Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//20350629
Figure 5: (S) Link Parameters tab
(S) The first two tabs in Mac-n-Cheese are used to create the Giraffe Link files. The first
tab is for 32-bit execution and the 2
nd
tab is for 64-bit execution. Different link files need
to be created for the different OS architectures.
(S) In each tab you will need to specify the name of the dll that will get loaded on
exploitation and the name of the link files that you want created. You can manually enter
data in the text boxes or use the “…” buttons on the right side of the screen to create the
file names. To specify a link file name you must first click the check box to the left of
that OS. Note, to increase the likelihood of execution on Windows XP, two different link
files need to be created. If you do not want the additional link file, Windows XP B is the
more likely link file to gain execution.
Figure 6: (S) Dll Parameters tab
(S) The Dll Parameters tab sets the file name of the payload executable to launch. Click
on the button to the right of the “Target executable to launch” box. Browse to and select
the executable that you want launched. In the next box, “Additional parameters”, you
can specify arguments to pass to the executable.
The “Auto Fix Paths” box is used to make the executable path relative to the drive the
link file containing the link file. You will generally want to keep this box checked.
SECRET//20350629
10