Collection of Beacon Object Files (BOFs) that I wrote.
hklm_existsdisk_existspatchlevelremotepipelistbeaconinfocatCVE-2019-16098- Compilation instructions
Credit to Outflank for the research.
This BOF uses the Remote Registry Protocol (RRP) to enumerate registry keys in HKLM of the target machine. It uses an information leak that discloses the presence of a key when an attempt is made to delete that key.
- The BOF will do a sanity check if the key is not accessible by the current user. If it is, the BOF will exit early to prevent regkey deletion.
- Requires user to be domain-joined.
- Remote Registry Service must be running on the target. If the Startup type is not set to "Disabled", it will start automatically in my experience. The
\\.\pipe\winregtrick is not needed in this case.
Credit to Outflank for the research.
This BOF uses the Remote Registry Protocol (RRP) to enumerate files/folders of the target machine. It uses an information leak that discloses the presence of a file/folder when an attempt is made save a regkey file to the specified path.
- The return values presented in the Outflank talk do not match my personal experience. File absence returns
ERROR_ACCESS_DENIED, file presence returnsERROR_ALREADY_EXISTS. Moreover, even though the return value may indicateERROR_ACCESS_DENIED, I have seen that it can still write the file to disk, depending on the current user's privileges. So this BOF may leave artifacts! - Requires user to be domain-joined.
- Remote Registry Service must be running on the target. If the Startup type is not set to "Disabled", it will start automatically in my experience. The
\\.\pipe\winregtrick is not needed in this case.
Credit to Outflank for the research.
This BOF uses the Remote Registry Protocol (RRP) to read HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion, which contains the exact patch level of a machine.
- Remote Registry Service must be running on the target. If the Startup type is not set to "Disabled", it will start automatically in my experience. The
\\.\pipe\winregtrick is not needed in this case. - Requires user to be domain-joined.
Credit to Outflank for the research. This is an improved version over their PoC as it does not require .NET and does authentication over SSPI instead of manually entering credentials.
This is a self-contained SMB2 client that connects to the remote machine over TCP/445, authenticates the current user using SSPI and enumerates the named pipes from the IPC$ share.
- Requires user to be domain-joined.
Shows starting and ending address of beacon in memory. Useful for developing/debugging.
Prints contents of a file. Does size checking in order not to overload the CS console, sanitizes output for weird characters and is UTF8 and UTF16 compatible. Also supports UNC paths.
Abuses a kASLR leak together with R/W primitive in RTCore64.sys to steal a SYSTEM token. Implemented the remainder as per Julian Peña's writeup. Was a fun little introduction to kernel exploit dev :)
Other than your usual MinGW compiler, this repo requires boflink in $PATH. Other than that, just run make!
DISCLAIMER: The creators and contributors of this repository accept no liability for any loss, damage, or consequences resulting from the use of the information or code contained in this repo. By utilizing this repo, you acknowledge and accept full responsibility for your actions. Use at your own risk.