Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #3375506
Caterpillar
Caterpillar Design
Requirements
Refer to Caterpillar v1.0 User Requirements Document (URD) IMIS: 2014-0638 Revision K January 30, 2014.
Use cases
Use Case 0: Operator exfiltrates a file.
Use Case 1: Operator exfiltrates arbitrary bytes of a file.
Use Case 2: Operator exfiltrates a glob.
Use Case 3: Operator resumes an aborted exfiltration.
Public interfaces
Low-side client
WinShell interface
TBD.
ICE interface
TBD.
High-side server
TBD.
Runtime parameters
Low-side client
A resource will convey runtime parameters.
| Name | Type | Description | Default |
|---|---|---|---|
| subject_filename | String | Fully qualified filename with globbing | C:\data.txt |
| caterpillar_chunksize | Integer | Outer Caterpillar subject chunk size (B) | 1045876 (1 MB) |
| exfiltration_rate | Integer | Bits per second | 1045876 (1 Mbps) |
| state_filename | String | Fully qualified filename to persist state | C:\state.txt |
| instance_identifier | Integer | Deconflicts concurrent sessions | 0 |
| begin_index | LongLong | Subject begin offset (modulo filesize, inclusive, B) | 0 |
| end_index | LongLong | Subject end offset (modulo filesize, inclusive, B) | -1 |
| destination_ip | String | Destination IP | 192.168.100.100 |
High-side server
TBD.
Exfiltration algorithm
0. Determine if this is a new mission or resume.
1. If new mission, create an entry in the state file.
2. Open UDPUser Datagram Protocol socket to destination IP.
3. Generate file/task metadata.
4. Prepend file/task metadata to subject file.
5. For each untransmitted chunk in enhanced subject file:
5.0. Generate chunk reassembly metadata.
5.1. Prepend chunk reassembly metadata to chunk.
5.2. Raptor the chunk, receiving one or more buffers in return.
5.3. For each buffer:
5.3.0. Generate packet reassembly data.
5.3.1. Prepend packet reassembly data to buffer.
5.3.2. Generate RTP header.
5.3.3. Prepend RTP header to enhanced buffer.
5.3.4. Send RTP packet via UDPUser Datagram Protocol socket.
5.4. Update entry in state file.
Resume algorithm
0. Search the state file for incomplete entries.
1. For each incomplete entry:
1.0. Run exfiltration algorithm.