bof

The swiss army knife of LSASS dumping

Situational Awareness commands implemented using Beacon Object Files

Shoggoth: Asmjit Based Polymorphic Encryptor

A BOF that runs unmanaged PEs inline

Useful C2 techniques and cheat sheets learned from engagements

Automated Hosting Information Hunting Tool - Windows 主机信息自动化狩猎工具

An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.

A COFF loader made in Rust

[ BOF-LAUNCHER ] -> an API for loading, executing and in-memory masking BOFs on Windows and Linux for use in C/Zig/Go/Rust agents/implants. [ Z-BEAC0N ] -> a custom-written stage-1 (aka pre-C2) solution engineered with a small footprint, stealth and modularity in mind.

C2-agnostic BOF collection, categorized by attack chain phase. Designed to be small and modular, allowing for quick execution and automation.

WindowSpy is a Cobalt Strike Beacon Object File meant for automated and targeted user surveillance.

A Go implementation of Cobalt Strike style BOF/COFF loaders.

Library of BOFs to interact with SQL servers

A compiled language for Windows position-independent x86-64 shellcode and Beacon Object Files.

Cobalt Strike Beacon Object File for bypassing UAC via the CMSTPLUA COM interface.

Dumping SAM / SECURITY / SYSTEM registry hives with a Beacon Object File

Take a screenshot without injection for Cobalt Strike

Cobalt Strike BOF that identifies Attack Surface Reduction (ASR) rules, actions, and exclusion locations

Cobalt Strike (CS) Beacon Object File (BOF) for kernel exploitation using AMD's Ryzen Master Driver (version 17).

Manual Map DLL injection implemented with Cobalt Strike's Beacon Object Files.