235 matches found
CVE-2024-26229-BOF
CVE-2024-26229 BOF Beacon Object File implementation of CVE-2024-26229 — Windows CSC driver local privilege escalation via DKOM token theft. Based on RalfHacker/CVE-2024-26229-exploit, converted to BOF with Dynamic Function Resolution DFR for use with C2 frameworks that support the Cobalt Strike...
PPLFaultDumpBOF
This is a derivative work of https://github.com/gabriellandau/PPLFault. Please view that repo for all of the original research and further information This conversion intentionaly does not modify IOC's of the original tool release. PPLFaultDumpBOF Takes the original PPLFault and the original...
CVE-2023-36874_BOF
CVE-2023-36874 Windows Error Reporting LPE BOF Introduction This is a mature and operational CobaltStrike BOF implementation of Filip Dragovic's @filipdragovic CVE-2023-36874 Windows Error Reporting LPE exploit. He did the heavy lifting in terms of creating a working exploit by reversing the...
PPEnum
PPEnum Simple BOF to read the protection level of a process...
cookie-monster
Cookie-Monster-BOF Steal browser cookies for edge, chrome and firefox through a BOF! Cookie Monster BOF will extract the WebKit Master Key and the App Bound Encryption Key for both Edge and Chrome, locate a browser process with a handle to the Cookies and Login Data files, copy the handles and th...
FindObjects-BOF
This repository has been moved to our C2-Tool-Collection repository...
lsawhisper-bof
LSA Whisperer BOF A Cobalt Strike Beacon Object File BOF port of LSA Whisperer — the tool that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory even when PPL and Credential Guard is enabled. Why This Exists...
kernel-mii
Cobalt Strike Beacon Object File foundation for kernel exploitation using CVE-2021-21551. Built by Tijme. Credits to Alex for teaching me! Made possible by Northwave Security Description This is a Cobalt Strike CS Beacon Object File BOF which exploits CVE-2021-21551. It only overwrites the beacon...
Adrenaline
Adrenaline BOF Kit A C2-agnostic collection of Beacon Object Files BOFs for red team and offensive security operations. BOFs are organized by attack chain phase and designed to be small, modular, and automation-friendly for use in reconnaissance, enumeration, and post-exploitation workflows. Tabl...
SharpStartWebclient
SharpStartWebclient Run from an unprivileged session to start the WebClient service and enable that juicy privesc. C port of the Beacon Object File from https://github.com/outflanknl/C2-Tool-Collection/blob/main/BOF/StartWebClient/SOURCE/StartWebClient.c...
Awesome-CobaltStrike
Awesome CobaltStrike Contents 0x00 Introduction 0x01 Articles & Videos 1. Basic Knowledge 2. Crack and Customisation 3. Useful Trick 4. CobaltStrike Hide 5. CobaltStrike Analysis 6. CobaltStrike Video 0x02 C2 Profiles 0x03 BOF 0x04 Aggressor Script 0x05 Related Tools 0x06 Related Resources...
notRDP
notRDP A Havoc C2 plugin that creates an invisible alternate Windows desktop, streams it to a browser-based viewer, and supports full mouse/keyboard interaction like RDP, but invisible to the target user. How It Works 1. Creates a hidden desktop via CreateDesktopW and launches explorer.exe on it ...
RegPwnBOF
RegPwn BOF Cobalt Strike BOF port of the RegPwn exploit by Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. This is a sloppy BOF reimplementation of the original C exploit. All credit for the vulnerability research and exploit goes to Filip Dragovic and MDSec. Blog post :...
eden
Eden Eden loader is a PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate currently a PIC version of the Sleepmask-VS Draugr callgate BOF. The goal of Eden loader is to: Demonstrate the power of using Crystal Palace ...
toastnotify-bof
toastnotify-bof A Beacon Object File BOF for sending Windows toast notifications. Pairs with the blog post for full context and use cases. subcommands getaumid Enumerates AUMIDs Application User Model IDs registered on the system. Use this to find a suitable identity to borrow before sending a...
freeMetsrvLoader
freeMetsrvLoader Fork of freeBokuLoader which targets and frees Metsrv's initial reflective DLL package Usage meterpreter executebof freeMetsrvLoader.x64.o Can be automated with InitialAutoRunScript or AutoRunScript...
CVE-2024-35250-BOF
CVE-2024-35250-BOF Beacon Object File BOF implementation of CVE-2024-35250 for Cobalt Strike. Compiled with Visual Studio. Acknowledgments All credit for the exploit code goes to the original author varwara. Disclaimer I am not responsible for any crimes against humanity or nuclear war that you m...
amd-ryzen-master-driver-v17-exploit
Cobalt Strike Beacon Object File for kernel exploitation using AMD's Ryzen Master Driver version 17. Built by Tijme. Credits to Alex for teaching me! Made possible by Northwave Security Description This is a Cobalt Strike CS Beacon Object File BOF and executable which exploits AMD's Ryzen Master...
Elevate-System-Trusted-BOF
Elevate-System-Trusted-BOF This BOF can be used to elevate the current beacon to SYSTEM and obtain the TrustedInstaller group privilege. The impersonation is done through the SetThreadToken API. Compiling gcc elevatex64.c -c -o elevatex64.o Usage inline-execute C:\elevatex64.o Credit Mr.Un1k0d3r...