# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# StolenGoods-2_0-UserGuide

14 January, 2014

- 1
- 2
…
- 6
- 7
- 8
- 9
- 10
- 11

SECRET//NOFORN
2. -sd <path to stub DLL>: Required if persisting a DLL. Path to the stub DLL to
use. There are four options to pick from, based upon the target bitness and
payload DLL to persist:
i. MemStub32.dll (Persistence spec DLLs)
ii. MemStub64.dll (Persistence spec DLLs)
iii. MemStub32-GH1.dll (GH1 DLLs)
iv. MemStub64-GH1.dll (GH1 DLLs)
3. -sp <on target path>: Required if persisting a DLL. Path on target to lay down the
stub DLL.
4. -pd <path to payload DLL>: Required if persisting a DLL. Path to the payload
DLL to persist.
5. -ps <path to payload Driver>: Required if persisting a driver. Path to the driver to
persist.
(S//NF) At least one payload required (DLL or Driver). You can persist one driver and
one DLL at the same time if you wish. There are two RabbitStew executables (32 and 64
bit). Choose the EXE that reflects the target machine's bitness. For example, if building
an installer for Win 7 32-bit, use RabbitStew32.exe.
(S//NF) RabbitStew will print out a bunch of diagnostic information, including all files it
opened and read for use. Make sure the files selected are the ones you want. RabbitStew
will write out one of two files: shellcode_AMD64.bin or shellcode_x86.bin. The former
is written out by RabbitStew64, the latter by RabbitStew32. These files are what you will
send to ShellTerm when invoking its kernel shellcode execution module.
(S//NF) Example (using provided kshellcode.py script): kshellcode
'/home/user/shellcode_x86.bin'
(S//NF) The shellcode installer should return a number based on the result of the
installation. If the installer returns 0, then installation was successful. If the installer
returns a non-zero number, the installation failed. There are a lot of unique codes that
can be returned. Some common ones are as follows:
• 900 – Previous installation of SG2 was detected. If you're 100% sure this is
not the case, it may be possible that someone else installed a custom VBR
implant on the machine. See the developer to get more details
• 102 – The machine is using a non-standard sector size (standard is 512 bytes).
This can really mess up installation, so SG2 exits safely. If this occurs, you'll
need to talk to the developer about a custom compilation to run on this
machine.
• 103 – The total size of the payloads is too big for the free space found on the
target machine. Typically using a DLL and Driver payload combination that
totals more than 1 MB will be too big. The goal is to remain under 850 KB in
total payload sizes (overhead of required components is typically < 150 KB),
which would result in ~1MB total size. Space requirements are dependent on
SECRET//NOFORN
- viii -

- 1
- 2
…
- 6
- 7
- 8
- 9
- 10
- 11