# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-Module-Buffalo-Bamboo-v1_0-UserGuide

1 June, 2012

- 1
- 2
- 3
- 4
- 5
- 6
- 7

SECRET//ORCON//NOFORN
Windows svchost caches important registry information about services it has
started. In order to completely unhijack the service, we load a support DLL to locate
and clear the hijacked service's cache entry. Consequently, if the hijacked service
has already been started, the hijack will fail and the payload will not start until
reboot or until svchost restarts.
3 Payload Execution
Whenever the system starts, the Windows OS will run the Buffalo/Bamboo service
DLL stub. The stub is executed from the netsvcs svchost process with SYSTEM
privileges. The behavior of the stub depends on the payload type. Buffalo and
Bamboo support three kinds of payload: EXE, DLL, GH1.
3.1 EXE and DLL
If the payload is an EXE or DLL, the stub is configured with the path to the payload
and the name of the service that identifies it. Up execution by Windows services,
the stub will run the payload.
If the payload is an EXE, Buffalo/Bamboo will execute it with SYSTEM privileges and
terminate. If the payload is a DLL, the stub will call LoadLibrary() and begin
monitoring the payload.
If the stub is unable to locate or start the payload or if the payload disappears, it will
uninstall. During uninstallation, Buffalo/Bamboo will delete the payload, remove the
service, and self delete the stub.
The EXE or DLL payload is responsible for deleting itself from the target to trigger
uninstallation.
3.2 GH1
If the payload implements the GH1 interface, Buffalo/Bamboo embeds the payload
as a resource in the stub and configures the stub with the name of the service that
identifies it. Upon execution, the stub will load the payload DLL in memory.
The stub will uninstall itself on demand or failure to start the payload. During
uninstallation, Buffalo/Bamboo will remove the service and self delete the stub and
payload.
4 Footprint
Buffalo/Bamboo writes unobfuscated binaries to the target filesystem. The service
DLL stub is written to the filesystem at a user-specified path. If the payload is an
EXE or DLL, it is written to the filesystem at a user-specified path. If Bamboo is
used, the unhijack support DLL is written to the filesystem at a user-specified path
and promptly deleted after installation.
If the payload is an EXE, the process of the payload executable is visible in the Task
Manager during execution.
Buffalo/Bamboo will create a service visible in the Services view of the Microsoft
Management Console with the user-specified display name and description.
A registry key will be placed in
HKLM\SYSTEM\CurrentControlSet\services\<ServiceName>
holding the description and the path to the service stub.
4
SECRET//ORCON//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6
- 7