The swiss army knife of LSASS dumping

Situational Awareness commands implemented using Beacon Object Files

A BOF that runs unmanaged PEs inline

An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.

WindowSpy is a Cobalt Strike Beacon Object File meant for automated and targeted user surveillance.

Library of BOFs to interact with SQL servers

Dumping SAM / SECURITY / SYSTEM registry hives with a Beacon Object File

Cobalt Strike Beacon Object File for bypassing UAC via the CMSTPLUA COM interface.

Take a screenshot without injection for Cobalt Strike

Cobalt Strike (CS) Beacon Object File (BOF) for kernel exploitation using AMD's Ryzen Master Driver (version 17).

Manual Map DLL injection implemented with Cobalt Strike's Beacon Object Files.

An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are available.

Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass

A simple BOF that frees UDRLs

Small toolkit for extracting information and dumping sensitive strings from Windows processes

Tool for working with Indirect System Calls in Cobalt Strike's Beacon Object Files (BOF) using SysWhispers3 for EDR evasion

a BOF implementation of various registry persistence methods

Cobalt Strike (CS) Beacon Object File (BOF) foundation for kernel exploitation using CVE-2021-21551.

open source port/reimplementation of the Cobalt Strike BOF Loader as is

BOF template with boflink and mutator kit support