lsawhisper-bof

LSA Whisperer BOF A Cobalt Strike Beacon Object File BOF port of LSA Whisperer — the tool that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory even when PPL and Credential Guard is enabled. Why This Exists...

keelog-bof

KeeLog Async BOF that captures the KeePass master password by monitoring for the unlock prompt window. When a locked KeePass database is detected, a low-level keyboard hook is installed and keystrokes are captured until the prompt window disappears by being submitted, cancelled or closeed. The...

Cobaltstrike_BOFLoader

CobaltstrikeBOFLoader This is an open source port/reimplementation of the Cobalt Strike BOF Loader as is. For the most part, everything is done as in the original Beacon + Teamserver in Cobalt Strike. This includes shortcomings that are resolved in other open source COFF loaders such as the...

Adrenaline

Adrenaline BOF Kit A C2-agnostic collection of Beacon Object Files BOFs for red team and offensive security operations. BOFs are organized by attack chain phase and designed to be small, modular, and automation-friendly for use in reconnaissance, enumeration, and post-exploitation workflows. Tabl...

CVE-2024-26229-BOF

CVE-2024-26229 Beacon Object Files Beacon Object File BOF implementations from NVISO of CVE-2024-26229 for Cobalt Strike and BruteRatel. Compile with: root@kitploit: gcc -c CVE-2024-26229-bof.c -o CVE-2024-26229-bof.o This vulnerability was patched on April 9th, 2024. See...

DropSpawn_BOF

DropSpawn Introducción DropSpawn es un BOF de CobaltStrike utilizado para lanzar Beacons adicionales mediante un método relativamente desconocido de secuestro de DLL. Funciona x86-x86, x64-x64, y x86-x64/viceversa. Úsalo como alternativa a la inyección de procesos. Los ejecutables de Windows...

dumpguard_bof

DumpGuard BOF Beacon Object File BOF port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems. About This Project This repository contains a Beacon Object File BOF implementation of DumpGuard, ported from the original C/.NET implementation to pure C for use with Havo...

HiddenDesktop

Escritorio Oculto BOF Escritorio Oculto a menudo denominado HVNC es una herramienta que permite a los operadores interactuar con una sesión de escritorio remoto sin que el usuario lo sepa. El protocolo VNC no está involucrado, pero el resultado es una experiencia similar. Esta implementación BOF ...

pybof

PyBOF Run Beacon Object files through python in-memory loading and execution of BOFs PyBOF enables Python3 to load Beacon Object Files via bytes and execute a target BOF function in a Python interpreter Basic Usage Run a simple BOF with no required arguments root@kitploit: data =...

ASPX_WebShell_COFFLoader

ASPX Web Shell with COFF Loader Based on TrustedSec's CSCOFFLoader Description This ASPX web shell enables execution of Beacon Object Files BOFs on a target server using a semi-interactive Python client. It leverages a COFF loader implementation derived from TrustedSec’s CSCOFFLoader. This projec...

tgt-monitor-bof

Kerberos TGT Monitoring & Auto-Renewal This repository contains two Async Beacon Object Files BOF. The first, tgt-monitor, monitors the system for Kerberos logon events and wakes up the agent whenever a new Kerberos TGT is captured. Similar to Rubeus' monitor command, this BOF is running...

RegPwnBOF

RegPwn BOF Cobalt Strike BOF port of the RegPwn exploit by Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. This is a sloppy BOF reimplementation of the original C exploit. All credit for the vulnerability research and exploit goes to Filip Dragovic and MDSec. Blog post :...

CVE-2026-49176_BOF

CVE-2026-49176 Cobalt Strike BOF Cobalt Strike Beacon Object File BOF for local privilege escalation via Windows WalletService CVE-2026-49176 , fixed July 2026. From a medium-integrity standard user Beacon, this tool stages a malicious Wallet ESE database, redirects Documents, triggers...

toastnotify-bof

toastnotify-bof A Beacon Object File BOF for sending Windows toast notifications. Pairs with the blog post for full context and use cases. subcommands getaumid Enumerates AUMIDs Application User Model IDs registered on the system. Use this to find a suitable identity to borrow before sending a...

CVE-2023-36874_BOF

CVE-2023-36874 Windows Error Reporting LPE BOF Introduction This is a mature and operational CobaltStrike BOF implementation of Filip Dragovic's @filipdragovic CVE-2023-36874 Windows Error Reporting LPE exploit. He did the heavy lifting in terms of creating a working exploit by reversing the...

CVE-2024-35250-BOF

CVE-2024-35250-BOF Beacon Object File BOF implementation of CVE-2024-35250 for Cobalt Strike. Compiled with Visual Studio. Acknowledgments All credit for the exploit code goes to the original author varwara. Disclaimer I am not responsible for any crimes against humanity or nuclear war that you m...

Kerbeus-BOF

Kerbeus-BOF Archivos de Objeto Beacon para abuso de Kerberos. Esta es una implementación de algunas características importantes del proyecto Rubeus, escrita en C. El proyecto incluye integración con los frameworks C2 Cobalt Strike, Havoc, AdaptixC2 y Outflank C2. Solicitudes y renovaciones de...

cookie-monster

Cookie-Monster-BOF ¡Roba cookies de navegadores para Edge, Chrome y Firefox a través de un BOF! Cookie Monster BOF extraerá la WebKit Master Key y la App Bound Encryption Key tanto para Edge como para Chrome, localizará un proceso del navegador con un manejador de los archivos Cookies y Login Dat...

eden

Eden Eden loader is a PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate currently a PIC version of the Sleepmask-VS Draugr callgate BOF. The goal of Eden loader is to: Demonstrate the power of using Crystal Palace ...

RawHive

RawHive RawHive is a Cobalt Strike BOF for pulling selected Windows registry hives directly from a raw NTFS volume. It skips the normal file APIs, walks NTFS metadata to find the target file records, and copies the bytes straight from disk. It currently looks for: C:\Windows\System32\config\SAM...