ZheTian Powerful remote load and execute ShellCode tool

Related tags

Network ZheTian
Overview

my-logo.png

ZheTian

ZheTian Powerful remote load and execute ShellCode tool

免杀shellcode加载框架

命令详解

-u:从远程服务器加载base64混淆后的字节码。 -r:从本地文件内读。 -s:读取无修改的原始文件,只能从本地加载

-o:参数为tru自动向启动项添加自启模块。

从http远程服务器或本地文件内读取shellcode字节码需遵循以下格式: java类型需去除0x,c or python 类型需去除\x

示例:

字节码类型:

原始python代码:

buf = "\xfc\x48\x83\xe4\xf0\xe8\xc8\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b"....

修改成:

fc4883e4f0e8c8000000415141......

Java、c、ruby等同理。只需将字节数组里的16进制代码提取出来即可。注意需将得到的字符串使用base64转码。

原文件读取类型:

使用 ZheTian -h 命令可查看支持的语言。原文件无需使用base64转码,但是不支持放在远程服务器,只能通过本地 -s 命令读取,如: ZheTian -s C:/Windows/Temp/payload.java

编译:

go build -ldflags "-w -s" main.go

可以使用

go build -ldflags "-w -s -H windowsgui" main.go

实现无窗口运行。但是360偶尔会识别位恶意程序。如果目标机器无安全设备,可以尝试使用此命令打包,然后使用参数: -o true 实现写入启动项功能。

my-logo.png

注意:打包的时候需指定是64位还是32位。默认会根据系统自动选择。 而在生成payload shellcode的时候也需要选择正确的位数,否则会加载失败。使用code字节码加载时一定要使用base64加密,否则无法解析!!

后端使用了base64对读取到的字节码进行了转码,为了减小流量特征。AES/DES的加密模式太多在未标明的情况下可能导致无法解密失败,故此暂不考虑使用

Releases(v2)
Owner
一曲成殇
hello world
一曲成殇
red-tldr is a lightweight text search tool, which is used to help red team staff quickly find the commands and key points they want to execute, so it is more suitable for use by red team personnel with certain experience.

Red Team TL;DR English | 中文简体 What is Red Team TL;DR ? red-tldr is a lightweight text search tool, which is used to help red team staff quickly find t

倾旋 159 Jun 12, 2022
Go Library to Execute Commands Over SSH at Scale

vSSH Go library to handle tens of thousands SSH connections and execute the command(s) with higher-level API for building network device / server auto

Yahoo 811 Jun 22, 2022
🤘 The native golang ssh client to execute your commands over ssh connection. 🚀🚀

Golang SSH Client. Fast and easy golang ssh client module. Goph is a lightweight Go SSH client focusing on simplicity! Installation ❘ Features ❘ Usage

Mohamed El Bahja 1.1k Jun 26, 2022
Command-line tool and library for Windows remote command execution in Go

WinRM for Go Note: if you're looking for the winrm command-line tool, this has been splitted from this project and is available at winrm-cli This is a

Brice Figureau 365 Jun 19, 2022
A major platform Remote Access Terminal Tool based by Blockchain/P2P.

NGLite A major platform Remote Access Terminal Tool based by Blockchain/P2P. No public IP address required.More anonymity Example Detection Warning!!!

null 258 Jun 26, 2022
A remote access tool & CNC

⚠️ ⚠️ Disclaimer just use this with good intentions ⚠️ ⚠️ An useless rat (remote acces tool in develop) web client you want to use it? download pairat

pai 15 May 5, 2022
A remote access tool & CNC

⚠️ ⚠️ Disclaimer just use this with good intentions ⚠️ ⚠️ An useless rat (remote acces tool in develop) web client you want to use it? download pairat

pai 15 May 5, 2022
Simple tool for connecting to remote hosts via ssh written on GO.

sshmenu is a simple tool for connecting to remote hosts via ssh written on GO. Great if you have trouble remembering IP addresses, hostnames, usernames or path to a key file.

Maxim Zanoga 2 Mar 24, 2022
Laptop Booking Application in Golang and gRPC, load-balancing with NGINX, and fully compatible with HTTPS OpenAPI v3

Laptop Booking Application in Golang and gRPC Goals GitHub CI & Coverage Badge Serialize protobuf messages Create laptop unary gRPC Search laptop Serv

Tien La 3 Jun 17, 2022
Simple, fast and scalable golang rpc library for high load

gorpc Simple, fast and scalable golang RPC library for high load and microservices. Gorpc provides the following features useful for highly loaded pro

Aliaksandr Valialkin 651 Jun 20, 2022
High-performance PHP application server, load-balancer and process manager written in Golang

RoadRunner is an open-source (MIT licensed) high-performance PHP application server, load balancer, and process manager. It supports running as a serv

Spiral Scout 6.5k Jun 30, 2022
Generate HTTP load and plot the results in real-time

ali A load testing tool capable of performing real-time analysis, inspired by vegeta and jplot. ali comes with an embedded terminal-based UI where you

Ryo Nakao 3.2k Jun 25, 2022
gobetween - modern & minimalistic load balancer and reverse-proxy for the ☁️ Cloud era.

gobetween - modern & minimalistic load balancer and reverse-proxy for the ☁️ Cloud era. Current status: Maintenance mode, accepting PRs. Currently in

Yaroslav Pogrebnyak 1.7k Jun 27, 2022
DNS/DoT to DoH proxy with load-balancing, fail-over and SSL certificate management

dns-proxy Configuration Variable Example Description TLS_DOMAIN my.duckdns.org Domain name without wildcards. Used to create wildcard certificate and

Dimitri Herzog 3 Nov 23, 2021
High-performance PHP application server, load-balancer and process manager written in Golang

RoadRunner is an open-source (MIT licensed) high-performance PHP application server, load balancer, and process manager. It supports running as a serv

Spiral Scout 6.1k Dec 9, 2021
gRPC LRU-cache server and client with load test

gRPC k-v storage with LRU-cache server & client + load test. Specify LRU-cache capacity: server/cmd/app.go -> StorageCapacity go build ./server/cmd/*

Eldar Mamedov 0 Dec 26, 2021
Simple, yet powerful Adcell go client to import data feeds into you projects.

adcell-go Simple, yet powerful Adcell go client to import data feeds into you projects. Explore the docs » View Demo · Report Bug · Request Feature Ta

Matthias Bruns 0 Oct 31, 2021
Powerful golang network framework, supporting FFAX Protocol

X.NET framework Install $ go get github.com/RealFax/XNET This is a high-performance network framework, currently only supports tcp and FFAX protocol U

Realfax Messenger 0 Nov 19, 2021