Extension Purpose

The purpose of this VScode Extension is to be a simple proof-of-concept for initial access vectors via public Marketplace extensions. While no persistent remote connections are established, this POC showcases the ability to execute Win32 API calls (e.g., MessageBoxA()) via a bundled C++ .node PE).

Under-the-Hood

Upon loading the extension:

• A bundled C++ PE titled addon.node is downloaded to the host.
• The JavaScript extension extension.js loads the PE.
• The PE then executes MessageBoxA() from User32.dll.
• Finally, a message box appears with the title Proof-of-Concept and content Goodbye World: Next Generation.

This is not intended to be an advanced or stealthy POC.

Disclaimer

I DO NOT RECOMMEND INSTALLING THIS EXTENSION. THIS IS FOR SECURITY RESEARCH PURPOSES.