Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
VBR Persistence
Overview
The Volume Boot Record (also known as the Partition Boot Record) contains code called Initial Program Loader (IPLInitial Program Loader). This code is responsible for eventually launching NTLDR/WINLOAD for Windows OSOperating System partitions. The code here is 16/32 bit assembly code (asm) which is running in a very limited context, generally having only BIOSBasic Input/Output System interrupts (INT) available.
Running code here, however, can give the attacker the ability to hook Windows boot/kernel code as it is loaded, before features like PatchGuard come online. If done correctly, custom IPLInitial Program Loader code can maintain persistence throughout the boot process of a Windows partition. In the example used by StolenGoods 2, the end result is a stub driver that is loaded during the boot process, which can then perform tasks such as launching payload DLLs and drivers. The stub driver does not have to be signed if the IPLInitial Program Loader persistence code is done correctly.
Sample code/Explanation
Stolen Goods 2.0 contains the VBR IPLInitial Program Loader components used to maintain persistence throughout the boot process. The VBR IPLInitial Program Loader components were taken from Carberp, a Russian organized crime bootkit which had its source code published online. The components work on Windows XPWindows operating system (Version) (32 bit) and Windows 7 (32 and 64 bit). While Carberp advertised compatibility with Win 8, testing has shown that this is not the case currently.