inline_execute - Execute Beacon Object File (BOF)

Execute a Beacon Object File (BOF) in the current process thread and capture its output.

Description

The inline_execute command loads and executes a COFF (Common Object File Format) file, commonly known as a Beacon Object File (BOF), directly in the memory of the current process. BOFs are lightweight, position-independent code objects that can be executed without creating new processes, making them useful for stealthy operations.

Syntax

inline_execute -BOF <bof_file> [-Arguments <arguments>]

Parameters

-BOF or bof_name (required): Name of an already uploaded BOF file (e.g., whoami.x64.o)
bof_file (required for new uploads): A new BOF file to upload and execute
-Arguments or bof_arguments (optional): Arguments to pass to the BOF

Argument Types

BOF arguments can be specified using the following format:

int16:123 or -s:123 - 16-bit integer
int32:1234 or -i:1234 - 32-bit integer
string:hello or -z:hello - Null-terminated string
wchar:hello or -Z:hello - Wide character string
base64:abc== or -b:abc== - Base64-encoded binary data

Examples

# Execute a BOF with no arguments
inline_execute -BOF whoami.x64.o

# Execute a BOF with integer argument
inline_execute -BOF listmods.x64.o -Arguments int32:1234

# Execute a BOF with multiple arguments
inline_execute -BOF netstat.x64.o -Arguments int32:4 string:TCP

# Upload and execute a new BOF
inline_execute -BOF custom_bof.x64.o -Arguments int32:5678

Features

In-Memory Execution: BOFs are executed directly in the current process memory without creating new processes
COFF Loader: Full COFF loader implementation supporting x64 BOFs with relocations and symbol resolution
Beacon API Compatibility: Compatible with Cobalt Strike BOF API (BeaconPrintf, BeaconOutput, etc.)
Output Capture: Automatically captures and returns BOF output
Argument Parsing: Supports multiple argument types (int16, int32, string, wchar, base64)

Output

[inline_execute] BOF execution requested
[inline_execute] File ID: abc123...
[inline_execute] Arguments: int32:1234
[BOF Output]
Module Name: ntdll.dll
Base Address: 0x7ffa12340000
Size: 0x1f0000

OPSEC Considerations

Process Create Artifact: BOF execution creates a "Process Create" artifact that is logged
Memory Allocation: BOFs allocate executable memory which may be detected by EDR solutions
API Hooking: Some EDR solutions monitor API calls that BOFs make
Symbol Resolution: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged
No New Process: Unlike shell or execute_assembly, BOFs execute in-process, reducing some detection vectors

Technical Details

COFF Loader

The COFF loader implementation:

Supports x64 COFF files (IMAGE_FILE_MACHINE_AMD64)
Handles relocations (IMAGE_REL_AMD64_ADDR64, IMAGE_REL_AMD64_ADDR32NB, IMAGE_REL_AMD64_REL32)
Resolves internal Beacon API functions
Resolves external symbols via LoadLibraryA/GetProcAddress
Maps sections with PAGE_EXECUTE_READWRITE permissions

Beacon API Compatibility

The following Beacon API functions are supported:

BeaconPrintf - Formatted output
BeaconOutput - Raw output
BeaconDataParse - Parse input data
BeaconDataInt, BeaconDataShort, BeaconDataExtract - Data extraction
BeaconUseToken, BeaconRevertToken - Token manipulation
BeaconIsAdmin - Admin check

Error Handling

The command handles various error scenarios:

File Not Found: Returns error if BOF file cannot be retrieved from Mythic
Invalid COFF: Returns error if file is not a valid COFF or unsupported architecture
Symbol Resolution Failure: Warns if external symbols cannot be resolved
Execution Failure: Returns error if BOF entry point cannot be found or execution fails

inline_execute_assembly - Execute .NET assemblies in-process
execute_assembly - Execute .NET assemblies in remote processes
Artifacts Support

Command Category: Execution & Control
Requires Admin: No
MITRE ATT&CK: T1055 - Process Injection

4.2 KiB Raw Blame History