WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# StolenGoods-2_1-UserGuide

14 July, 2014

- 1
- 2
…
- 15
- 16
- 17
- 18
- 19
…
- 21
- 22

SECRET//NOFORN
(S//NF) Figure 4 – Here is where we enter the full path to the DLL payload we want to persist. If none is used,
we can just hit enter here (no other input)
(S//NF) Figure 5 – We can enter optional command line arguments for a Persistence Spec compliant DLL here.
The first entry is the command line to send, the second entry is the name of the environment variable to store the
command line in for the payload to access. Both are optional, and can be skipped by just hitting enter (no input)
(S//NF) Figure 6 – Next, we enter the on-target path to save the on-disk stub for launching the DLL payload. For
Grasshopper, the directory does not have to exist on target, but Grasshopper must have the permissions to
create the directory path, and to write a file to that location.
(S//NF) Figure 7 – Next, we enter the full path to the payload driver we want to persist. If none is used, we can
just hit enter here (no other input). Remember, at least 1 payload (DLL or driver) is required (otherwise, what's
the point?)
(S//NF) Figure 8 – We want to use the network component, so we enter T here.
(S//NF) Figure 9 – Grasshopper will let you edit rules here. This example uses the default rules, which only
verifies that the target OS is Windows XP SP3, and admin access is granted to the Grasshopper process when
installing. Just hit enter to move on from both prompts to leave it as-is.
SECRET//NOFORN
- xvii -

- 1
- 2
…
- 15
- 16
- 17
- 18
- 19
…
- 21
- 22