Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
The Gibson
Programs
Queue Proxy
The Que Proxy runs on the C2. It takes commands from the Transport and User Interfaces.
Queue
The Queue runs on the LP. It takes commands from the Transport and Beacon (cgi script) Interfaces.
Queue Tar File -
cmd_file [task_files] //cmd_file must be first in tar file, no nested folders
task_files = [task_file] [task_files]
task-file = binary file representing tasks // required for append, prepend, insert
cmd_file = <json_cmds>
json_cmds = command <cmd> queue <que_id> timestamp < time> user <userid> data <data>
// the literals (e.g, command) above are json tags or keys in the python dictionaries
cmd = 1 // create queue
2 // delete queue
3 // update queue
que_id - alphanumeric, at least 5 alphanumeric (fisrt 4 are parent id)
time = numberic time // int(mktime(gmtime())) when command sent
userid = os userid, numeric
data = [change_list]
change_list = < json_changes>
json_changes = cmdseq <seq> respseq <seq> updates <changes>
// the literals (e.g, updates) above are json tags or keys in the python dictionaries
seq = numeric // one-up numbers for que updates cmd from qproxy, resp from queue
changes = change [changes]// a python list of change strings
change = <verb> [to] [from] [filename]
verb = 0 // NOP
1 // insert
2 //append
3 //prepend
4 // move
5 // delete
to = <slot | id>
from = <slot | id>
id - alphanumeric, fails on conversion to number
slot - digits only / numeric