# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# StolenGoods-2_1-UserGuide

14 July, 2014

- 1
- 2
…
- 8
- 9
- 10
- 11
- 12
…
- 21
- 22

SECRET//NOFORN
(S//NF) Windows 8.1 support: In 2.1, SG2 can operate against Windows 8.1. This
requires different IPL code compared to Windows XP-7. To produce the right IPL code,
run VBR.exe from the command line with one of the following arguments:
• --832: To generate IPL code for Windows 8.1 x86. Will generate ipl_832.asm
• --864: To generate IPL code for Windows 8.1 x64. Will generate ipl_864.asm
(S//NF) Next, using a command prompt, you'll need to run RabbitStew32.exe or
RabbitStew64.exe. Remember, you must choose the correct binaries that are compatible
with the target system, or you will BSOD the target
1. [--xp | --732 | --764 | --832 | --864]: The OS of the target system. This choice is
crucial, as an incorrect choice here will lead to an incorrect choice by the builder
for many key components, which *will* result in system instability, BSOD, or
straight OS boot failure. Only 1 choice should be given.
2. --ps <path to driver payload>: Optional. Path to the driver payload for SG2 to
persist. The user needs to ensure this payload will work on the target OS. SG2
does no verification of the driver payload beyond checking that it exists.
3. --pd <path to DLL payload>: Optional. Path to the DLL payload for SG2 to
persist. As for --ps, the user must ensure the DLL will work on the target system.
4. --sp <path on target for a stub>: Required if --pd is used. Path on target for SG2
to save a stub DLL for injection of the payload DLL. The stub is a simple
downloader/memory loader which is used to inject the payload into the target
process. This path must exist on the target or installation will fail (Error 104).
5. --network: Optional. Turns on the network component.
i. Note for Windows 8.1: The network component should work just fine on
Windows 8.1. However, it is using a Windows 7 driver and deprecated
functionality (deprecated since XP). It uses the same functionality as
WinPCap, which supports Windows 8.1. Having said all that, there is still
risk involved. Therefore, when using the network component for Windows
8.1 targets, you must specify --network AND --ikwid. Otherwise, the builder
will fail and tell you that --network can't be used on Windows 8.1
6. --gh: Optional. If a payload DLL is given, and the payload DLL is GH1
compatible, then this switch can be used to utilize the GH1 stub, allowing use of
GH1 functionality with the GH1 DLL payload. Do not use this switch unless
you are 100% sure the payload DLL is GH1 compliant. Otherwise, process
instability can occur.
7. --output: Optional. The name of the output .bin file, containing the configured
SG2 install for Shellterm's shellcode installer.
(S//NF) At least one payload is required (DLL or Driver). You can persist one driver and
one DLL at the same time if you wish. There are two RabbitStew executables (32 and 64
bit). Choose the EXE that reflects the target machine's bitness. For example, if building
an installer for Win 7 32-bit, use RabbitStew32.exe.
SECRET//NOFORN
- x -

- 1
- 2
…
- 8
- 9
- 10
- 11
- 12
…
- 21
- 22