Home

Awesome

BOF Template

This repository is meant to host the core files needed to create a Beacon Object File for use with Cobalt Strike.

A Beacon Object File (BOF) is a compiled C program, written to a convention that allows it to execute within a Beacon process and use internal Beacon APIs. BOFs are a way to rapidly extend the Beacon agent with new post-exploitation features.

beacon.h

beacon.h contains definitions for several internal Beacon APIs. The function go is similar to main in any other C program. It's the function that's called by inline-execute and arguments are passed to it. BeaconOutput is an internal Beacon API to send output to the operator.

examples

This directory contains examples BOFs. The directory contains the following:

cs_beacon_info

Directory containing the cs_beacon_info BOF which demonstrates BeaconInformation API introduced in 4.9

Use:

cs_format_example

Directory containing the cs_format_example BOF from the documentation 'Formatting BOF Output'

Use:

cs_key_value

Directory containing the cs_key_value BOF which demonstrates the Key/Value store APIs introduced in 4.9

Use:

   cs_key_value --key default --state init
   cs_key_value --key default --state continue
   cs_key_value --key default --state finish

cs_read_virtual_memory

Directory containing the cs_read_virtual_memory BOF from the documentation 'Formatting BOF Output'

Use:

demo

Directory containing the example demo BOF which demonstrates items that are now supported in Cobalt Strike version 4.7

Use:

hello

Directory containing the example hello world BOF from the documentation.

Use:

helloWorld

Directory containing the example helloWorld BOF from the documentation.

Use:

Examples:

  inline-execute /base/path/examples/helloWorld/hello.x64.o these are args
  inline-execute /base/path/examples/helloWorld/hello.x86.o these are args

tests

The tests directory contains examples for using the internal Beacon APIs. The directory contains the following:

How to execute the tests:

  1. Build the object files with the build.sh script in the tests directory.
  2. Start a team server and client
  3. Load the bof_test_runner.cna script from the tests directory.
  4. Generate and start a beacon on a test system.
  5. In the beacon console execute: run_boff_tests "<user_string>" <numeric> "<numeric_string>"

where:

BOF Documentation

Community developed BOFs