免杀之Shell混淆

import base64def base64_encode(data):# 将字符串编码为字节流  encoded_bytes = base64.b64encode(data.encode('utf-8'))# 将字节流解码为字符串encoded_string = encoded_bytes.decode('utf-8')return encoded_stringdef base64_decode(encoded_string):# 将字符串编码为字节流  encoded_bytes = encoded_string.encode('utf-8')# 将字节流解码为字符串decoded_bytes = base64.b64decode(encoded_bytes)# 将字节流解码为字符串decoded_string = decoded_bytes.decode('utf-8')return decoded_string# 测试加密和解密data = "shellcode"encoded_data = base64_encode(data)print("编码后:", encoded_data)decoded_data = base64_decode(encoded_data)print("解码后:", decoded_data)

from Crypto.Cipher import AESfrom Crypto.Util.Padding import pad, unpadfrom Crypto.Random import get_random_bytesdef encrypt(plaintext, key):  # 使用ECB模式  cipher = AES.new(key, AES.MODE_ECB)    ciphertext = cipher.encrypt(pad(plaintext, AES.block_size))  return ciphertextdef decrypt(ciphertext, key):  # 使用ECB模式  cipher = AES.new(key, AES.MODE_ECB)    plaintext = unpad(cipher.decrypt(ciphertext), AES.block_size)  return plaintext# 生成随机密钥key = get_random_bytes(16)# 要加密的明文plaintext = b"shellcode"# 加密ciphertext = encrypt(plaintext, key)print("加密后:", ciphertext)# 解密decrypted_text = decrypt(ciphertext, key)print("解密后:", decrypted_text)

#include <stdio.h>#include <string.h>char shellcode[] = "shellcode";void xor_encrypt_decrypt(size_t shellcodeSize) {    for (int i = 0; i < shellcodeSize; i++)    {        shellcode[i] ^= 0x5b;    }}int main() {    //获取shellcode大小    size_t shellcodeSize = strlen(shellcode);    //第一次异或    xor_encrypt_decrypt(shellcodeSize);    printf("第一次异或后：%sn", shellcode);    //第二次异或，即复原    xor_encrypt_decrypt(shellcodeSize);    printf("第二次异或后：%sn", shellcode);    return 0;}

import codecs#获取win.ini的二进制编码with open("C:Windowswin.ini", 'rb') as file:    content = file.read()new_file = codecs.encode(content, 'hex').decode()#获取shellcode的二进制编码with open("shellcode.bin", 'rb') as file:    shellcode = file.read()new_shellcode = codecs.encode(shellcode, 'hex').decode()#遍历查找对应的位置，并添加到数字list中list = []for a in new_file:    offset = new_file.find(a)    list.append(offset)print(list)

import  uuid#多写几个shellcode，体会一下uuid加密的前提是位数为16的倍数shellcode = b'shellcode,shellcode,shellcode,shellcode' def convertToUUID(shellcode):    #如果shellcode的长度不足16位数，则需要用空字节填充shellcode为16的倍数    if len(shellcode)%16 !=0:        #计算出需要填充空字节的数量        addNullbyte = b"x00" * (16-(len(shellcode)%16))        #拼接需要填充空字节的数量        shellcode += addNullbyte    uuids = []    # 每次取出shellcode的16个字节进行uuid转换    for i in range(0,len(shellcode),16):        uuidString = str(uuid.UUID(bytes_le=shellcode[i:i+16]))        uuids.append(uuidString.replace("'","""))    return uuidsu = convertToUUID(shellcode)print(str(u).replace("'","""))