# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# StolenGoods-2_1-UserGuide

14 July, 2014

- 1
- 2
- 3
- 4
- 5
- 6
…
- 21
- 22

SECRET//NOFORN
1. (U) Scope
(S//NF) This document is the User Manual for Stolen Goods v2.1, a persistence method
for the Grasshopper installer or the Shellterm shellcode injector. It provides a description
of how Stolen Goods works, the payloads Stolen Goods can persist, and how to use
Stolen Goods with Grasshopper and Shellterm.
(S//NF) Stolen Goods 2.0 is fundamentally different from Stolen Goods 1.0. This user
guide will not include information about Stolen Goods 1.0. Please see the original Stolen
Goods 1.0 user guide for all 1.0 information. All information contained here is in
reference to Stolen Goods 2.0 only.
(S//NF) Stolen Goods 2.1 adds a few core features, and other quality of life
improvements. SG 2.1 adds support for Windows 8.1 (x86 and x64), a limited stealth
mechanism, and a network capture capability for use with IcePick 1.2
2. (U) Fair Warning
(S//NF) This document will stress some details, often repeatedly and in bold letters, that
are crucial to remember. This was done purely in the interest of making sure the user has
a good first experience with the tool, and to help the user avoid the same mistakes the
developer made while testing the tool. There are plenty of ways to easily misconfigure
Stolen Goods 2.1 for a target OS. Most mistakes will cause the system to constantly fail
to boot or constantly blue screen during start up. The target would then need to reinstall
their OS to fix the issue most likely (or use some kind of recovery CD). Considering the
consequences for installing a misconfigured SG2 install are high, it is important that you
either:
• Read this guide in its entirety (or at least the sections pertaining to the installation
method of choice)
• Ask the developer for a quick demo on how to use it for your particular CONOPS
(S//NF) The current developer of SG2 is very much willing to do demos for parties who
want to use SG2 and want to make sure they're using it correctly. The builders are easy
to use after going through the process once or twice.
SECRET//NOFORN
- iv -

- 1
- 2
- 3
- 4
- 5
- 6
…
- 21
- 22