Skip to content

Octoberfest7/JumpSession_BOF

main
Switch branches/tags
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 

JumpSession_BOF

This is a Beacon Object File allowing creation of Beacons in different sessions. Must be Elevated.

image

This BOF was created on the heels of research I did on Session 1 -> Session 0 Migration. To understand what is happening under the hood I suggest you read the full writeup there.

With an Elevated Beacon an operator may spawn a beacon in a different session; This may be session 0, so as to prevent losing your beacon should the victim log off, or even another user's session.

A couple things to keep in mind:

  1. The "sessionpid" you select must be a process which has the SE_ASSIGNPRIMARYTOKEN_PRIVILEGE and SE_TCB_PRIVILEGE privileges. This means you are going to be looking at system integrity processes, not high integrity ones ran by a user. Note that PPL protected processes like smss.exe MAY be used here (and are in fact a desired target when jumping to session 0). Smss.exe is a good target for session 0, while winlogon is a good target for user sessions.

  2. The "parentpid" you select CAN NOT be PPL protected. Ideally you will select a parentpid in the same session that you want to jump to; spoolsv is a good target for session 0, while winlogon is a good target for user sessions.

  3. The Beacon in the new session will spawn as the same architecture as the Beacon that JumpSession was ran from; architecture migration is not supported.

To Compile:

x64

x86_64-w64-mingw32-gcc -o JumpSession.x64.o -Os -c main.c -DBOF

x86

i686-w64-mingw32-gcc -o JumpSession.x86.o -Os -c main.c -DBOF

Credit

Thanks to TrustedSec for their CS-Remote-OPs-Bof repo, from which I stole the .cna script as a template for this one along with some assorted WINAPI prototypes for bofdefs.h.

About

Beacon Object File allowing creation of Beacons in different sessions.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages