All Projects → iframepm → FuckAV

iframepm / FuckAV

Licence: other
python写的一款免杀工具(shellcode加载器)BypassAV,国内杀软全过(windows denfend)2021-9-13

Programming Languages

python
139335 projects - #7 most used programming language

Projects that are alternatives of or similar to FuckAV

HellgateLoader CSharp
Load shellcode via HELLGATE, Rewrite hellgate with .net framework for learning purpose.
Stars: ✭ 73 (-71.26%)
Mutual labels:  bypass-antivirus, shellcode-loader
NewNtdllBypassInlineHook CSharp
Load a fresh new copy of ntdll.dll via file mapping to bypass API inline hook.
Stars: ✭ 35 (-86.22%)
Mutual labels:  bypass-antivirus, shellcode-loader
DInjector
Collection of shellcode injection techniques packed in a D/Invoke weaponized DLL
Stars: ✭ 497 (+95.67%)
Mutual labels:  shellcode-loader
MsfMania
Python AV Evasion Tools
Stars: ✭ 388 (+52.76%)
Mutual labels:  bypass-antivirus
GolangBypassAV
研究利用golang各种姿势bypassAV
Stars: ✭ 530 (+108.66%)
Mutual labels:  bypass-antivirus
URL-obfuscator
Python Program to obfuscate URLs to make Phishing attacks more difficult to detect. Uses Active open redirect list and other URL obfuscation techniques.
Stars: ✭ 101 (-60.24%)
Mutual labels:  bypass-antivirus
ScareCrow-CobaltStrike
Cobalt Strike script for ScareCrow payloads intergration (EDR/AV evasion)
Stars: ✭ 387 (+52.36%)
Mutual labels:  bypass-antivirus
Defeat-Defender-V1.2
Powerful batch script to dismantle complete windows defender protection and even bypass tamper protection ..Disable Windows-Defender Permanently....Hack windows. POC
Stars: ✭ 885 (+248.43%)
Mutual labels:  bypass-antivirus
window-rat
The purpose of this tool is to test the window10 defender protection and also other antivirus protection.
Stars: ✭ 59 (-76.77%)
Mutual labels:  bypass-antivirus
trolo
trolo - an easy to use script for generating Payloads that bypasses antivirus
Stars: ✭ 45 (-82.28%)
Mutual labels:  bypass-antivirus
Go Bypass
Golang Bypass Av Generator template
Stars: ✭ 606 (+138.58%)
Mutual labels:  bypass-antivirus
chameleon
PowerShell Script Obfuscator
Stars: ✭ 319 (+25.59%)
Mutual labels:  bypass-antivirus
DNSWho
transmit cs beacon (shellcode) over self-made dns to avoid anti-kill and AV
Stars: ✭ 47 (-81.5%)
Mutual labels:  bypass-antivirus
Skrull
Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted.
Stars: ✭ 413 (+62.6%)
Mutual labels:  bypass-antivirus
shellcode-loader
Shellcode Loader Engine for Windows
Stars: ✭ 24 (-90.55%)
Mutual labels:  shellcode-loader
DInvoke shellcodeload CSharp
ShellCodeLoader via DInvoke
Stars: ✭ 41 (-83.86%)
Mutual labels:  bypass-antivirus
NativePayload CBT
NativePayload_CallBackTechniques C# Codes (Code Execution via Callback Functions Technique, without CreateThread Native API)
Stars: ✭ 109 (-57.09%)
Mutual labels:  bypass-antivirus
Lscript
The LAZY script will make your life easier, and of course faster.
Stars: ✭ 3,056 (+1103.15%)
Mutual labels:  bypass-antivirus
Crab-Runner
Shellcode runner in Rust
Stars: ✭ 22 (-91.34%)
Mutual labels:  shellcode-loader

FuckAV

中文 English

Travis Travis Travis

农民工写的免杀工具,2021-9-13 1frame [email protected]

更新记录

时间 2021-9-13 版本:1.2

  1. shellcode加载方式由远程加载改为了本地加载,shellcode写死在了exe里面,因为远程加载太麻烦,点开直接上线更方便,现在直接运行shell.exe就能上线
  2. 增加了upx压缩,缩小了exe体积
  3. 自动更新图标文件的md5,防止图标资源成为查杀的特征码,现在不需要每隔一段时间次就替换图标文件
  4. 支持powershell脚本免杀(还没开发的,就这几天弄)
  5. 加载器已经被杀软分析透了,得大改才能活下去,开源之后差不多活了两个月,也还算可以了

时间 2021-9-23 版本:1.3

  1. 去除了upx压缩,压缩率太低,没啥用,画蛇添足
  2. 每次都会重置ico还有py的文件名
  3. 封装了主main依赖库

时间 2021-10-25 版本:2.0

  1. 加入了powershell免杀

温馨提示

使用之前安装一下python库 pip install -r requirement.txt,出现啥依赖库报错,大家自己解决吧,因为这个每个人的环境不一样,解决个依赖库报错相信不是啥难题

  • 脚本采用python3.7编写,Windows环境!!!!!!

  • 采用pyinstaller打包,使用之前请安装pyinstaller

  • 运行之前先确认一下pip库有没有安装

  • 环境实在报错就用fuckav.exe

  • 因为开源了嘛,估计要不了半个月就会被加入360豪华套餐了,但是整个程序够简单,被杀了再去改几个特征码照样又可以免杀半个月,反正我自己用了半个月,一直都是国内杀软全过,保持更新,但是频率比较慢,因 为我只是个没用的安服

  • 不得不说这个脚本确实有很多地方是在造轮子,但是是有意造的轮子,看似造轮子,实则是为了以后方便魔改(说白了就是菜,因为我是一个没用的安服)

  • 因为脚本逻辑实在太过于简单,没啥技术含量,所以大家尽量还是不要把马子上传到云杀箱了吧,为了免杀活更久一点

存活动态

  • 截止到 2021-8-20,360、火绒、Windows denfend、卡巴静态全过
  • 截止到 2021-8-28,360、火绒、Windows denfend、卡巴静态全过 2021-8-28更新
  • 截止到 2021-9-13,360、火绒、Windows denfend、静态全过,无法过360动态查杀(约一分钟之后就会报毒,可以再查杀之前选择进程注入。)
  • 截止到 2021-9-23,360、火绒动静态全过 Windows denfend、卡巴静态全过,更新了一下改了改规则,又能过了....不愧是md5查杀器
  • 截止到 2021-9-26,360、火绒动静态全过 Windows denfend、卡巴静态全过,Windows denfend、卡巴 动态杀
  • 截止到 2021-10-25,360、火绒动静态全过,卡巴,Windows denfend过不了(没有WD环境,懒得测)

VT查杀率:

image

exe:

image

powershell:

image

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].