Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #3375506
Grasshopper Design
Note: Grasshopper is currently being updated for v2.0. This page documents the working v2.0 design. As such, it is subject to change at any time.
Background
Grasshopper is a modular tool used to install software IOInformation Operations tools on targets running Microsoft Windows operating systems. Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). Installers may be configured with rule that will be evaluated on target to determine whether to conduct an install.
Overview
A Grasshopper executable contains one or more installers. An installer is a stack of one or more installer components. Grasshopper invokes each component of the stack in series to operate on a payload. The ultimate purpose of an installer is to persist a payload.
Grasshopper will optionally evaluate rules to determine whether to execute an installation. Rules may be set on each installer and/or globally.
Component
Grasshopper components form the functional portions of an installer. Components may be used to introduce payloads to the installer stack, modify a payload in the stack, or install a payload on a target. A component script is used at build time to generate component configurations and resources. A resource is used to store component data shared across installers while a configuration is used to store component data specific to an installler. A Grasshopper installer executes a component module at run time to perform some operation on the payload. The module is provided the configuration and resource generated by the script.
Components may be independently developed and added to a Grasshopper system.