Vault 7: Projects
This publication series is about specific projects related to the Vault 7 main publication.
SECRET//20341105
have a drive letter. It also must be
under \Windows\ folder.
-st (file name) The solartime pack file (xqlmi.dat)
to be added to the transitory file.
-f (file name) File name to be deleted from the
covert store.
-bin (file name) {sub-options} Add the specified binary (.exe, .dll,
or .sys) to the transitory file.
print transitory_file_name none Prints a summary of the contents of
the transitory file.
finalize transitory_file_name {user
install application}
none Adds the specified transitory file as
a resource to the targeted user
install application.
3.2 (S) Installing BadMFS
(S) Angelfire uses the BadMFS covert file system to store many of the implants and data
required to run. BadMFS has two options for installation, one using a specified file and
the other using slack space at the end of a hard drive. Which option is used depends on
what is specified under the –bp flag. To use the specified file option, an operator must
give a complete path to a file that will hold the covert store on disk. To use the slack
space option, the operator must specify “PhysicalDrive”. Note that many drives do not
have such slack space, therefore installation under this method is not guaranteed.
The maximum filesystem size for BadMFS is 200 MB.
Once BadMFS is installed using the Angelfire installer, the location of BadMFS must be
provided to any transitory file created. The location is specified with the –bp flag when
building a transitory file.
3.3 (S) Installing Angelfire (inst transitory file)
(S) To install Angelfire, you must create and finalize an “inst” transitory file. This
transitory file must include the BadMFS path on target (-bp), the wolfcreek driver (-wd),
the solartime container path that will be created on target (-cp), and the solartime pack
file (-st). Note that the container path (-cp) must not contain a drive letter, and it must be
placed under \Windows folder (i.e. the path must be \Windows\...).
Example creation of inst transitory file:
wtpack.exe new inst “inst_transitory_file”
wtpack.exe update “inst_transitory_file” –bp “BadMFS
location”
wtpack.exe update “inst_transitory_file” –wd
“wolfcreek driver”
wtpack.exe update “inst_transitory_file” –cp
“solartime container file (created on target)”
wtpack.exe update “inst_transitory_file” –st
“solartime pack file”
af+mainrepo+Angelfire 2.0 UserGuide 7
of 15
SECRET//20341105
Angelfire-2_0-UserGuide.pdf