# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-Module-Buffalo-Bamboo-v1_0-UserGuide

1 June, 2012

- 1
- 2
- 3
- 4
- 5
- 6
- 7

SECRET//ORCON//NOFORN
The Service Name will be placed in a registry REG_MUTLI_SZ value at
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs. Note: this value is
distinct from the subkey of the same name.
5 Receipt XML Format
Buffalo/Bamboo's configuration is recorded in the Grasshopper receipt at build time
under build.xml. An example and description of the xml format is provided below.
5.1 XML Examples
<PersistModule>
<UUID>9d03da02ab3a47d7bd28c9a776ba9806</UUID>
<ServiceDll>
<ServiceName>Cover Name</ServiceName>
<ServiceDllPath>C:\Test\stub.dll</ServiceDllPath>
<PayloadPath>C:\Test\payload.exe</PayloadPath>
<DisplayName>Cover Name</DisplayName>
<Description>This is a description.</Description>
</ServiceDll>
</PersistModule>
<PersistModule>
<UUID>9d03da02ab3a47d7bd28c9a776ba9806</UUID>
<ServiceDllHijack>
<ServiceName>Cover Name</ServiceName>
<ServiceDllPath>C:\Target\stub.dll</ServiceDllPath>
<PayloadPath>C:\Target\payload.dll</PayloadPath>
<DisplayName>Cover Name</DisplayName>
<Description>This is a description.</Description>
<UnhijackDllPath>C:\Target\unhijack.dll</DllPath>
</ServiceDllHijack>
</PersistModule>
5.2 Field Definitions
UUID
The universally unique identifier for the module variant used in the build.
ServiceDll
The service DLL configuration information used by the Buffalo module.
ServiceDllHijack
The service DLL and hijacking configuration information used by the Bamboo
module.
5
SECRET//ORCON//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6
- 7