Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #3375506
Grasshopper Design
Note: Grasshopper is currently being updated for v2.0. This page documents the working v2.0 design. As such, it is subject to change at any time.
Background
Grasshopper is a modular tool used to install software IOInformation Operations tools on targets running Microsoft Windows operating systems. Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). Installers may be configured with rule that will be evaluated on target to determine whether to conduct an install.
Overview
A Grasshopper contains one or more installers. An installer is a stack of one or more installer components. Grasshopper invokes each component of the stack in series to operate on a payload. The ultimate purpose of an installer is to persist a payload.
Grasshopper will optionally evaluate rules to determine whether to execute an installation. Rules may be set on each installer and/or globally.
Definitions
Installer
Installers encapsulate the process used to install a payload on a target. They are constructed from one or more components that each contribute to the installation process.
An installer may have an associated rule that will be evaluated before execution.
Component
Components form the functional portions of an installer. Components may be used to introduce payloads to the installer stack, modify a payload in the stack, or install a payload on a target. A component script is used at build time to generate component a configuration, used to store component data specific to an installler. A Grasshopper installer executes a component module at run time to perform some operation on the payload. The module is provided the configuration and resource generated by the script.
Components may be independently developed and added to a Grasshopper system.
Script
A component script is a Python package that interfaces with the Grasshopper builder.
Configuration
A component configuration is a data store provided to the component to save information necessary to execute an installation step. The configuration is generated by the script at buildtime and provided to the module at runtime. A configuration is generated for each use of a component.
The format of the configuration data is component-specific.
Module
A module is a Windows DLLDynamic Link Library that provides runtime functionality for an installer component. At runtime, modules are provided a configuration and, optionally, an input payload from the previous component. Modules may return an output payload which will be passed to the next component.
The component must provide modules for each Grasshopper architecture.
Payload
Payloads are the tools that an installer is meant to install on a target. A payload is passed to each installer component in series to perform some component-specific action. The first component is responsible for starting the payload on the installer stack and should not expect one as input. The last component is responsible for finishing the payload on the stack and should not return one as output.
Payloads are typed by format (EXE, DLL, etc.) and architecture (x86, x64, etc.). At buildtime, the input and output types of each component are validated against the input and output types of its neighbors in the stack.