# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-Module-Null-v2_0-UserGuide

1 December, 2013

- 1
- 2
- 3
- 4
- 5

SECRET//ORCON//NOFORN
1 Overview
NULL is a module that lays down and executes a payload. When a payload is
chosento use this module, NULL will drop the payload to disk, execute it, and exit
immediately. Note that the payload is not deleted.
As of version 2.0, NULL can optionally also lay down (but not execute) an arbitrary
number of other user provided files.
This module is meant to be used with either one-shot tools (e.g., a survey tool) or
with payloads that provide their own persistence separate from Grasshopper,
allowing existing tools to make use of the Grasshopper Rule Engine and payload
obfuscation.
NULL supports 32- and 64-bit EXE payloads only.
2 Installation
NULL will deploy and execute an EXE payload at a user-specified location on the
target filesystem. NULL does not provide any soft persistence, nor will it delete the
payload after execution.
2.1 Configuration
The following fields are configured at build time to specify NULL's installation
behavior.
Field
Defaul
t
Description
Payload Path None Path to Payload EXE on target started by NULL
If the path does not exist, it is created.
Additional Files None Local and remote paths for any desired additional files.
3 Payload Execution
The payload is executed once as a normal process at the privilege level of the
Grasshopper process. All additional files are dropped before the payload is dropped.
If any file is not able to be dropped for any reason, all dropped files will be securely
deleted and the payload will not be executed.
The NULL module does not need to uninstall; it does not leave any stubs and does
notprovide any persistence. The payload is responsible for removing itself from the
target.
3.1 Run Once
The NULL module implements the 'run_once' interface, indicating that the payload
will be executed one and only one time.
Any payload using this module must also be designated as using the 'run_once'
interface.
3
SECRET//ORCON//NOFORN

- 1
- 2
- 3
- 4
- 5