Extension Purpose

The purpose of this VScode Extension is to be a simple proof-of-concept for initial access vectors via public Marketplace extensions. While no persistent remote connections are established, this POC showcases the ability to execute Win32 API calls (e.g., MessageBoxA()) via a remote PowerShell runner.

Under-the-Hood

Upon loading the extension:

• A powershell.exe child process is created via child_process.spawn().
• The PowerShell process downloads and executes PowerShell code hosted on a remote web server.
• The downloaded code loads MessageBoxA() from User32.dll into the PowerShell session.
• Finally, PowerShell launches a message box with the title Proof-of-Concept and content Goodbye World.

This is not intended to be an advanced or stealthy POC.

Disclaimer

I DO NOT RECOMMEND INSTALLING THIS EXTENSION. THIS IS FOR SECURITY RESEARCH PURPOSES.