Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #71494
Caterpillar ICE Command-Line Parser Notes, Plans, Etc.
Customer User Story:
The operator needs the ability to override the burned in destination configuration as well as the instance ID for a built Caterpillar.
High-level design:
Implement a python c2 tool which generates a binary blob which can contain a new instance ID and an arbitrary number of destinations. These destinations will override all destinations burned into the configuration. This will be base64 encoded to be added as a command line argument to the invocation of Caterpillar via ICE. Caterpillar will override the ID and destinations with the data in the passed blob.
Assumptions and Caveats:
- Users are willing to accept a new tool separate from Builderpillar for the generation of command-line re-configurations.
- The channel used to communicate the re-configuration to Caterpillar is secure, and thus the new configs will not be encrypted or encoded beyond base64ing the blob.
- Users will only be able to add destinations up to the 1040 character limit in the ICEIn-memory Code Execution command line spec.
- No other parameters are available for re-configuration outside of the destinations and instance ID.
- Re-configurations are not persistent and only effect the instance of Caterpillar run with the command line data.
Implementation:
| Step | Complete |
|---|---|
| Implement base64 encoding and decoding in Caterpillar | |
| Add new re-configuration structure | |
| Add functions to override the instance id to the Caterpillar config object | |
Add functions to replace the destinations with a new set of destinations |
|
| Parse the command line at the entry point and take action after the original config is loaded | |
| Write c2 tool to generate and encode re-config blobs | |
| Add new c2 tool to Caterpillar build processes. | |
| Unit tests |