Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
UNCLASSIFIED
Analysis Report
WMI Persistence Proof of Concept – Supplemental Report
(U) Unfortunately, Microsoft’s documentation is inconsistent and, ultimately, incorrect. For
example, consider Figure 1 (below):
Figure : IMofCompiler Interface Documentation
(U) Note that the CompileBuffer method states that it can take a buffer of
BMOF data and compile /install it. Although the file cannot easily be
generated at runtime, the small size of the BMOF data allows it to be
included in a variety of ways and, therefore, make this a viable option. With
this in mind, we still performed additional research to verify that no method
exists that would allow a text MOF buffer to be generated at runtime and
subsequently installed. Further investigation into the
IMofCompiler::CompileBuffer method above revealed the text in Figure 2
(below):
Figure : IMofCompiler::CompileBuffer Documentation
Raytheon Blackbird Technologies, Inc.
4
26 June 2015
Use or disclosure of data contained on this sheet is subject to the restrictions on the title page of this document.
UNCLASSIFIED