Scribd
Upload
67 views

GH Module Null v2 0 UserGuide

The document provides information about the NULL module for the Grasshopper framework. The NULL module lays down and executes a payload executable on a target system without providing persistence. It will run the payload once and exit without cleaning up the payload file. The module documentation describes its configuration options, usage, and the XML format used to record module details in the Grasshopper receipt.

Uploaded by

Lantz Hastings
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
67 views

GH Module Null v2 0 UserGuide

The document provides information about the NULL module for the Grasshopper framework. The NULL module lays down and executes a payload executable on a target system without providing persistence. It will run the payload once and exit without cleaning up the payload file. The module documentation describes its configuration options, usage, and the XML format used to record module details in the Grasshopper receipt.

Uploaded by

Lantz Hastings
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 5

SECRET//ORCON//NOFORN

Grasshopper Module Guide -


NULL v2.0
December 2013

1OVERVIEW............................................................................................3
2INSTALLATION......................................................................................3
2.1CONFIGURATION..................................................................................................... 3
3PAYLOAD EXECUTION............................................................................3
3.1RUN ONCE............................................................................................................ 3
4FOOTPRINT..........................................................................................3
5RECEIPT XML FORMAT...........................................................................3
5.1XML EXAMPLE...................................................................................................... 3
5.2FIELD DEFINITIONS................................................................................................. 4

CL BY: 2355679
CL REASON: Section
1.5(c),(e)
DECL ON: 20370522
DRV FRM: COL 6-03
SECRET//ORCON//NOFORN
SECRET//ORCON//NOFORN

2
SECRET//ORCON//NOFORN
SECRET//ORCON//NOFORN

1 Overview
NULL is a module that lays down and executes a payload. When a payload is
chosento use this module, NULL will drop the payload to disk, execute it, and exit
immediately. Note that the payload is not deleted.
As of version 2.0, NULL can optionally also lay down (but not execute) an arbitrary
number of other user provided files.
This module is meant to be used with either one-shot tools (e.g., a survey tool) or
with payloads that provide their own persistence separate from Grasshopper,
allowing existing tools to make use of the Grasshopper Rule Engine and payload
obfuscation.
NULL supports 32- and 64-bit EXE payloads only.

2 Installation
NULL will deploy and execute an EXE payload at a user-specified location on the
target filesystem. NULL does not provide any soft persistence, nor will it delete the
payload after execution.

2.1 Configuration
The following fields are configured at build time to specify NULL's installation
behavior.
Defaul Description
Field
t
Payload Path None Path to Payload EXE on target started by NULL
If the path does not exist, it is created.
Additional Files None Local and remote paths for any desired additional files.

3 Payload Execution
The payload is executed once as a normal process at the privilege level of the
Grasshopper process. All additional files are dropped before the payload is dropped.
If any file is not able to be dropped for any reason, all dropped files will be securely
deleted and the payload will not be executed.
The NULL module does not need to uninstall; it does not leave any stubs and does
notprovide any persistence. The payload is responsible for removing itself from the
target.

3.1 Run Once


The NULL module implements the 'run_once' interface, indicating that the payload
will be executed one and only one time.
Any payload using this module must also be designated as using the 'run_once'
interface.

3
SECRET//ORCON//NOFORN
SECRET//ORCON//NOFORN

4 Footprint
The NULL module writes an unobfuscatedpayload to the target filesystem. The path
is specified by the user at build time. This file will not be deleted by Grasshopper.
The process of the payload executable is visible in the Task Manager during
execution.

5 Receipt XML Format


NULL's configuration is recorded in the Grasshopper receipt at build time under
build.xml. An example and description of the xml format is provided below.

5.1 XML Example


<PersistModule>
<UUID>9d03da02ab3a47d7bd28c9a776ba9806</UUID>
<Null>
<PayloadPath>C:\Target\payload.exe</PayloadPath>
</Null>
</PersistModule>

5.2 Field Definitions


UUID
The universally unique identifier for the module variant used in the build.
Null
The configuration information used by the NULL module.
PayloadPath
The path to the payload on the target deployed by NULL.

Appendix A:

4
SECRET//ORCON//NOFORN
SECRET//ORCON//NOFORN

Appendix B: Change Log


Authorit
Date Change Description
y
05/2012 Document Initialization 235567
9
09/2012 Update for Grasshopper v1.0 Phase 2 Delivery 235567
9
11/2012 Update for Grasshopper v1.0.1 Delivery 235567
9

5
SECRET//ORCON//NOFORN

You might also like