# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-Module-Crab-v1_0-UserGuide

1 June, 2012

- 1
- 2
- 3
- 4
- 5
- 6

SECRET//ORCON//NOFORN
1 Overview
Crab is a persistence module that uses a Windows Service Executable to persist a
payload. When a payload is chosen to use this module, Crab will install a stub
Windows service and deploy the payload to the target.
Crab supports 32- and 64-bit EXE, DLL, and GH1 payloads. The bitness of the stub
and DLL, GH1 payloads must match the target OS. A 32-bit EXE payload may be
installed on a 64-bit target, but not vice versa.
2 Installation
Crab uses direct registry modification to register a Crab stub executable as a
Windows Service using the user-provided configuration. If the module fails to install
the payload, it will delete any deployed components and remove the registry
modifications.
2.1 Configuration
The following fields are configured at build time to specify Crab's installation
behavior.
Field
Defau
lt
Description
Service Name None Overt key value for service stored in registry
Service EXE Path None Path to stub EXE on target installed as a service
If the path does not exist, it is created.
Payload Path None Path to payload EXE or DLL on target
If the path does not exist, it is created.
Display Name None Overt name of service displayed by Windows Services
MMC
Description None Overt description of service displayed by Windows
Services MMC
3 Payload Execution
Whenever the system starts, the Windows OS will run the Crab service executable
stub with SYSTEM privileges. The behavior of the Crab stub depends on the payload
type. Crab supports three kinds of payload: EXE, DLL, GH1.
3.1 EXE and DLL
If the payload is an EXE or DLL, the stub is configured with the path to the payload
and the name of the service that identifies it. Upon execution by Windows services,
the stub will run the payload.
If the payload is an EXE, the Crab stub will execute it with SYSTEM privileges and
terminate. If the payload is a DLL, the stub will call
LoadLibrary() and begin
monitoring the payload.
3
SECRET//ORCON//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6