Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Create Process Via ShellExecute (ShellExecute_CRS - Chorus)
SECRET//NOFORN
OSB Library: Payload Deployment
Module Name: ShellExecute_CRS - Chorus
Module Description: Describe how the technique works. All the cool things it does. Describe how cool the module writer is, etc.
PSP/OS Issues: PSPs should be tested on a per tool basis.
('excerpt' missing)
Sharing Level: Liaison (well known technique)
Technique Origin: Internet/open-source (well-defined Windows APIApplication Programming Interface)
Notes: Any information that could be useful to anyone maintaining the code or using the code. i.e. This module uses Alternate Data Streams which are only available on NTFSNT filesystem (Windows) volumes.
Module Specific Structures:
struct PARAM_CRS
{
WCHAR *wcArgs; //The arguments to the executable being executed
DWORD dwAttribs; //The attributes of the target payload on disk
WCHAR *wcTarget; //The target path of the executable to drop to disk
};
Example Code:
HANDLE hHandle = NULL;
IPayload *myPayload = new ShellExecute_CRS();
PARAM_CRS params;
params.dwAttribs = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM;
params.wcTarget = L"C:\\Test Folder\\MyTest.exe";
params.wcArgs = L"1 2 3";
IPayload::PayloadErr pErr = myPayload->execute(improvedDummy, sizeof(improvedDummy), ¶ms, sizeof(params), &hHandle);
SECRET//NOFORN