# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Brutal Kangaroo

# EzCheese v6.2 - User Guide (Rev. B)

18 July, 2013

- 1
- 2
- 3
- 4
- 5
- 6
…
- 21
- 22

SECRET//20350629
1. (U) Scope
(U) This document establishes the User Guide for EzCheese v6.2.
1.1 (U) System Overview and Description
(S) COG/HTD and COG/NOD have requested enhancements to the existing EZCheese
application that runs from a flash drive to drop a payload, perform a system survey, and
run a configurable file collection. As in version 5.1.1 the link file creation GUI, Mac-n-
Cheese, has been separated from the survey configuration GUI. The link files for version
6.2 have been upgraded from EnviousArtist to Giraffe. Additionally, link files can be
created for windows XP, Vista, or 7 on either 32 or 64 bit machines from any of the
operating systems. EZCheese 6.2 also includes the option to deploy multiple payloads
with individual blacklists. Unlink previous versions the survey/ file collection executable
is not restricted to running from removable media.
(S) Flash drives are configured with the EZCheese application prior to deployment. Once
on target, the user browses to a specific folder on the thumb drive which will trigger the
Giraffe exploit and launch the EzCheese collection. The tool will run for few minutes and
will write all data back to the thumb drive, buried in the folder structure, in an encrypted
and compressed format.
1.2 (U) Assumptions and Constraints
(S) In order for the survey tool to run, the user must use Windows Explorer to display a
link file crafted for the current OS. This will trigger the Giraffe exploit which will load a
dynamically linked library (DLL). If the target is not running any programs in the
configured process blacklist, and it is not running a blacklisted OS/ServicePack, it will
start the EzCheese survey program. On Windows XP, this exploit will only run once per
machine such that if the user browses to that directory again, nothing will happen. On
Windows Vista, the dll will load every time the user browses to the folder containing the
link. No old survey data will be overwritten and data from additional surveys can be
collected and stored in individual folders.
2. (U) Applicable Documents
(S) The following documents pertain to this tool. In the event of a conflict between the
documents referenced below, the contents of this document will be considered binding.
• EzCheese v6.2 User Guide_Rev B_2013-07-17.doc (S//NF)
• EzCheese v6.2 TDR_Rev B.pptx (S//NF)
• EZCheese v6.2_IVV TDR Slides_07172013.pptx (S//NF)
• EZCheese v6.2_IVVTR_07172013.pdf (S//NF)
SECRET//20350629
1

- 1
- 2
- 3
- 4
- 5
- 6
…
- 21
- 22