Windows BOF-Collections

Tool for Testing

• I have used COFFLoader from TrustedSec for local BOF testing.
  Link: https://github.com/trustedsec/COFFLoader

Protections enabled during testing (as of now):

• Compiler's Stack Buffer Overrun protection

  '/GS-'

• Control Flow Guard (CFG)

Table of Contents

Collection
Credential Access
Discovery
PrivilegeEscalation
Execution
BYOVD
ProcessInjection
ActiveDirectory
Persistence
PrivilegeEscalation
MalwareDelivery
ImpairingDefenses
Impact

Collection

BOF	Use
procenum	Finds the PID of a process name given. This operation requires appropriate privileges to see the handle to the target process object.

Credential Access

BOF	Use
cookiecrunch	Test Test Test Test Test Test Test .
edgelord	Test Test Test Test Test Test Test .

Discovery

BOF	Use
tokeninfo_recon	Prints out target process' token attributes information such as TokenSource, TokenType, TokenImpersonationLevel, TokenSessionId, etc.
av_edr_enum	Print out artifacts that indicates the existence of security solutions in the machine.

Execution

BOF	Use
warbird	Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test .

BYOVD

BOF	Use
rtcore-elevate2system	Copy the token of the System.exe process' NT AUTHORITY\SYSTEM and transferring it to the target process by exploiting the vulnerable RTCore64.sys.
rtcore-settokenhighprivs	Setting all the privileges of a target process to '1' by exploiting the vulnerable RTCore64.sys.
rtcore-setintegritylevel	Elevate the integrity of the target process to NT AUTHORITY\SYSTEM by exploiting the vulnerable RTCore64.sys.
rtcore-unrestricttoken	Allows access of the target process to any objects in the system usually proceeded by an "access denied" due to SID restriction by exploiting the vulnerable RTCore64.sys.
rtcore-flipprocprotection	Flip the protection of the target process to Fully Protected Process or Process Protected Light by exploiting the vulnerable RTCore64.sys.

ProcessInjection

BOF	Use
processinjection	Executes the classic process injection technique through section maps.

ActiveDirectory

BOF	Use
dpapi-regsearch	Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test Test .

Persistence

BOF	Use
pers-runkeys	Executes the runkeys persistence technique.

Privilege Escalation

BOF	Use
fodhelper	The “fodhelper UAC bypass” is a well-known Windows privilege-escalation technique that abuses the auto-elevated Microsoft binary fodhelper.exe to bypass normal User Account Control (UAC) prompts.

MalwareDelivery

BOF	Use
dns-ptr	Deliver payload into the target process' memory via DNS resolution's PTR record(s).

ImpairingDefenses

BOF	Use
BlindingEventLog	Interacting with the Event log service process to suspend logging.
EPPFirewallBlock	Blocking of Endpoint Protection Telemetry directed to its server via Firewall.
SysmonUnload	Unload the sysmon driver disabling endpoint telemetry.
windef-disable	Disabling Windows Defender via Registry modification.

Impact

BOF	Use
ransomware-sim-bof	Executes a ransomware simulation on a proof of concept file with the most restricted access control.

DISCLAIMER: These beacon object files are re-creation and analysis of already known techniques. None of the techniques discussed are novel, they have been publicly known and documented by the security research community for many years, and credit is given throughout to the researchers and projects that developed them. The creators and contributors of this repository accept no liability for any loss, damage, or consequences resulting from the use of the information or code contained in this repo. By utilizing this repo, you acknowledge and accept full responsibility for your actions. Use at your own risk.