# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# StolenGoods-2_1-UserGuide

14 July, 2014

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 21
- 22

SECRET//NOFORN
9. Next, you'll be prompted for a path on target to write the stub DLL to. The stub
DLL handles loading the payload DLL in-memory. The path will be created by
Grasshopper if it doesn't already exist, if Grasshopper is able to (sufficient
permissions at time of install)
◦ If a DLL is not being persisted (driver only) leave this blank and hit enter
10. You'll be prompted for the path to the payload driver you wish to persist.
◦ If you're not persisting a driver (DLL only) leave this blank and hit enter
◦ Make sure you are using a driver that is compatible with the target
system. Grasshopper cannot perform any checks to determine if the
payload driver you gave will be OK to run on the target system. Choosing
an incompatible driver for the target system will most likely cause a Blue
Screen of Death (BSOD) on the target machine.
11. Finally, you'll be asked if you wish to use the network driver component. This
component captures network packets and allows a payload to call into SG2 to
retrieve the network packets. The only tool which supports talking with SG2 (at
the time of this writing) is IcePick v1.2
12. You may be prompted to change Grasshopper rules (two T/F questions). Unless
you know what you want, you should just hit enter (default answer of F) for both
questions.
13. (Grasshopper only) Type generate and hit enter
14. (Grasshopper only) Type build and hit enter
15. You'll be asked if the target is Windows 8.1 or not. Make sure to answer these
questions correctly. Failure to do so will mean Grasshopper will pick the wrong
IPL code for persistence, and will brick the OS install on target.
16. If you chose to use the network component, then you'll have to type in the target
OS twice during the build phase when prompted. Make sure to select the proper
OS target!
(S//NF) You're now done configuring a Grasshopper/Cricket build. The installers will be
written to the given output folder. No matter what your target OS/Bitness is, a 64 and 32
bit version of the Grasshopper/Cricket DLL and EXE installers will be built. Choose
what you need accordingly.
4.5 (S//NF) Shellterm Kernel Shellcode Installer
(S//NF) SG2 comes with the ability to be installed using Shellterm's kernel shellcode
launcher. FULL DISCLOSURE: This installation method does not have any real
safety checks, and requires the user to be very careful about using it. All payloads
must be chosen by the user, and making an incompatible choice will, most likely,
cause the system to crash with a BSOD either during installation or after reboot.
(S//NF) Included in this delivery is a 'shellcode builder' folder. Inside will be several
binaries. First, you must run (double clicking is fine) the Vbr.exe binary. This will mix
the VBR assembly code and produce ipl.asm. Re-running Vbr.exe will remix the VBR
persistence code, resulting in all but the first 12 bytes being different.
SECRET//NOFORN
- ix -

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11
…
- 21
- 22