# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# StolenGoods-2_1-UserGuide

14 July, 2014

- 1
- 2
…
- 9
- 10
- 11
- 12
- 13
…
- 21
- 22

SECRET//NOFORN
(S//NF) RabbitStew will print out a bunch of diagnostic information, including all files it
opened and read for use. Make sure the files selected are the ones you want. RabbitStew
will write out to the given output file (--output) or a default name if none is given. A
receipt file is generated with a time stamp in the name. This receipt file contains all the
options used when configuring SG2, the XOR keys used for obfuscating the payloads for
install, and a SHA256 hash of the output bin file.
(S//NF) Example (using provided kshellcode.py script): kshellcode
'/home/user/shellcode_x86.bin'
(S//NF) The shellcode installer should return a number based on the result of the
installation. If the installer returns 0, then installation was successful. If the installer
returns a non-zero number, the installation failed. There are a lot of unique codes that
can be returned. Some common ones are as follows:
• 900 – Previous installation of SG2 was detected. If you're 100% sure this is
not the case, it may be possible that someone else installed a custom VBR
implant on the machine. See the developer to get more details
• 102 – The machine is using a non-standard sector size (standard is 512 bytes).
This can really mess up installation, so SG2 exits safely. If this occurs, you'll
need to talk to the developer about a custom compilation to run on this
machine.
• 103 – The total size of the payloads is too big for the free space found on the
target machine. Typically using a DLL and Driver payload combination that
totals more than 1 MB will be too big. The goal is to remain under 850 KB in
total payload sizes (overhead of required components is typically < 150 KB),
which would result in ~1MB total size. Space requirements are dependent on
the target machine. Some machines can have 6-7 MB of unpartitioned space,
others may only have 1 MB (contiguous).
• 104 – The installer failed to write the stub DLL to disk. The likely cause of
this is that the target path exists already. Example: Tried to lay down stub
DLL to c:\windows\system32\msxml6.dll but msxml6.dll already exists in that
directory.
• 6 – The active partition is not an NTFS partition. Not safe to install in this
case.
• 105 – This generally means there was not sufficient space on the disk that
SG2 could write to when installing payload data. SG2 installs to free space on
the disk (not the file system). If this error occurs after repeated throws (2-3
times in a row) then SG2 cannot install on the system at this time. Report
these instances to the developer. If there are enough important systems that
have this issue, there are (non-trivial) ways of getting around this problem that
can be worked on in future versions.
(S//NF) Other return errors for the shellcode installer, and for the Grasshopper installer,
describe many other issues that could arise. If you get a code not listed above, the
developer can look it up for you.
SECRET//NOFORN
- xi -

- 1
- 2
…
- 9
- 10
- 11
- 12
- 13
…
- 21
- 22