Kerbeus-BOF

Kerbeus-BOF Beacon Object Files for Kerberos abuse. This is an implementation of some important features of the Rubeus project, written in C. The project features integration with the C2 frameworks Cobalt Strike, Havoc, AdaptixC2 and Outflank C2. Ticket requests and renewals asktgt The asktgt...

BOF_ExecuteAssembly

BOF Execute-Assembly Beacon Object File for Cobalt Strike that executes .NET assemblies in beacon with evasion techniques. Overview Core Architecture ┌──────────────────────────────────────────────────────────────────────────────┐ │ Cobalt Strike Beacon │ │ Parent Process │...

CVE-2024-26229-BOF

CVE-2024-26229 Beacon Object Files Beacon Object File BOF implementations from NVISO of CVE-2024-26229 for Cobalt Strike and BruteRatel. Compile with: gcc -c CVE-2024-26229-bof.c -o CVE-2024-26229-bof.o This vulnerability was patched on April 9th, 2024. See...

ASPX_WebShell_COFFLoader

ASPX Web Shell with COFF Loader Based on TrustedSec's CSCOFFLoader Description This ASPX web shell enables execution of Beacon Object Files BOFs on a target server using a semi-interactive Python client. It leverages a COFF loader implementation derived from TrustedSec’s CSCOFFLoader. This projec...

cookie-monster

Cookie-Monster-BOF Steal browser cookies for edge, chrome and firefox through a BOF! Cookie Monster BOF will extract the WebKit Master Key and the App Bound Encryption Key for both Edge and Chrome, locate a browser process with a handle to the Cookies and Login Data files, copy the handles and th...

Adrenaline

Adrenaline BOF Kit A C2-agnostic collection of Beacon Object Files BOFs for red team and offensive security operations. BOFs are organized by attack chain phase and designed to be small, modular, and automation-friendly for use in reconnaissance, enumeration, and post-exploitation workflows. Tabl...

KslKatzBof

KslKatzBOF A Beacon Object File BOF in-line LSASS credential extraction from C2 using the KslD.sys BYOVD technique. This project is based on the blog post: https://avantguard.io/blog/erfahrungsbericht-ki-gest%C3%BCtzte-bof-entwicklung-im-red-team Attribution This BOF is based on KslKatz Maximilia...

unhook-bof

This is a Beacon Object File to refresh DLLs and remove their hooks. The code is from Cylance's Universal Unhooking research: https://blogs.blackberry.com/en/2017/02/universal-unhooking-blinding-security-software To use: Load unhook.cna into Cobalt Strike via Cobalt Strike - Script Manager Run...

WindowSpy

WindowSpy 👀 WindowSpy is a Cobalt Strike Beacon Object File meant for targetted user surveillance. The goal of this project was to trigger surveillance capabilities only on certain targets, e.g. browser login pages, confidential documents, vpn logins etc. The purpose was to increase stealth durin...

KDStab

KDStab 6/28/2022 : Microsoft has rolled out a patch that prevents opening a handle to the MsMpEng.exe token, and as such the KillDefender portion of this tool no longer works. Backstab should still work. Not sure the patch ID, may work on older unpatched systems. Verified on Win10 21H2 and Win11...

unhook-bof

This is a Beacon Object File to refresh DLLs and remove their hooks. The code is from Cylance's Universal Unhooking research: https://blogs.blackberry.com/en/2017/02/universal-unhooking-blinding-security-software To use: Load unhook.cna into Cobalt Strike via Cobalt Strike - Script Manager Run...

toastnotify-bof

toastnotify-bof A Beacon Object File BOF for sending Windows toast notifications. Pairs with the blog post for full context and use cases. subcommands getaumid Enumerates AUMIDs Application User Model IDs registered on the system. Use this to find a suitable identity to borrow before sending a...

tgt-monitor-bof

Kerberos TGT Monitoring & Auto-Renewal This repository contains two Async Beacon Object Files BOF. The first, tgt-monitor, monitors the system for Kerberos logon events and wakes up the agent whenever a new Kerberos TGT is captured. Similar to Rubeus' monitor command, this BOF is running...

teams-cookies-bof

teams-cookies-bof Steal cookies for Teams, while running within the ms-teams.exe process. Related post: https://tierzerosecurity.co.nz/2025/11/03/teams-cookies-bof.html Based on: https://blog.randorisec.fr/ms-teams-access-tokens/. This tool is heavily based on the Cookie-Monster-BOF. The BOF will...

dumpguard_bof

DumpGuard BOF Beacon Object File BOF port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems. About This Project This repository contains a Beacon Object File BOF implementation of DumpGuard, ported from the original C/.NET implementation to pure C for use with Havo...

ADSyncDump-BOF

ADSyncDump BOF The ADSyncDump BOF is a port of Dirkjan Mollema's adconnectdump.py / ADSyncDecrypt into a Beacon Object File BOF for use with Cobalt Strike, Sliver and Havoc. !NOTE The tool has been tested on a Windows Server 2019 with Azure AD Connect version 2.2.1.0. The 32 bit version of the BO...

COM-Hunter

COM-Hunter COM Hijacking VOODOO Description COM-Hunter is a COM Hijacking persistence tool. Available in both a .NET version and a BOF variant fully compatible with Cobalt Strike. The following list explains the available modes: Search Mode : Searches for CLSIDs based on LocalServer32,...

cs-token-vault

Token Vault BOF for Cobalt Strike This Beacon Object File BOF creates in-memory storage for stolen/duplicated Windows access tokens allow you to: Hot swap/re-use already stolen tokens without re-duplicating. Store tokens for later use in case of a person log out. Installation 1. Download the late...

rustbof

rustbof This project enables the development of BOFs using Rust with full nostd support. It leverages Rust's safety features and modern tooling while producing small, efficient COFF objects. The framework provides everything needed for BOF development. The build process compiles your code to a...

VeeamDumper-BOF

Veeam Dumper BOF A credential extraction BOF for Veeam Backup and Replication and Veeam One by Stephen Munro and Logan Kroeger from @MWRCyberSec. The BOF needs to be executed in an Admin beacon on either a Veeam One or Veeam Backup and Replication server and supports Cobalt Strike and Outflank C2...