Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Reforge
Reforge Language Rough Definition
Variable Types-
- int <variable_name> = <value>
- whole integers only
- name is restricted to A-Z, a-z, 0-9, and may contain an underscore
- str <variable_name> = "<value>"
- value must be quoted
- name is restricted to A-Z, a-z, 0-9, and may contain an underscore
- list <variable_name> = [<value1>, <value2>, ...]
- name is restricted to A-Z, a-z, 0-9, and may contain an underscore
- value list must be comma seperated
- value list must be wrapped in [ ]
- stream <variable_name> = <file_path>
- name is restricted to A-Z, a-z, 0-9, and may contain an underscore
- filepath must be a valid windows filepath
- output will always be compressed and encrypted
- plaintextstream <variable_name> = <file_path>
- name is restricted to A-Z, a-z, 0-9, and may contain an underscore
- filepath must be a valid windows filepath
- output will always be uncompressed and unencrypted
Commands
- delete - securely deletes a file
- del <path_to_file/filename.ext>
- input can be a raw string or variable of type str
- input must be a valid windows filepath
- del <path_to_file/filename.ext>
- pause - pause execution for a specified amount of time
- pause <time_in_seconds>
- input can be a raw number or a variable of type int
- time must be a whole integer and is specified in seconds
- pause <time_in_seconds>
- echo - echo a string out to a stream
- echo <string/int value> <stream>
- string/int value can be a raw string/int or a variable of type string
- stream must be a user defined stream type or a reserved stream type
- echo <string/int value> <stream>
- dirlist - performs a dir walk starting at a specified location
- dirlist <start path> <stream>
- start path must be a valid windows file path
- stream must be a user defined stream type or a reserved stream type
- dirlist <start path> <stream>
- combine - combine a file into an archive
- combine <filepath/archivename> <filepath/filename>
- filepaths must be valid windows filepaths
- the file combined should be secure deleted
- combine <filepath/archivename> <filepath/filename>
- pack - pack another executable into the reforge package and extract it to a specified location on target
- pack <filepath to execuable> <extract location>
- executable path can be a valid linux or windows filepath
- extract location must be a valid windows filepath
- both inputs can be a raw string or a variable
- pack <filepath to execuable> <extract location>
- proclist - get a process list
- proclist <stream>
- stream must be a user defined stream type or a reserved stream type
- proclist <stream>
- netstat - get a netstat
- netstat <stream>
- stream must be a user defined stream type or a reserved stream type
- netstat <stream>
- msgbox - popup a msg box on the target system
- msgbox <type> <title> <msg>
- the title and msg inputs can be a raw string or a variable of type str
- type can be MB_OK
- msgbox <type> <title> <msg>
- registry - set, edit, or delete a registry key
- reg <operation> <key> <type> <value>
- operation can be create, set, or delete
- key can be a raw string or a variable of type string
- type can be REG_BINARY, REG_SZ, REG_DWORD
- value can be a raw string, raw int, or a variable of type int or str
- reg <operation> <key> <type> <value>
- enzip - compress and encrypt a file
- enzip <input file> <output file>
- input/output files must be valid windows file paths
- input/output files can be raw strings or variables of type string
- input can also be a stream which causes the stream to close
- should we allow compress and encrypt of the same file in place?
- enzip <input file> <output file>
- run - run a program or a system command on the command line and wait for its completion
- run <cmd> <stream>
- cmd can be a raw string or a variable of type string
- cmd must contain full path to the executable to run and any args if these things are necessary
- run must wait till the command is finished
- stream must be a user defined stream type or a reserved stream type
- run <cmd> <stream>
- start - run a command or program on the command line but don't wait for its completion
- start <cmd> <stream>
- cmd can be a raw string or a variable of type string
- cmd must contain full path to the executable to run and any args if these things are necessary
- start does not wait till the command is finished
- stream must be a user defined stream type or a reserved stream type
- start <cmd> <stream>
- for - for each loop
-
for <x> in <y> { <cmds> }
- for each <x> item in <y> do the commands in the <cmds> block
- <y> is a list of items or the base of a directory to iterate over
- if <y> is a base dir then it must be a valid windows filepath
- the cmds block can contain any command supported by reforge
-
- while - loop while a condition is true
- while( <condition>) { <cmds> }
- condition must be in the form <x> <operator> <y> where x and y are of the same type
- condition operators can be <,>, <=,>=, or =
- x and y can be raw str/int or variables of type str/int
- the cmds block can contain any command supported by reforge
- condition must be in the form <x> <operator> <y> where x and y are of the same type
- while( <condition>) { <cmds> }
- if / if...else - conditional statement
- if( <condition> ) { <cmds> } else { <cmds> }
- condition must be in the form <x> <operator> <y> where x and y are of the same type
- condition operators can be <,>, <=,>=, or =
- x and y can be raw str/int or variables of type str/int
- the cmds block can contain any command supported by reforge
- the else part of this command is optional
- condition must be in the form <x> <operator> <y> where x and y are of the same type
- if( <condition> ) { <cmds> } else { <cmds> }
- break - break out of a loop
- will stop execution of a for, while, if or else statement and exit the loop/code block
Other
- env - holds global variables/streams
- Reserved streams - used via env.<stream_name>
- stdin
- stdout
- stderr
- Reserved environment variables - used via env.
- temp - holds the base directory path to the windows temp directory
- computername - holds the current name of the computer
- windir - holds the base directory path to the windows path
- systemroot - holds the base directory path to the systemroot
- path - holds the current path values
- Reserved streams - used via env.<stream_name>
- comments
- signified by the # symbol