1. Part One: System administration Training Handouts

2. Contents of Part one: System administration 2.1 Diagrams 2.2 Frontend 2.2.3 Anonymizers 2.2.4 Collector 2.3 Backend 2.3.4 Masternode 2.3.5 Shards (option) 2.4 Data Flow 2.5 Network Injectors (option) 2.5.1 TNI 2.5.2NIA 2.6 RMI modem (option) 2.7 System panel 2.7.1 Frontend Management 2.7.2 Backend Management 2.7.3 Injector Management (option) 2.7.4 Connector Management (option) 2.8 Monitor Panel Architecture Console

3. Anonymizer DMZ 2.1 High level diagram: Internet LAN User LAN EndUser network Anonymizer Collector Masternode Mobile Agent Desktop Agent Internet

4. 2.1 Block diagram:

5. 2.1 Interconnection schema:

6. 2.1 Allowed traffic through the switch:

7. 2.2.1 Anonymizer chain: Anonymizer Collector Anonymizer Virtual Private Server (VPS) with: Linux CentOS™ 6 32 Bit (and x64?) 256 MB of RAM minimum Static public IP address 2 Mbit/s Internet connection Running process:

8. 2.2.4 Collector server: Collector Anonymizer http:80 https:44 3 Network Injectors Gathers evidence from agents (Via Anonymizer) Serves client’s requests for installers http:80 Monitors other Galileo module health (Network Controller, NC) Agent

9. Masternode Receives evidence from and sends commands to the Collector Collector Operator Console Operator Console Operator Console Shard (optional) https:443 Accessed by Operators Consoles Distributes data among shards (optionally) 2.3.4 Masternode server:

10. Galileo Agent synchronize to the First Anonymizer The last anonymizer in the chain forwards Agent traffic to the Collector Server The Collector Server recognize and Authenticates the Agent, extract payload and stores it locally If any shard is part of the infrastructure, the Masternode distributes evidence among them When the User access to the Masternode from within his Consoles, data are pulled from Masternode, displayed and handled by the user. Masternode receives payload from the Collector, decrypts it and stores evidence in the Database 2.4 Data from the device to the Operator’s eye

11. Internet The target requests an Internet resource TNI intercepts the requests TNI makes the same request and downloads the same content The modified resource is sent back to the target TNI modifies the resource to deliver the Agent 2.5.1 Tactical Network Injector (TNI) Target device Access point TNI (Tactical Network Injector) http:80

12. 2.5.2 Network Injector Applicance (NIA)

13. 2.6 RMI (Remote Mobile Installation) modem Zadako™ Modem USB-connected to the Masternode Automatically detected by Galileo To be equipped with phone simcards Sends sms wap push messages Aircard Watcher™ software must be running

14. 2.7 System-Frontend Panel Installing new Anonymizers: Click on New Anonymizer and fill out: Name (arbitrary) Description (arbitrary) Address (public static Ip address) Monitor via Network Controller Click on Download Installer, then: copy the installer onto the VPS execute sh / /installer.sh check that the process is running (ps aux | grep bbproxy) Drag and drop the new Anonymizer onto the Collector and do Apply Configuration Issues? Monitor Panel Collector Logs (C:\RCS\Collector\Log) Support portal (https:\\support.hackingteam.com\) Upgrade: select the Anonymizers and click Upgrade

15. 2.7 System-Backup Panel To be continued…

16. Training Agenda: Monday: Firewall and Architecture - check 9.2 Requirement Preparation- check Offline Installation ( refer to ticket) Chrome Cashed password retrieving (to open ticket, it worked in local environment) Tuesday Tactical Network Injector (Injection Proxy) Exploit Creation Questions & Answers (Devel.) Windows desktop Melted executable Vs Antiviruses (Devel.) (kspky, comodo) How to conf agent to uninstall after a period of time Wednesday Mobile infections: Android, Windows Phone (devel.), iOS (Devel.) Thursday 9.2 Training Q&A: Roadmap, Hacking training, Client Suggestions, Project Expansion (Massimiliano), missing versions Friday Backup