A collection of Beacon Object Files (BOFs) for post-exploitation operations. Includes credential hunting, system enumeration, event log analysis, and privilege management tools.
| BOF | Description | Usage |
|---|---|---|
| adduser-domaingroup | Adds a user to a domain global/universal group via NetGroupAddUser (target a DC) |
Usage |
| adduser-localgroup | Adds a user to a local group on a Windows computer | Usage |
| bkread | Reads a file with SeBackupPrivilege and backup semantics, without changing ACLs |
Usage |
| checkaccess | Probes read access for a directory path and subfolders (depth-1 or recursive) | Usage |
| credguard-check | Checks Credential Guard, HVCI, LSA Protection, VBS status | Usage |
| curl | HTTP/HTTPS requests with TLS fingerprinting | Usage |
| decrypt-credmanager | Decrypts Windows Credential Manager entries using DPAPI | Usage |
| dpapi-unprotect | Decrypts an arbitrary DPAPI blob (with optional entropy) in the current user's context | Usage |
| dsreg-status | Reports documented dsregcmd /status device, tenant, user, and proxy state |
Usage |
| edge-passdump | Dumps plaintext passwords saved in Microsoft Edge from process memory | Usage |
| enum-credmanager | Lists Windows Credential Manager entries (no decryption) | Usage |
| enum-creds | Credential-focused file enumeration with optional app-data discovery and inline content dump | Usage |
| enum-logon-events | Queries Security Event Log for logon events (4624) | Usage |
| enum-registry | Extracts RDP history, installed software, env vars, WSL/Docker info across all loaded user hives | Usage |
| enum-stored-accounts | Lists service accounts, tasks with stored passwords, and per-profile DPAPI material (which tokens are worth stealing) | Usage |
| enum-user-right | Lists accounts assigned an effective LSA user right; defaults to SeMachineAccountPrivilege |
Usage |
| fake-windows-popup (BOF-PE, x64) | Shows native Windows credential UI with optional validation and password output | Usage |
| enumshares | Enumerate remote shares and test filesystem access (single host) | Usage |
| enumshares-file | Enumerate remote shares from an uploaded hostnames file | Usage |
| listpipes | Lists named pipes for IPC reconnaissance | Usage |
| lsfiles | Recursive file/directory listing with wildcards, date/size filters | Usage |
| removeuser-domaingroup | Removes a user from a domain global/universal group via NetGroupDelUser (target a DC) |
Usage |
| removeuser-localgroup | Removes a user from a local group on a Windows computer (or a domain-local group when targeted at a DC) | Usage |
| sccm-wmi | Recovers SCCM Network Access Account credentials from live WMI policy as SYSTEM (CRED-3) |
Usage |
| sccm-disk | Recovers SCCM Network Access Account credentials from on-disk OBJECTS.DATA as SYSTEM (CRED-4) |
Usage |
| sccm-local-recon | Local SCCM client recon: paths, cache permissions, ManagementPoints, log UNC/URL scraping (RECON-7) | Usage |
See docs/USAGE.md for detailed command syntax and examples.
The oc2-python-scripts-bof/ directory contains OC2 integration scripts for external BOFs. Source repos are tracked as git submodules under external/. Run ./oc2-python-scripts-bof/sync-bofs.sh to pull, build, and sync the compiled BOF binaries.
# Pull, build, and sync all external BOFs
./oc2-python-scripts-bof/sync-bofs.sh
# Skip pulling submodules
./oc2-python-scripts-bof/sync-bofs.sh --no-pull
# Skip builds and only copy existing object files
./oc2-python-scripts-bof/sync-bofs.sh --no-build
# Sync selected projects only
./oc2-python-scripts-bof/sync-bofs.sh PrivKit SQL-BOF| Project | Commands | Deploy | Source |
|---|---|---|---|
| cookie-monster | cookie-monster |
with redteam-bofs | KingOfTheNOPs/cookie-monster |
| Kerbeus-BOF | krb_asktgt, krb_asktgs, krb_s4u, krb_ptt, krb_klist, krb_dump, etc. |
standalone | RalfHacker/Kerbeus-BOF |
| LNKgenerator-BOF | LNKgenerator |
with redteam-bofs | KingOfTheNOPs/LNKgenerator-BOF |
| SQL-BOF | sql-whoami, sql-query, sql-xpcmd, sql-links, etc. |
standalone | Tw1sm/SQL-BOF |
| OperatorsKit | addtaskscheduler, credprompt |
with redteam-bofs | REDMED-X/OperatorsKit |
| PrivKit | privcheck, privkit-alwaysinstallelevated, privkit-autologon, privkit-credmanager, privkit-hijackablepath, privkit-modifiableautorun, privkit-modifiablesvc, privkit-tokenprivileges, privkit-unquotedsvcpath, privkit-pshistory, privkit-uacstatus |
with redteam-bofs | mertdas/PrivKit |
Kerbeus-BOF and SQL-BOF ship their own *_bof.s1.py with hardcoded /shared/bofs/<project>/... paths, so they are deployed standalone at the top of the teamserver's BOF dir rather than nested under custom/redteam-bofs/.
See docs/USAGE.md#external-bof-scripts for usage details.
Install the mingw-w64 cross-compiler:
# Debian/Ubuntu
sudo apt install mingw-w64
# macOS
brew install mingw-w64# Build all BOFs
make
# Build specific BOF
make enum-creds
# Build the x64 BOF-PE
make fake-windows-popup
# List available BOFs
make listOutput files are placed in each BOF's directory:
*.x64.o- 64-bit object file*.x86.o- 32-bit object filebuild-mingw/*.exe- x64 BOF-PE executable
Each BOF includes integration scripts:
*.s1.py- OC2/Sliver Python scripts*.cna- Cobalt Strike Aggressor scripts (where available)
make # Build all production BOFs (14)
make test # Build test executables
make clean # Remove artifacts
make help # Show all options- Create
src/<bof-name>/withentry.c,beacon.h, andMakefile. BOF-PE projects use CMake and a local Makefile wrapper. - Add OC2 script:
<bof-name>_bof.s1.py - Add to
Makefileandbuild-all.shBOFS arrays - Update this README and USAGE.md
| Document | Description |
|---|---|
| USAGE.md | Command syntax and examples |
| BUILD.md | Build instructions |
Individual BOFs may have different licenses. See each BOF's directory.
For authorized security testing and research only. Users are responsible for legal compliance.