BOF-CobaltStrike - Useful Cobalt Strike Beacon Object Files (BOFs) us

项目说明

CobaltStrike BOF Collections

Useful Cobalt Strike Beacon Object Files (BOFs) used during red teaming and penetration testing engagements.

---

Enumeration

TrustedSec Situational Awareness BOF<br />

BOF that provides host enumeration and awarness commands which are more opsec friendly<br />
Example commands include:<br />

Find Objects BOF<br />

Use direct system calls to enumerate processes for specific loaded modules (amsi.dll, clr.dll) or process handles (lsass.exe)<br />
Avoids fork&run<br />

BOF Collection<br />

A set of BOFs useful for enumeration and exploitation. Examples include:<br />

whereami<br />

A "Where Am I" BOF which is a way to run the whoami.exe binary but in an opsec safe way by pulling the info from the current beacon process memory.<br />
Also pulls current en .<br />

RiccardoAncarani BOFs<br />

A useful BOF collection to perform tasks in a safer opsec way.

Outflank C2 Tool Collection<br />

Great list of useful tools con to BOFs for better opsec.<br />
Tools like add machine account, kerberoast, LAPS password dump, SMB info, LDAP AD spray, and more!

---

Executing .NET Assemblies

InlineExecute-Assembly<br />

Perform .NET assembly execution of any .NET executable without any prior modifications required<br />
The BOF also supports several flags to disabling AMSI via in memory patching, disabling and restoring ETW via in memory patching, or customization of the CLR App Domain name to be created<br />

inject-assembly<br />

Another alternative .NET executable loader to inject an assembly into a running process<br />

---

Exploitation

ajpc500 BOFs<br />

A collection of very useful BOFs for utilities including different techniques of shellcode injection with syscalls, process dumping (LSASS!), and patching ETW for better e.<br />

MiniDumpWriteDump<br />

Uses static syscalls to dump a process such as LSASS to output file<br />

SilentLsassDump<br />

Uses direct syscalls generated from />
Dump the LSASS process via the silent process exit mechanism into the C:\Temp directory<br />

Unhook BOF<br />

Created by Raphael Mudge, this BOF will attempt to unhook userland APIs to bypass EDR<br />
Sort of the "hail mary" for attempting to unhook APIs<br />

WdToggle<br />

Enables WDigest credential caching using direct system calls<br />
Bypasses Windows Credential Guard if enabled<br />

TrustedSec CS-Remote-OPs-BOF<br />

Great repo of new BOFs from TrustedSec to follow up their SituationalAwareness BOFs.<br />
Includes dumping a process, decrypting Chrome keys, persistence techniques (registry, scheduled tasks, services), and more!

Inject AMSI Bypass<br />

BOF that bypasses AMSI in a remote process with code injection<br />

Inject ETW Bypass<br />

Inject ETW Bypass into Remote Process <br />

Kerberoast BOF<br />

BOF for targeted Kerberoasting against input SPN to roast<br />
Returns TGS that you can pass to apreq2hashcat.py (provided in repo) to output the hashcat format<br />

---

Miscellaneous

BOF Template<br />

Used for creating your very own BOFs!

BOF Hound<br />

An offline BloodHound ingestor and LDAP parser to be used with TrustedSec's "ldapsearch".<br />
Use ldapsearch in Cobalt Strike to gather data and then use bofhound on your CS logs to generate JSON files for importing into BloodHound.<br />

Help Color<br />

Color helper Aggressor script for coloring "help" output based on command type and OPSEC<br />

项目信息

开发语言：未知

Star 数：163

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Useful Cobalt Strike Beacon Object Files (BOFs) used during red teaming and penetration testing engagements.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。