Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Payload Deployment
SECRET//NOFORN
Stash Repository: Payload Deployment Library
Interface Description:
The interface for the Payload Deployment Library specifies an execute function be written. The prototype is as follows:
virtual PayloadErr execute(LPBYTE payload, DWORD payloadSize, LPVOID params, DWORD paramsSize, LPHANDLE returnHandle);payload: pointer to an array of BYTEs containing the module to be deployed
payloadSize: size, in bytes, of the payload
params: pointer to struct containing the module's arguments
paramsSize: size, in bytes, of the params struct
returnHandle: pointer to HANDLE of the loaded module. (not always used)
Library Conventions: Describe any and all conventions submissions should adhere to for this library. Applying a naming convention can help with the organization of the library.
Payload Deployment Member List:
Load Library From Disk - Class Name: LoadLibraryFromDisk
Load EXE From Disk - Class Name:LoadExeFromDisk
Example of technique/class in Survey Library: Get User Name(Link to Anchor #GetUserNameWinApi) - Class Name: GetUsersName_WinApi
Error Code Descriptions: List error codes with descriptions. Use either a bulleted list or the code block macro. Remember, error codes must be compatible with the SUCCEEDED() and FAILED() macros.
- Error Codes List
Code Sample Using The Library Interface:
Get User Name Windows API:
Error Codes: Specific error codes for the class/technique
PSP/OS Issues: List all known issues the technique has with OSs or PSPs
List Of Tools Using This Code: List all tools utilizing the code
Stash Repository/Knowledge Base Article: Link to code in the stash repository or a knowledge base article containing the code
SECRET//NOFORN