# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Brutal Kangaroo

# EzCheese v6.2 - User Guide (Rev. B)

18 July, 2013

- 1
- 2
…
- 15
- 16
- 17
- 18
- 19
…
- 21
- 22

SECRET//20350629
• %drive% - adds the drive flash drive letter to the filepath (e.g. “G:\”)
• %GUID% - adds a GUID in the filepath
• %ft% - adds the filetime to the filepath
• %st% - adds the systemtime to the filepath
(S) So an example entry would be:
• \Windows\System32\%GUID%
(S) The GUI now allows for a user to save and/or load configuration files. The user must
simply navigate to the file menu and select either "Load Configuration" or "Save
Configuration" based on the action desired. The file menu also allows for individual tabs
to be cleared, if necessary.
4.2.3 (U) Application Configuration
(S) Once all desired collection sets are in the table, and the exploit parameters are set, the
user must navigate to the file menu, then select Configure Exploit for EZConfigUltimate
or Create Link(s) for Mac-n-Cheese, to configure the tool. The application now forces
the user to save a configuration file before proceeding. Once configured, the tool will
copy all cover files, the exe, dll, and link to the appropriate locations on the flash drive.
4.3 (S) Initiating a Session on the Target System
(S) The following steps should be taken to activate the EzCheese tool on a target system:
1. (S) Insert the USB drive into the target system.
2. (S) Open Windows Explorer (some systems will do this automatically upon
thumb drive insertion), browse to the USB drive, and then browse to the folder
containing the link(s) on the drive. Other than drive activity, there will be no
reliable indication that the collection has begun or that the payload has been
dropped on the target.
(S) IMPORTANT: The collection process may take several minutes. If the drive is
removed from the system before the collection completes, some survey/collection
data may not be written to the thumb drive. The user should allow the tool to
complete the survey/collection and stop activity to the thumb drive. There is no
other visible indication that the process is finished.
4.4 (U) Stopping and Suspending Work
(S) The EzCheese tool cannot be stopped once it is initiated. If the drive is removed while
the tool is still running, it will terminate gracefully but only complete a partial collection.
4.5 (U) Contingencies and Alternate States and Modes of Operation
(S) If the link file is removed from the drive, the tool will not execute. Removing this file
is a way to disarm the drive if desired.
SECRET//20350629
14

- 1
- 2
…
- 15
- 16
- 17
- 18
- 19
…
- 21
- 22