parameters and there will need to be an artifact to match against, be that the string itself, an obfuscated version, or a one way hash.
- Pros of off target:
- Fewer signatures in Caterpillar. I can build an obfuscated command line string or even encode it with that deployment's RC4 key and then output the base 64 encoding of that to cut and paste on target ( or clumsily fat finger more likely... )
- Helpful feedback for the user.
- Cons:
- More of a pain to use for the operator. If they were trying to iterate quickly between configurations on-target it would require going back and forth between the command line generator and the target.
- More of a pain to use for the operator. If they were trying to iterate quickly between configurations on-target it would require going back and forth between the command line generator and the target.
- Pros of on target: