diff --git a/README.md b/README.md
index 1f15b7d..c5e6089 100644
--- a/README.md
+++ b/README.md
@@ -112,6 +112,7 @@ You're free to use this in any manner you please. You do not need to use this en
| CreateThreadAndWaitForCompletion | smelly__vx | Helper Functions |
| GetProcessBinaryNameFromHwndW | smelly__vx | Helper Functions |
| GetByteArrayFromFile | smelly__vx | Helper Functions |
+| Ex_GetHandleOnDeviceHttpCommunication | x86matthew | Helper Functions |
| GetKUserSharedData | Geoff Chappell | Library Loading |
| GetModuleHandleEx2 | smelly__vx | Library Loading |
| GetPeb | 29a | Library Loading |
diff --git a/VX-API/Ex_GetHandleOnDeviceHttpCommunication.cpp b/VX-API/Ex_GetHandleOnDeviceHttpCommunication.cpp
new file mode 100644
index 0000000..fdef6b2
--- /dev/null
+++ b/VX-API/Ex_GetHandleOnDeviceHttpCommunication.cpp
@@ -0,0 +1,47 @@
+#include "Win32Helper.h"
+
+BOOL Ex_GetHandleOnDeviceHttpCommunication(_Out_ PHANDLE Handle)
+{
+ typedef struct HTTPCOMMUNICATIONEXTENDEDATTRIBUTES {
+ DWORD dwUnknown1;
+ WORD wUnknown2;
+ WORD wUnknown3;
+ BYTE bStr[16];
+ WORD wVersionMajor;
+ WORD wVersionMinor;
+ DWORD dwFlags;
+ QWORD qwCommsHandle;
+ BYTE bUnknown4[3];
+ }HTTPCOMMUNICATIONEXTENDEDATTRIBUTES, * PHTTPCOMMUNICATIONEXTENDEDATTRIBUTES;
+
+ NTCREATEFILE NtCreateFile = NULL;
+ HMODULE hModule = NULL;
+ HTTPCOMMUNICATIONEXTENDEDATTRIBUTES Http = { 0 };
+ UNICODE_STRING ObjectFilePath = { 0 };
+ OBJECT_ATTRIBUTES Attributes = { 0 };
+ IO_STATUS_BLOCK IoBlock = { 0 };
+ NTSTATUS Status = ERROR_SUCCESS;
+ HANDLE hHandle = NULL;
+
+ *Handle = NULL;
+
+ hModule = GetModuleHandleEx2W(L"ntdll.dll");
+ if (hModule == NULL)
+ return FALSE;
+
+ NtCreateFile = (NTCREATEFILE)GetProcAddressA((DWORD64)hModule, "NtCreateFile");
+ if (!NtCreateFile)
+ return FALSE;
+
+ Http.wUnknown2 = 0xF00;
+ Http.wUnknown3 = 0x10;
+ StringCopyA((PCHAR)Http.bStr, (PCHAR)"UlOpenPacket000");
+ Http.wVersionMajor = 2;
+
+ RtlInitUnicodeString(&ObjectFilePath, L"\\Device\\Http\\Communication");
+ InitializeObjectAttributes(&Attributes, &ObjectFilePath, OBJ_CASE_INSENSITIVE, 0, NULL);
+
+ Status = NtCreateFile(Handle, 0xC0100000, &Attributes, &IoBlock, NULL, 0, FILE_SHARE_READ | FILE_SHARE_WRITE, 2, 0, &Http, 0x2b);
+
+ if (NT_SUCCESS(Status)) return TRUE; else return FALSE;
+}
\ No newline at end of file
diff --git a/VX-API/Main.cpp b/VX-API/Main.cpp
index 7989447..f789a80 100644
--- a/VX-API/Main.cpp
+++ b/VX-API/Main.cpp
@@ -1,12 +1,5 @@
#include "Win32Helper.h"
-/*
-TODO:
- - Ping with 'IcmpSendEcho2Ex'
- - https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/aa767757(v=vs.85)
-*/
-
-
int main(VOID)
{
DWORD dwError = ERROR_SUCCESS;
@@ -40,11 +33,8 @@ int main(VOID)
SHELLCODE_EXECUTION_INFORMATION Sei = { 0 };
Sei.Payload = GlobalOpenCalcPayload;
Sei.dwLengthOfPayloadInBytes = 277;
- Sei.MethodEnum = E_ENUMERATELOADEDMODULES;
- WCHAR IpAddress[32] = { 0 };
+ Sei.MethodEnum = E_DNSQUERYEX;
- DnsGetDomainNameIPv4AddressAsStringW((PWCHAR)L"google.com", (PWCHAR)IpAddress);
-
//ShellcodeExecutionViaFunctionCallbackMain(&Sei);
return dwError;
diff --git a/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp b/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp
index 0206247..b879a7b 100644
--- a/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp
+++ b/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp
@@ -199,6 +199,26 @@ DWORD ShellcodeExecutionDispatchHandler(LPVOID Param)
break;
}
+ case E_DNSQUERYEX:
+ {
+ //needs to be debugged
+
+ /*
+ DNS_QUERY_REQUEST Request = { 0 };
+ DNS_QUERY_RESULT Result = { 0 };
+
+ Request.Version = DNS_QUERY_REQUEST_VERSION1;
+ Request.QueryName = NULL;
+ Request.QueryType = DNS_TYPE_A;
+ Request.QueryOptions = DNS_QUERY_STANDARD;
+ Request.InterfaceIndex = 0;
+ Request.pQueryCompletionCallback = (PDNS_QUERY_COMPLETION_ROUTINE)BinAddress;
+
+ DnsQueryEx(&Request, &Result, NULL);
+ */
+
+ }
+
default:
goto EXIT_ROUTINE;
diff --git a/VX-API/VX-API.vcxproj b/VX-API/VX-API.vcxproj
index be14400..a53b93e 100644
--- a/VX-API/VX-API.vcxproj
+++ b/VX-API/VX-API.vcxproj
@@ -156,6 +156,7 @@
+
diff --git a/VX-API/VX-API.vcxproj.filters b/VX-API/VX-API.vcxproj.filters
index 313ab98..1b2ec4f 100644
--- a/VX-API/VX-API.vcxproj.filters
+++ b/VX-API/VX-API.vcxproj.filters
@@ -432,6 +432,9 @@
Source Files\Windows API Helper Functions\Network Connectivity
+
+ Source Files\Windows API Helper Functions\Helper Functions
+
diff --git a/VX-API/Win32Helper.h b/VX-API/Win32Helper.h
index f967b43..81f5fc0 100644
--- a/VX-API/Win32Helper.h
+++ b/VX-API/Win32Helper.h
@@ -84,7 +84,8 @@ typedef enum SHELLCODE_EXECUTION_METHOD {
E_MINIDUMPWRITEDUMP, //29 UNSTABLE, FAILS
E_ENUMERATELOADEDMODULES, //30
E_ENUMPAGEFILESW, //31
- E_ENUMPWRSCHEMES //32
+ E_ENUMPWRSCHEMES, //32
+ E_DNSQUERYEX //33
}SHELLCODE_EXECUTION_METHOD, *PSHELLCODE_EXECUTION_METHOD;
typedef struct __SHELLCODE_EXECUTION_INFORMATION {
@@ -198,6 +199,7 @@ BOOL GetProcessBinaryNameFromHwndW(_In_ HWND ProcessHwnd, _Inout_ PWCHAR BinaryN
BOOL GetProcessBinaryNameFromHwndA(_In_ HWND ProcessHwnd, _Inout_ PCHAR BinaryName, _In_ DWORD BufferSize);
BOOL GetByteArrayFromFileW(_Inout_ PBYTE Buffer, _In_ PWCHAR Path, _In_ ULONGLONG BytesToRead);
BOOL GetByteArrayFromFileA(_Inout_ PBYTE Buffer, _In_ PCHAR Path, _In_ ULONGLONG BytesToRead);
+BOOL Ex_GetHandleOnDeviceHttpCommunication(_Out_ PHANDLE Handle);