WikiLeaks - Revision history

TTopal at 00:19, 18 December 2024

2024-12-18T00:19:00Z

← Older revision		Revision as of 00:19, 18 December 2024
Line 165:		Line 165:
	The malicious thumbdrive is then delivered to an air-gapped target computer, relying on human interaction to plug it in.<br><br>		The malicious thumbdrive is then delivered to an air-gapped target computer, relying on human interaction to plug it in.<br><br>
	Interface of the Brutal Kangaroo tool:<br><br>		Interface of the Brutal Kangaroo tool:<br><br>
	[[File:Brutal_Kangaroo_Interface.png\|border\|500px\|Brutal Kangaroo Configuration Interface~~<ref name="BKRef">[https://wikileaks.org/vault7/document/Brutal_Kangaroo-DriftingDeadline-V1_2-User_Guide.pdf Brutal Kangaroo-Drifting Deadline V1.2 User Guide]</ref>~~]]<br><br>		[[File:Brutal_Kangaroo_Interface.png\|border\|500px\|Brutal Kangaroo Configuration Interface]]<br><br>

	* '''Execution''' - Once connected to the air-gapped computer:		* '''Execution''' - Once connected to the air-gapped computer:

TTopal at 00:17, 18 December 2024

2024-12-18T00:17:21Z

← Older revision		Revision as of 00:17, 18 December 2024
Line 165:		Line 165:
	The malicious thumbdrive is then delivered to an air-gapped target computer, relying on human interaction to plug it in.<br><br>		The malicious thumbdrive is then delivered to an air-gapped target computer, relying on human interaction to plug it in.<br><br>
	Interface of the Brutal Kangaroo tool:<br><br>		Interface of the Brutal Kangaroo tool:<br><br>
	[[File:Brutal_Kangaroo_Interface.png\|border\|500px\|Brutal Kangaroo Configuration Interface]]<br><br>		[[File:Brutal_Kangaroo_Interface.png\|border\|500px\|Brutal Kangaroo Configuration Interface<ref name="BKRef">[https://wikileaks.org/vault7/document/Brutal_Kangaroo-DriftingDeadline-V1_2-User_Guide.pdf Brutal Kangaroo-Drifting Deadline V1.2 User Guide]</ref>]]<br><br>

	* '''Execution''' - Once connected to the air-gapped computer:		* '''Execution''' - Once connected to the air-gapped computer:

TTopal at 00:15, 18 December 2024

2024-12-18T00:15:01Z

@@ Line 154: / Line 154: @@
 * '''Setup''' - The first step is to flash the adapter. This is done by booting an ISO file that is saved on a peripheral device and plugging it in combination with the thunderbolt-to-ethernet adapter into a Mac device. This will boot a FreeDos Operating System. There the command "B57UDIAG.exe -ppe x:\ss.rom" needs to be executed and the adapter is flashed. This adapter will look for a specific file path to execute from a USB or CD/DVD-Drive. This file path is "/EFI/BOOT/BOOTX64.efi". This filepath needs to be configured onto the before mentioned USB or CD/DVD-Drive.
 * '''Execution''' - Now the thundebolt-to-ethernet adapter and the USB or the CD/DVD-Drive need to be connected to the target Mac device before it boots up. After the requirements are met, the adapter will automatically execute the BOOT64.efi file while the Mac computer boots up.
 === Weeping Angel ===

TTopal at 00:00, 18 December 2024

2024-12-18T00:00:58Z

← Older revision		Revision as of 00:00, 18 December 2024
Line 204:		Line 204:
	* https://coed.com/2017/03/08/weeping-angel-cia-hack-protection-guide-how-to-prevent-protect-samsung-tv-info/		* https://coed.com/2017/03/08/weeping-angel-cia-hack-protection-guide-how-to-prevent-protect-samsung-tv-info/
	* https://www.nytimes.com/2022/07/13/nyregion/cia-engineer-joshua-schulte-theft-convicted.html		* https://www.nytimes.com/2022/07/13/nyregion/cia-engineer-joshua-schulte-theft-convicted.html
			* https://wikileaks.org/vault7/document/Brutal_Kangaroo-DriftingDeadline-V1_2-User_Guide/Brutal_Kangaroo-DriftingDeadline-V1_2-User_Guide.pdf
	* https://wikileaks.org/ciav7p1/		* https://wikileaks.org/ciav7p1/

SDejkoski: /* CouchPotato */

2024-01-03T18:43:39Z

CouchPotato

← Older revision		Revision as of 18:43, 3 January 2024
Line 183:		Line 183:
	* '''Execution''' <br> '''Capturing Image Frames of Significant Change'''<br>When used to record picture frames with significant changes, the CouchPotato handler is invoked with the -f image2 parameter, which directs the output to stdout. The taken photographs are systematically saved in the chosen directory, with each file labeled with a timestamp in GMT, mirroring the local machine’s time facilities. <ref name=”RE2”/><br> '''Capturing Video (Without Audio)'''<br>The handler is started with the -vcodec copy -an -f avi parameters for video capture without audio. The resulting video file is immediately written to the specified directory, with a filename that includes the precise time in GMT. <ref name=”RE2”/><br>'''Capturing Video (With Audio)'''<br>To capture video with audio, launch the CouchPotato handler with the -vcodec copy -acodec copy -f avi parameters. The resulting video file is then saved in the chosen directory, with a filename that includes the precise time in GMT. It’s important to realize that this approach generates more network traffic than collecting video without audio. <ref name=”RE2”/>		* '''Execution''' <br> '''Capturing Image Frames of Significant Change'''<br>When used to record picture frames with significant changes, the CouchPotato handler is invoked with the -f image2 parameter, which directs the output to stdout. The taken photographs are systematically saved in the chosen directory, with each file labeled with a timestamp in GMT, mirroring the local machine’s time facilities. <ref name=”RE2”/><br> '''Capturing Video (Without Audio)'''<br>The handler is started with the -vcodec copy -an -f avi parameters for video capture without audio. The resulting video file is immediately written to the specified directory, with a filename that includes the precise time in GMT. <ref name=”RE2”/><br>'''Capturing Video (With Audio)'''<br>To capture video with audio, launch the CouchPotato handler with the -vcodec copy -acodec copy -f avi parameters. The resulting video file is then saved in the chosen directory, with a filename that includes the precise time in GMT. It’s important to realize that this approach generates more network traffic than collecting video without audio. <ref name=”RE2”/>

	* '''Known Issues''' - ~~On some versions~~, ~~Xshell will let~~ the ~~user use a private key file that has~~ not ~~been imported into Xshell's key manager~~. ~~In this case~~, ~~BothanSpy will not be able to get the private key file name~~. <ref name=”RE2”/>		* '''Known Issues''' - Notably, CPU consumption fluctuated between 50 and 70% during picture capture on a single-core Windows 7 64-bit VM. Premature termination of the cp handler.py script is not recommended since it may cause instability in the C2 Loader. Furthermore, possible difficulties with early termination identified in Shell- Term 2.9.1 are effectively resolved in ShellTerm 2.9.2. <ref name=”RE2”/>

	== Security ==		== Security ==

SDejkoski: /* CouchPotato */

2024-01-03T18:41:37Z

CouchPotato

← Older revision		Revision as of 18:41, 3 January 2024
Line 179:		Line 179:
	The tool was leaked on 10th August, 2017. CouchPotato is a remote tool in the CIA’s hacking toolkit that specializes in gathering data from RTSP/H.264 video streams discreetly. Its critical significance is in the extraction of both video files (AVI) and still photos (JPG), recording frames that differ significantly from previously recorded frames. CouchPotato rigorously cuts extra functions and codecs from the bundled ffmpeg version, focusing on a small Dynamic Link Library (DLL) build. Its operational integrity is dependent on being launched from an intrusion Countermeasures Electronics (ICE v3) Fire and Collect-compatible loader. <ref name=”RE2”> WikiLeaks, “WikiLeaks - CouchPotato v1.0 – User Guide”. https://wikileaks.org/vault7/document/Couch_Potato-1_0-User_Guide/, 2017 </ref>		The tool was leaked on 10th August, 2017. CouchPotato is a remote tool in the CIA’s hacking toolkit that specializes in gathering data from RTSP/H.264 video streams discreetly. Its critical significance is in the extraction of both video files (AVI) and still photos (JPG), recording frames that differ significantly from previously recorded frames. CouchPotato rigorously cuts extra functions and codecs from the bundled ffmpeg version, focusing on a small Dynamic Link Library (DLL) build. Its operational integrity is dependent on being launched from an intrusion Countermeasures Electronics (ICE v3) Fire and Collect-compatible loader. <ref name=”RE2”> WikiLeaks, “WikiLeaks - CouchPotato v1.0 – User Guide”. https://wikileaks.org/vault7/document/Couch_Potato-1_0-User_Guide/, 2017 </ref>

	* '''Setup''' - To properly launch CouchPotato, the handler, as implemented by the cp handler.py script, must be run on the same host as the C2 loader. Using the -o option, the path or directory, where the files gathered by CouchPotato will be saved, must be specified during this initiation. It is vital to use caution and avoid running CouchPotato during important operations, as unexpected exits may occur, potentially causing interruptions. <ref name=”RE2”/>		* '''Setup''' - To properly launch CouchPotato, the handler, as implemented by the cp handler.py script, must be run on the same host as the C2 loader. Using the -o option, the path or directory, where the files gathered by CouchPotato will be saved, must be specified during this initiation. It is vital to use caution and avoid running CouchPotato during important operations, as unexpected exits may occur, potentially causing interruptions. <ref name=”RE2”/><br>The Tool requires particular information for functioning, such as the video source (RTSP URL), instructions on how to handle video and audio (codecs), and defining the desired file format for output. Aside from these necessities, one needs the ability to fine-tune additional variables, such as the amount of information in the logs, defining when the data collecting should begin (start time offset), and determining the process length. In addition, the –pHash-threshold option allows you to establish a threshold for spotting significant changes in the photos captured by CouchPotato. <ref name=”RE2”/>
	The Tool requires particular information for functioning, such as the video source (RTSP URL), instructions on how to handle video and audio (codecs), and defining the desired file format for output. Aside from these necessities, one needs the ability to fine-tune additional variables, such as the amount of information in the logs, defining when the data collecting should begin (start time offset), and determining the process length. In addition, the –pHash-threshold option allows you to establish a threshold for spotting significant changes in the photos captured by CouchPotato. <ref name=”RE2”/>

	* '''Execution''' - Capturing Image Frames of Significant Change		* '''Execution''' <br> '''Capturing Image Frames of Significant Change'''<br>When used to record picture frames with significant changes, the CouchPotato handler is invoked with the -f image2 parameter, which directs the output to stdout. The taken photographs are systematically saved in the chosen directory, with each file labeled with a timestamp in GMT, mirroring the local machine’s time facilities. <ref name=”RE2”/><br> '''Capturing Video (Without Audio)'''<br>The handler is started with the -vcodec copy -an -f avi parameters for video capture without audio. The resulting video file is immediately written to the specified directory, with a filename that includes the precise time in GMT. <ref name=”RE2”/><br>'''Capturing Video (With Audio)'''<br>To capture video with audio, launch the CouchPotato handler with the -vcodec copy -acodec copy -f avi parameters. The resulting video file is then saved in the chosen directory, with a filename that includes the precise time in GMT. It’s important to realize that this approach generates more network traffic than collecting video without audio. <ref name=”RE2”/>
	When used to record picture frames with significant changes, the CouchPotato handler is invoked with the -f image2 parameter, which directs the output to stdout. The taken photographs are systematically saved in the chosen directory, with each file labeled with a timestamp in GMT, mirroring the local machine’s time facilities. <br> '''Capturing Video (Without Audio)'''<br>The handler is started with the -vcodec copy -an -f avi parameters for video capture without audio. The resulting video file is immediately written to the specified directory, with a filename that includes the precise time in GMT.''' ~~<br>~~Capturing Video (With Audio)
	To capture video with audio, launch the CouchPotato handler with the -vcodec copy -acodec copy -f avi parameters. The resulting video file is then saved in the chosen directory, with a filename that includes the precise time in GMT. It’s important to realize that this approach generates more network traffic than collecting video without audio.

			* '''Known Issues''' - On some versions, Xshell will let the user use a private key file that has not been imported into Xshell's key manager. In this case, BothanSpy will not be able to get the private key file name. <ref name=”RE2”/>
	* '''Known Issues''' - On some versions, Xshell will let the user use a private key file that has not been imported into Xshell's key manager. In this case, BothanSpy will not be able to get the private key file name. <ref name=~~”RE1”~~/>

	== Security ==		== Security ==

SDejkoski: /* VAULT 7 - CIA Hacking Tools */

2024-01-03T18:38:12Z

VAULT 7 - CIA Hacking Tools

← Older revision		Revision as of 18:38, 3 January 2024
Line 168:		Line 168:

	=== BothanSpy ===		=== BothanSpy ===
	This tool was leaked on the 6th July, 2017. BothanSpy is a tool for obtaining user credentials from the SSH client application Xshell. The Tool functions by targeting the Xshell application and discreetly collecting user credentials from current SSH connections. <ref name=”RE1”> WikiLeaks, “WikiLeaks - ~~CouchPotato v1~~.~~0 – User Guide”~~. https://wikileaks.org/vault7/document/~~Couch_Potato~~-~~1_0~~-~~User_Guide~~/, 2017 </ref>		This tool was leaked on the 6th July, 2017. BothanSpy is a tool for obtaining user credentials from the SSH client application Xshell. The Tool functions by targeting the Xshell application and discreetly collecting user credentials from current SSH connections. <ref name=”RE1”> WikiLeaks, “WikiLeaks - BothanSpy 1.0”. https://wikileaks.org/vault7/document/BothanSpy_1_0-S-NF/, 2017 </ref>

	* '''Setup''' - BothanSpy officially supports a predefined list of Xshell versions in its original release (v1.0). Version 3, build 0288; Version 4, build 0127; Version 5, build 0497; and Version 5, build 0537 are among them. Before use with Shellterm, install the BothanSpy.py file into the Shellterm configured scripts folder. <ref name=”RE1”/>		* '''Setup''' - BothanSpy officially supports a predefined list of Xshell versions in its original release (v1.0). Version 3, build 0288; Version 4, build 0127; Version 5, build 0497; and Version 5, build 0537 are among them. Before use with Shellterm, install the BothanSpy.py file into the Shellterm configured scripts folder. <ref name=”RE1”/>

	* '''Execution''' - BothanSpy has two separate modes of operation: Fire and Collect (F&C) and Fire and Forget (F&F). F&C mode, which is the suggested default, enables for credential gathering without writing any data to disk, assuring maximum discretion. In contrast, F&F mode produces encrypted files on the target’s workstation that include parsed Xshell credential data. <ref name=”RE1”/>		* '''Execution''' - BothanSpy has two separate modes of operation: Fire and Collect (F&C) and Fire and Forget (F&F). F&C mode, which is the suggested default, enables for credential gathering without writing any data to disk, assuring maximum discretion. In contrast, F&F mode produces encrypted files on the target’s workstation that include parsed Xshell credential data. <ref name=”RE1”/>

			* '''Known Issues''' - On some versions, Xshell will let the user use a private key file that has not been imported into Xshell's key manager. In this case, BothanSpy will not be able to get the private key file name. <ref name=”RE1”/>

			=== CouchPotato ===
			The tool was leaked on 10th August, 2017. CouchPotato is a remote tool in the CIA’s hacking toolkit that specializes in gathering data from RTSP/H.264 video streams discreetly. Its critical significance is in the extraction of both video files (AVI) and still photos (JPG), recording frames that differ significantly from previously recorded frames. CouchPotato rigorously cuts extra functions and codecs from the bundled ffmpeg version, focusing on a small Dynamic Link Library (DLL) build. Its operational integrity is dependent on being launched from an intrusion Countermeasures Electronics (ICE v3) Fire and Collect-compatible loader. <ref name=”RE2”> WikiLeaks, “WikiLeaks - CouchPotato v1.0 – User Guide”. https://wikileaks.org/vault7/document/Couch_Potato-1_0-User_Guide/, 2017 </ref>

			* '''Setup''' - To properly launch CouchPotato, the handler, as implemented by the cp handler.py script, must be run on the same host as the C2 loader. Using the -o option, the path or directory, where the files gathered by CouchPotato will be saved, must be specified during this initiation. It is vital to use caution and avoid running CouchPotato during important operations, as unexpected exits may occur, potentially causing interruptions. <ref name=”RE2”/>
			The Tool requires particular information for functioning, such as the video source (RTSP URL), instructions on how to handle video and audio (codecs), and defining the desired file format for output. Aside from these necessities, one needs the ability to fine-tune additional variables, such as the amount of information in the logs, defining when the data collecting should begin (start time offset), and determining the process length. In addition, the –pHash-threshold option allows you to establish a threshold for spotting significant changes in the photos captured by CouchPotato. <ref name=”RE2”/>

			* '''Execution''' - Capturing Image Frames of Significant Change
			When used to record picture frames with significant changes, the CouchPotato handler is invoked with the -f image2 parameter, which directs the output to stdout. The taken photographs are systematically saved in the chosen directory, with each file labeled with a timestamp in GMT, mirroring the local machine’s time facilities. <br> '''Capturing Video (Without Audio)'''<br>The handler is started with the -vcodec copy -an -f avi parameters for video capture without audio. The resulting video file is immediately written to the specified directory, with a filename that includes the precise time in GMT.''' <br>Capturing Video (With Audio)
			To capture video with audio, launch the CouchPotato handler with the -vcodec copy -acodec copy -f avi parameters. The resulting video file is then saved in the chosen directory, with a filename that includes the precise time in GMT. It’s important to realize that this approach generates more network traffic than collecting video without audio.


	* '''Known Issues''' - On some versions, Xshell will let the user use a private key file that has not been imported into Xshell's key manager. In this case, BothanSpy will not be able to get the private key file name. <ref name=”RE1”/>		* '''Known Issues''' - On some versions, Xshell will let the user use a private key file that has not been imported into Xshell's key manager. In this case, BothanSpy will not be able to get the private key file name. <ref name=”RE1”/>

SDejkoski: /* BothanSpy */

2024-01-03T18:27:04Z

BothanSpy

← Older revision		Revision as of 18:27, 3 January 2024
Line 173:		Line 173:

	* '''Execution''' - BothanSpy has two separate modes of operation: Fire and Collect (F&C) and Fire and Forget (F&F). F&C mode, which is the suggested default, enables for credential gathering without writing any data to disk, assuring maximum discretion. In contrast, F&F mode produces encrypted files on the target’s workstation that include parsed Xshell credential data. <ref name=”RE1”/>		* '''Execution''' - BothanSpy has two separate modes of operation: Fire and Collect (F&C) and Fire and Forget (F&F). F&C mode, which is the suggested default, enables for credential gathering without writing any data to disk, assuring maximum discretion. In contrast, F&F mode produces encrypted files on the target’s workstation that include parsed Xshell credential data. <ref name=”RE1”/>

			* '''Known Issues''' - On some versions, Xshell will let the user use a private key file that has not been imported into Xshell's key manager. In this case, BothanSpy will not be able to get the private key file name. <ref name=”RE1”/>

	== Security ==		== Security ==

SDejkoski: /* VAULT 7 - CIA Hacking Tools */

2024-01-03T18:25:31Z

VAULT 7 - CIA Hacking Tools

← Older revision		Revision as of 18:25, 3 January 2024
Line 166:		Line 166:
	* '''Setup''' - This application can be downloaded from the internet, but the website is not available anymore. There was an older version of this exploit named "Highrise 1.4". If this was installed on the device before, it needs to be terminated. This is done by going into the settings and locating "TideCheck". Now the buttons "Force Stop", "Clear Data", and "Uninstall" need to be pressed in that exact order to uninstall the application. Now that all the requirements are met, Highrise 2.0 can be opened. Firstly it will prompt the attacker with password, which is "inshallah". Now 3 functions are displayed on the screen: "Initialize", "Show Configuration" and "Send Message". Initialize obviusly executes the the attack, which leads to the application being able to run in the background, whenever the android device is active. But before starting it the configurations need to be made. This is done by pressing the show configuration button. There are multiple options, but the 2 most important are the "Checkin Interval" and the "Server URL". For the Checkin Interval it is recommended to use 2-5 minutes and for the Server URL you need to set the receiver you want to redirect the SMS message to. The last function is the "send Message" button, which enables the attacker to send messages to the configured Server URL, for troubleshooting.		* '''Setup''' - This application can be downloaded from the internet, but the website is not available anymore. There was an older version of this exploit named "Highrise 1.4". If this was installed on the device before, it needs to be terminated. This is done by going into the settings and locating "TideCheck". Now the buttons "Force Stop", "Clear Data", and "Uninstall" need to be pressed in that exact order to uninstall the application. Now that all the requirements are met, Highrise 2.0 can be opened. Firstly it will prompt the attacker with password, which is "inshallah". Now 3 functions are displayed on the screen: "Initialize", "Show Configuration" and "Send Message". Initialize obviusly executes the the attack, which leads to the application being able to run in the background, whenever the android device is active. But before starting it the configurations need to be made. This is done by pressing the show configuration button. There are multiple options, but the 2 most important are the "Checkin Interval" and the "Server URL". For the Checkin Interval it is recommended to use 2-5 minutes and for the Server URL you need to set the receiver you want to redirect the SMS message to. The last function is the "send Message" button, which enables the attacker to send messages to the configured Server URL, for troubleshooting.
	[[File:HIGHRISE.png\|border\|500px]]		[[File:HIGHRISE.png\|border\|500px]]

			=== BothanSpy ===
			This tool was leaked on the 6th July, 2017. BothanSpy is a tool for obtaining user credentials from the SSH client application Xshell. The Tool functions by targeting the Xshell application and discreetly collecting user credentials from current SSH connections. <ref name=”RE1”> WikiLeaks, “WikiLeaks - CouchPotato v1.0 – User Guide”. https://wikileaks.org/vault7/document/Couch_Potato-1_0-User_Guide/, 2017 </ref>

			* '''Setup''' - BothanSpy officially supports a predefined list of Xshell versions in its original release (v1.0). Version 3, build 0288; Version 4, build 0127; Version 5, build 0497; and Version 5, build 0537 are among them. Before use with Shellterm, install the BothanSpy.py file into the Shellterm configured scripts folder. <ref name=”RE1”/>

			* '''Execution''' - BothanSpy has two separate modes of operation: Fire and Collect (F&C) and Fire and Forget (F&F). F&C mode, which is the suggested default, enables for credential gathering without writing any data to disk, assuring maximum discretion. In contrast, F&F mode produces encrypted files on the target’s workstation that include parsed Xshell credential data. <ref name=”RE1”/>

	== Security ==		== Security ==

NFaustino: /* References */

2023-01-07T15:12:59Z

References

← Older revision		Revision as of 15:12, 7 January 2023
Line 180:		Line 180:
	* https://www.britannica.com/topic/WikiLeaks		* https://www.britannica.com/topic/WikiLeaks
	* https://www.ndr.de/fernsehen/sendungen/zapp/medienpolitik/Wikileaks-eine-Chronologie,wikileaks300.html		* https://www.ndr.de/fernsehen/sendungen/zapp/medienpolitik/Wikileaks-eine-Chronologie,wikileaks300.html
			* https://support.apple.com/de-at/guide/security/secc80b0cd0c/web
			* https://wikileaks.org/vault7/document/SonicScrewdriver_1p0/
			* https://wikileaks.org/vault7/document/HighRise-2_0-Users_Guide/
			* https://wikileaks.org/vault7/document/EXTENDING_User_Guide/
			* https://coed.com/2017/03/08/weeping-angel-cia-hack-protection-guide-how-to-prevent-protect-samsung-tv-info/
			* https://www.nytimes.com/2022/07/13/nyregion/cia-engineer-joshua-schulte-theft-convicted.html
			* https://wikileaks.org/ciav7p1/



	[[Category:Documentation]]		[[Category:Documentation]]