A Beacon Object File port of GodPotato for Cobalt Strike.
This BOF triggers the GodPotato privilege escalation flow and supports two behaviors:
- default mode: steal a SYSTEM token and spawn a process to run a command
tokenmode: steal a SYSTEM token and apply it to the current Beacon withBeaconUseToken()
- Git clone the repo
- Run
make
- Import
godpotato.cnainto Cobalt Strike - Execute the BOF with the CNA alias
godpotato [token] [-cmd <command>] [-pipe <name>]
Argument summary:
(none) Run "cmd /c whoami" as SYSTEM.
token Apply a SYSTEM token to the current Beacon with BeaconUseToken().
-cmd <cmd> Run a command as SYSTEM in a spawned process.
-pipe <name> Use a custom named pipe. Default is a random pipe name.
help,-h,--help,/? Show this help.
Examples:
godpotato
godpotato token
godpotato help
godpotato -cmd "cmd /c whoami /priv"
godpotato -cmd "cmd /c whoami" -pipe "mycustompipe"
Credits: