Cobalt Strike 4.1 released on 25 June 2020, introduced a novel (for that time) capability of running so called Beacon Object Files - small post-ex capabilities that execute in Beacon, parse arguments, call a few Win32 APIs, report output, and exit. Since that time BOFs became very popular and the demand to launch/execute them in other environments than Cobalt Strike's Beacon has emerged.
We at Z-Labs saw a big potential in BOFs and decided to extend its capabilities, versatility and usefulness even further. That's how the following projects came to live.
The repository provides:
- bof-launcher - programming library for BOFs in-memory management (loading, keeping track of loaded BOFs, execution, masking).
- z-beac0n - a custom-written stage-1 (aka pre-C2) solution featuring bof-launcher. Engineered with a small footprint, stealth and modularity in mind.
- Z-Labs BOFs collection - growing collection of OS-specific and cross-platform BOFs for usage during a red team engagements.
- 'bof' command line tool - a swiss army knife tool for running, injecting and organizing your BOFs collection.
See here for the project's ROADMAP.
See here for the building instructions.
BOF launcher library is the engine behind the z-beac0n adversary simulation toolkit.
It is a standalone programming library implemented in Zig and C that can be used to execute BOFs. On Windows it support x86 and x86_64 architectures, on Linux x86, x86_64, ARMv6+ and AArch64 architectures are supported. The library exposes either C API and Zig API.
Library features:
- Capable of running BOFs that adhere to Windows BOF template and Linux BOF template.
- Fully integrable with programs written in C/C++/Zig/Go or Rust. See examples for sample integrations.
- Adds capability to write BOFs in Zig programming language - which is a low-level language with a goal of being a "better C".
- Access to rich std library during BOF development: lists, hash maps, cross-platform OS layer, http, networking, threading, crypto and compression.
- Capability to implement cross-platform BOFs (see: udpScanner, tcpScanner, grep and various other BOFs).
- Provides modern sleepmasking functionality.
- Capability to run asynchronous or long-running BOFs in a separate thread.
- Pattern for launching more risky BOFs (i.e. privilege escalation exploits) inside of a sacrificial process.
- Seamless support for either Windows COFF and UNIX/Linux ELF formats.
- ARM and AARCH64 support on Linux.
- Flexible API allowing for BOF chaining (works like
Bashpipes but purely in-memory) both on Linux and Windows.
Extremely modular and versatile pre-C2 implant for Windows and Linux.
For details see here: z-beac0n - Open Adversary Simulation Toolkit
In addition to bof-launcher and z-beac0n projects, we maintain growing collection of our BOFs in this repository. Main differentiator of these BOFs is that they are implemented in Zig programming language. This, among other advantages like (modern language syntax, access to rich std library), brings the capability to implement truly cross-platform BOFs.
We have two types of BOFs here:
- Conventional BOFs that are fully compatible with original
Cobalt StrikeBOFs and can be run in other red teaming toolboxes as well. Specifically, Sliver, AdaptixC2 and Meterpreter were tested.
| Category | Description | BOFs list | Documentation |
|---|---|---|---|
| SAL-BOF | Local Situational Awareness BOFs | lskmod, hostname, hostid, id, uname, uptime, who, ifconfig, whoami, whereami, winver |
SAL-BOF reference |
| FS-BOF | Filesystem interaction BOFs | pwd, cd, cat, zcat, ls, find | FS-BOF reference |
| NET-BOF | Networking BOFs | socat | NET-BOF reference |
| SAR-BOF | Remote Situational Awareness BOFs | tcpScanner, udpScanner | SAR-BOF reference |
| Elevation-BOF | Context elevation BOFs | dirtypipe | Elevation-BOF reference |
| Injection-BOF | Process injection BOFs | processInjectionSrdi | Injection-BOF reference |
| TEXT-BOF | Text processing BOFs | grep | TEXT-BOF reference |
- Special purposes BOFs, that serve specifically as a buliding blocks for our
z-beac0nimplant.
| Category | Description | BOFs list | Documentation |
|---|---|---|---|
| BOF0 | So called BOF zero. Those ones operate as standalone implants, managing and executing other loaded BOFs (both conventional and API-style) |
z-beac0n core | BOF0 reference |
| C2-BOF | Special purpose API-style BOFs providing alternative C2 communication channels | C2channelHTTPS | C2-BOF reference |
| API-BOF | Misc API-style BOFs | kmodLoader | API-BOF reference |
Being a zero-dependency, drop-in C/C++ compiler that supports cross-compilation out-of-the-box, Zig can be used to build this project. To do so Zig's tarball (0.15.2) needs to be downloaded and dropped in the directory of choice. After adding that directory to the PATH environment variable, buliding the whole project is as easy as running:
zig build
Above command will build all included BOFs, example programs and bof-launcher library for all supported platforms. To build BOFs as a debuggable, standalone executables run:
zig build -Doptimize=Debug
Build artifacts will show up in zig-out/bin and zig-out/lib folders.
To build and run test BOFs do:
zig build test
To run tests on foreign CPU architectures, you can use QEMU which is nicely integrated in Zig:
zig build test -fqemu --glibc-runtimes /usr
This is an open source project meant to be used with authorization to assess the security posture and for research purposes.