Appendix A: Complete Exploit Catalogue

This inventory is compiled statically from the vector-exploit packages' info.yaml metadata, the repository’s Git history, and its development tree. Nothing in the repository was built, run, repaired, or improved.

The packages use internal tracking numbers (HT-YYYY-NNN). The loader accepts clear ZIP archives or archives encrypted with a source-embedded passphrase from the server’s exploits/ directory. The passphrase is not reproduced. When the catalogue is requested, the server’s exploit loader scans that directory and publishes each compatible package’s declared metadata to the console, using the categories social, zeroday, private, and public.

The three final zeroday package trees contain public stub manifests telling the user to contact HackingTeam support. The Word and PowerPoint trees also contain functional-looking info-good.yaml variants, while all three checked-out trees contain info-fake.yaml. Their names suggest alternate customer-facing and functional manifests, but no code found in the examined snapshot proves how or for whom they were selected. That remains an inference, not a catalogue fact.

The static history scanner recovers 46 paths named info.yaml, which collapse to 38 normalized catalogue IDs after renames and duplicates are joined. Seven are present at HEAD. A separate early ht-2011-019.zip has no recoverable manifest and is excluded from those metadata totals.

The tables merge three sets:

1. packages present at repository HEAD (2cf574d3bf2ea44f67433e32ccc9906ded6218e0, committed 12 December 2014; manifests declare version 20140930);
2. packages with recoverable metadata in Git history, using each manifest at its last surviving commit; and
3. projects in the repository’s src/ development tree.

Removal reasons are copied from the repository’s own CHANGELOG and should be read as HackingTeam’s descriptions, not independent conclusions.

Present at repository HEAD

The manifests are dated 30 September 2014. “First observed” is the first commit in this repository containing a manifest for the normalized ID; it is not necessarily the package’s original development date.

Two HEAD directory names disagree with their manifests: the FakeWin directory is numbered 2014-002 but declares HT-2012-001, and the self-delete directory is numbered 2014-003 but declares HT-2014-001. The table keys on the declared ID, which is what the backend returns to the console.

Retired packages with 2010-2013 catalogue IDs

¹ The historical manifest spells the ID HT-2011-0O7 with a capital letter O. The path and mapped CVE make the intended HT-2011-007 clear. The table normalizes it while preserving the discrepancy here.

Most removals that lack an individual explanation occurred in the February 2013 cleanup commit whose changelog says “Removed all dangerous exploits detected by AV.” Repeated folder names in history such as ht-2012-001-nsis, ht-2012-002-OSXFake, and makeosFake are iterations of IDs still present at repository HEAD rather than separate catalogue entries.

Development projects at repository HEAD

These projects were present in src/ but were not packaged in the operator catalogue at the examined repository tip.

Initial observations

Windows dominates the normalized catalogue: 34 of 38 metadata-bearing IDs (89%) name it, while macOS and iOS have two each. Categories divide into 19 private, 11 zeroday, six social, and two public entries. At repository HEAD, five of seven packages are Windows-focused; the categories have narrowed to four social and three zeroday entries. Android appears only in development trees in this inventory.

The catalogue’s center of gravity also changes. The 2010-2011 history contains a broad mix of private, public, and claimed zeroday vulnerabilities. By 2013, the packaged catalogue had narrowed toward Office-plus-Flash and IE chains. The repeated removal notes about patching and antivirus detection make product maintenance visible in repository history.

The Flash ByteArray use-after-free exposed in the leak was assigned CVE-2015-5119 and patched by Adobe shortly after the archive became public. Chapter 11 treats it as a separately sourced case study rather than inferring the mapping from filenames.

Finally, the version skew is direct: packages at repository HEAD declare version: 20140930, while the examined 9.2.3 server accepts only 20140512. The catalogue therefore targets a server line newer than the reconstructed database snapshot.

Validation state

The lifecycle, version, source path, and category totals above are generated from the reproducible static inventory. CVE-2011-0609 and CVE-2011-0663 are validated mappings. CVE-2010-1095 is retained only as a contradicted manifest claim. Broad bulletin references remain bulletin-level labels rather than guessed CVE mappings. The author-side publication-safety pass found that the metadata remains historical rather than procedural, removed the archive passphrase, and confirmed that no exploit command line, payload, or build procedure is included. Final review must still ensure later edits do not turn the descriptions into execution guidance.

Sources and evidence

• SOURCE: vector-exploit commit 2cf574d3bf2ea44f67433e32ccc9906ded6218e0, its history, VERSION, CHANGELOG, package manifests, and src/ names/readmes.
• SOURCE: rcs-db/lib/rcs-db/build/exploit.rb:238-254 at commit 6cff59d28634d718cac9fdd17cb629fd59a3cf3f for the accepted manifest version.
• SOURCE: research/hackingteam-rcs/exploit-catalogue/inventory.rb and its README for the normalization method and totals.
• Microsoft, MS11-031 and MS11-081.
• NIST NVD, CVE-2011-0609, CVE-2010-1095, and CVE-2015-5119.