Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #3375506
Grasshopper Design
Note: Grasshopper is currently being updated for v2.0. This page documents the working v2.0 design. As such, it is subject to change at any time.
Background
Grasshopper is a modular tool used to install software IOInformation Operations tools on targets running Microsoft Windows operating systems. Grasshopper allows tools to be installed using a variety of persistence mechanisms and modified using a variety of extensions (like encryption). Installers may be configured with rules that will be evaluated on target to determine whether to conduct an install.
Overview
A Grasshopper contains one or more installers. An installer is a stack of one or more installer components. Grasshopper invokes each component of the stack in series to operate on a payload. The ultimate purpose of an installer is to persist a payload.
Grasshopper will optionally evaluate rules to determine whether to execute an installation. Rules may be set on each installer and/or globally.
Definitions
Installer
Installers encapsulate the process used to install a payload on a target. They are constructed from one or more components that each contribute to the installation process.
An installer may have an associated rule that will be evaluated before execution.
Component
Components form the functional portions of an installer. Components may be used to introduce payloads to the installer stack, modify a payload in the stack, or install a payload on a target. A component script is used at build time to generate a configuration that stores component data specific to an installler. A Grasshopper installer executes a component module at run time to perform some operation on the payload. The module is provided the configuration generated by the script.
Components may be independently developed and added to a Grasshopper system.
Script
A component script is a Python package that interfaces with the Grasshopper builder.
Configuration
A component configuration is a data store provided to the component to save information necessary to execute an installation step. The configuration is generated by the script at buildtime and provided to the module at runtime. A configuration is generated for each use of a component.
The format of the configuration data is component-specific.
Module
A module is a Windows DLLDynamic Link Library that provides runtime functionality for an installer component. At runtime, modules are provided a configuration and, optionally, an input payload from the previous component. Modules may return an output payload which will be passed to the next component.
The component must provide modules for each Grasshopper architecture.
Payload
Payloads are the tools that an installer is meant to install on a target. A payload is passed to each installer component in series to perform some component-specific action. The first component is responsible for starting the payload on the installer stack and should not expect one as input. The last component is responsible for finishing the payload on the stack and should not return one as output.
Payloads are typed by format (EXE, DLL, etc.) and architecture (x86, x64, etc.). At buildtime, the input and output types of each component are validated against the input and output types of its neighbors in the stack.
Interfaces
Component Modules
The component module interface requires that the module DLLDynamic Link Library expose functions that perform a set of procedures.
Install Procedure
The component install procedure is called by Grasshopper during the execution of a configured installer.
typedef bool (__stdcall *InstallProcedure)(void* config, unsigned long config_size, void* input_payload, unsigned long input_payload_size, void** output_payload, unsigned long* output_payload_size);
The install procedure takes the following arguments:
config |
- pointer to the configuration data associated with the component |
config_size |
- size of the configuration data in bytes |
input_payload |
- pointer to the input payload |
input_payload_size |
- size of the input payload in bytes |
output_payload |
- pointer to pointer to store output payload The input payload may be modified in place and the output payload pointer set to the input payload pointer. If more space is needed for the output, the module is responsible for allocating this buffer. The memory should be allocated as read-write. |
output_payload_size |
- pointer to size of the output payload in bytes |
The uninstall procedure returns a boolean indicating whether the install procedure was completed successfully. If a component returns TRUE, the installation continues. If a component returns FALSE, Grasshopper will call the uninstall procedure on each component module that was called successfully in reverse order.
Uninstall Procedure
The component uninstall procedure is called by Grasshopper when trying to reverse an installer.
typedef bool _(_stdcall *UninstallProcedure) (void* config, unsigned long config_size);
The uninstall procedure takes the following arguments:
config |
- pointer to the configuration data associated with the component |
config_size |
- size of the configuration data in bytes |
The uninstall procedure returns a boolean indicating whether the uninstall procedure was completed successfully. The uninstallation continues regardless of the return value.
Component Scripts
Payload Type
The component scripts are responsible for reporting what types of payloads it can accept as input and what type of payload it will output for any given input type.
Grasshopper and component scripts describe these payload types using PayloadType objects. The PayloadType class is defined in grasshopper.payload.
Component Builder
The component scripts must provide a Component subclass that implements methods required to build their component module and configuration.
The Component class is defined in grasshopper.component.