Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Create Process Using WMI (CreateProcessWMI_TIG - Tiger)
SECRET//NOFORN
OSB Library: Payload Deployment
Module Name: CreateProcessWMI_TIG - Tiger
Module Description: Describe how the technique works. All the cool things it does. Describe how cool the module writer is, etc.
PSP/OS Issues: PSPs should be tested on a per case basis.
('excerpt' missing)
Sharing Level: Unilateral
Technique Origin: In-house module development, internet/open-source technique
Notes: Any information that could be useful to anyone maintaining the code or using the code. i.e. This module uses Alternate Data Streams which are only available on NTFSNT filesystem (Windows) volumes.
Module Specific Structures:
struct PARAM_TIG //action type = 1
{
WCHAR *wcTargetPath; //The target path of the executable to be executed.
WCHAR *wcArgs; //Arguments to be passed to the created process
DWORD dwAttribs; //Attributes of the file on disk
};
Example Code:
LPHANDLE lpHandle = NULL;
IPayload *myPayload = new CreateProcessWMI_TIG();
PARAM_TIG params;
params.dwAttribs = FILE_ATTRIBUTE_NORMAL;
params.wcTargetPath = L"C:\\Test Folder\\MyTest.exe";
params.wcArgs = L"1 2 3";
IPayload::PayloadErr pErr = myPayload->execute(improvedDummy, sizeof(improvedDummy), ¶ms, sizeof(params), lpHandle);
SECRET//NOFORN