Bof Loader implemented

2025-12-11 15:41:44 +01:00
parent e688609c0e
commit 3978a16fab
24 changed files with 2135 additions and 6 deletions
@@ -0,0 +1,114 @@
+# inline_execute - Execute Beacon Object File (BOF)
+
+Execute a Beacon Object File (BOF) in the current process thread and capture its output.
+
+## Description
+
+The `inline_execute` command loads and executes a COFF (Common Object File Format) file, commonly known as a Beacon Object File (BOF), directly in the memory of the current process. BOFs are lightweight, position-independent code objects that can be executed without creating new processes, making them useful for stealthy operations.
+
+## Syntax
+
+```
+inline_execute -BOF <bof_file> [-Arguments <arguments>]
+```
+
+## Parameters
+
+- `-BOF` or `bof_name` (required): Name of an already uploaded BOF file (e.g., `whoami.x64.o`)
+- `bof_file` (required for new uploads): A new BOF file to upload and execute
+- `-Arguments` or `bof_arguments` (optional): Arguments to pass to the BOF
+
+### Argument Types
+
+BOF arguments can be specified using the following format:
+- `int16:123` or `-s:123` - 16-bit integer
+- `int32:1234` or `-i:1234` - 32-bit integer
+- `string:hello` or `-z:hello` - Null-terminated string
+- `wchar:hello` or `-Z:hello` - Wide character string
+- `base64:abc==` or `-b:abc==` - Base64-encoded binary data
+
+## Examples
+
+```
+# Execute a BOF with no arguments
+inline_execute -BOF whoami.x64.o
+
+# Execute a BOF with integer argument
+inline_execute -BOF listmods.x64.o -Arguments int32:1234
+
+# Execute a BOF with multiple arguments
+inline_execute -BOF netstat.x64.o -Arguments int32:4 string:TCP
+
+# Upload and execute a new BOF
+inline_execute -BOF custom_bof.x64.o -Arguments int32:5678
+```
+
+## Features
+
+- **In-Memory Execution**: BOFs are executed directly in the current process memory without creating new processes
+- **COFF Loader**: Full COFF loader implementation supporting x64 BOFs with relocations and symbol resolution
+- **Beacon API Compatibility**: Compatible with Cobalt Strike BOF API (BeaconPrintf, BeaconOutput, etc.)
+- **Output Capture**: Automatically captures and returns BOF output
+- **Argument Parsing**: Supports multiple argument types (int16, int32, string, wchar, base64)
+
+## Output
+
+```
+[inline_execute] BOF execution requested
+[inline_execute] File ID: abc123...
+[inline_execute] Arguments: int32:1234
+[BOF Output]
+Module Name: ntdll.dll
+Base Address: 0x7ffa12340000
+Size: 0x1f0000
+```
+
+## OPSEC Considerations
+
+- **Process Create Artifact**: BOF execution creates a "Process Create" artifact that is logged
+- **Memory Allocation**: BOFs allocate executable memory which may be detected by EDR solutions
+- **API Hooking**: Some EDR solutions monitor API calls that BOFs make
+- **Symbol Resolution**: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged
+- **No New Process**: Unlike `shell` or `execute_assembly`, BOFs execute in-process, reducing some detection vectors
+
+## Technical Details
+
+### COFF Loader
+
+The COFF loader implementation:
+- Supports x64 COFF files (IMAGE_FILE_MACHINE_AMD64)
+- Handles relocations (IMAGE_REL_AMD64_ADDR64, IMAGE_REL_AMD64_ADDR32NB, IMAGE_REL_AMD64_REL32)
+- Resolves internal Beacon API functions
+- Resolves external symbols via LoadLibraryA/GetProcAddress
+- Maps sections with PAGE_EXECUTE_READWRITE permissions
+
+### Beacon API Compatibility
+
+The following Beacon API functions are supported:
+- `BeaconPrintf` - Formatted output
+- `BeaconOutput` - Raw output
+- `BeaconDataParse` - Parse input data
+- `BeaconDataInt`, `BeaconDataShort`, `BeaconDataExtract` - Data extraction
+- `BeaconUseToken`, `BeaconRevertToken` - Token manipulation
+- `BeaconIsAdmin` - Admin check
+
+## Error Handling
+
+The command handles various error scenarios:
+- **File Not Found**: Returns error if BOF file cannot be retrieved from Mythic
+- **Invalid COFF**: Returns error if file is not a valid COFF or unsupported architecture
+- **Symbol Resolution Failure**: Warns if external symbols cannot be resolved
+- **Execution Failure**: Returns error if BOF entry point cannot be found or execution fails
+
+## Related
+
+- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process
+- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes
+- [Artifacts Support](../features.md#artifacts-support)
+
+---
+
+**Command Category:** Execution & Control  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/)
+