# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# StolenGoods-2_0-UserGuide

14 January, 2014

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
- 10
- 11

SECRET//NOFORN
10. Finally, you'll be prompted for the path to the payload driver you wish to persist.
◦ If you're not persisting a driver (DLL only) leave this blank and hit enter
◦ Make sure you are using a driver that is compatible with the target
system. Grasshopper cannot perform any checks to determine if the
payload driver you gave will be OK to run on the target system.
Choosing an incompatible driver for the target system will most likely
cause a Blue Screen of Death (BSOD) on the target machine.
11. You may be prompted to change Grasshopper rules (two T/F questions). Unless
you know what you want, you should just hit enter (default answer of F) for both
questions.
12. (Grasshopper only) Type generate and hit enter
13. (Grasshopper only) Type build and hit enter
(S//NF) You're now done configuring a Grasshopper/Cricket build. The installers will be
written to the given output folder. No matter what your target OS/Bitness is, a 64 and 32
bit version of the Grasshopper/Cricket DLL and EXE installers will be built. Choose
what you need accordingly.
3.4 (S//NF) Shellterm Kernel Shellcode Installer
(S//NF) Stolen Goods 2 comes with the ability to be installed using Shellterms kernel
shellcode launcher. FULL DISCLOSURE: This installation method does not have
any real safety checks, and requires the user to be very careful about using it. All
payloads and stubs must be chosen by the user, and making an incompatible choice
will, most likely, cause the system to crash with a BSOD either during installation or
after reboot.
(S//NF) Included in this delivery is a 'shellcode builder' folder. Inside will be several
binaries. First, you must run (double clicking is fine) the Vbr.exe binary. This will mix
the VBR assembly code and produce ipl.asm. Re-running Vbr.exe will remix the VBR
persistence code, resulting in all but the first 12 bytes being different.
(S//NF) Next, using a command prompt, you'll need to run RabbitStew32.exe or
RabbitStew64.exe. There are up to 5 different parameters that you can give that will be
explained below. Remember, you must choose the correct binaries that are compatible
with the target system, or you will BSOD the target
1. -ss <path to stub driver>: Required. Path to the stub driver to use. This is the
driver that must be run first on the system, and takes care of kicking off running
and maintaining the persistence method. Failure to choose the correct driver
stub could result in a system crash. There are 3 provided options here that are
based off the target OS. Pick one of the following:
i. stubdriver_win7AMD64.sys
ii. stubdriver_win7x86.sys
iii. stubdriver_winXPx86.sys
SECRET//NOFORN
- vii -

- 1
- 2
…
- 5
- 6
- 7
- 8
- 9
- 10
- 11