marcos.luna
133 lines
5.2 KiB
Markdown
133 lines
5.2 KiB
Markdown
# inline_execute - Execute Beacon Object File (BOF)
|
|
|
|
Execute a Beacon Object File (BOF) in the current process thread and capture its output.
|
|
|
|
## Description
|
|
|
|
The `inline_execute` command loads and executes a COFF (Common Object File Format) file, commonly known as a Beacon Object File (BOF), directly in the memory of the current process. BOFs are lightweight, position-independent code objects that can be executed without creating new processes, making them useful for stealthy operations.
|
|
|
|
## Syntax
|
|
|
|
```
|
|
inline_execute -BOF <bof_file> [-Arguments <arguments>]
|
|
```
|
|
|
|
## Parameters
|
|
|
|
- `-BOF` or `bof_name` (required): Name of an already uploaded BOF file (e.g., `whoami.x64.o`)
|
|
- `bof_file` (required for new uploads): A new BOF file to upload and execute
|
|
- `-Arguments` or `bof_arguments` (optional): Arguments to pass to the BOF
|
|
|
|
### Argument Types
|
|
|
|
BOF arguments can be specified using the following format:
|
|
- `int16:123` or `-s:123` - 16-bit integer
|
|
- `int32:1234` or `-i:1234` - 32-bit integer
|
|
- `string:hello` or `-z:hello` - Null-terminated string
|
|
- `wchar:hello` or `-Z:hello` - Wide character string
|
|
- `base64:abc==` or `-b:abc==` - Base64-encoded binary data
|
|
|
|
## Examples
|
|
|
|
```
|
|
# Execute a BOF with no arguments
|
|
inline_execute -BOF whoami.x64.o
|
|
|
|
# Execute a BOF with integer argument
|
|
inline_execute -BOF listmods.x64.o -Arguments int32:1234
|
|
|
|
# Execute a BOF with multiple arguments
|
|
inline_execute -BOF netstat.x64.o -Arguments int32:4 string:TCP
|
|
|
|
# Upload and execute a new BOF
|
|
inline_execute -BOF custom_bof.x64.o -Arguments int32:5678
|
|
```
|
|
|
|
## Features
|
|
|
|
- **In-Memory Execution**: BOFs are executed directly in the current process memory without creating new processes
|
|
- **COFF Loader**: Full COFF loader implementation supporting x64 BOFs with relocations and symbol resolution
|
|
- **Beacon API Compatibility**: Compatible with Cobalt Strike BOF API (BeaconPrintf, BeaconOutput, etc.)
|
|
- **Output Capture**: Automatically captures and returns BOF output
|
|
- **Argument Parsing**: Supports multiple argument types (int16, int32, string, wchar, base64)
|
|
|
|
## Output
|
|
|
|
The command returns the output captured from the BOF via `BeaconPrintf` or `BeaconOutput`:
|
|
|
|
```
|
|
[BOF Output]
|
|
Module Name: ntdll.dll
|
|
Base Address: 0x7ffa12340000
|
|
Size: 0x1f0000
|
|
```
|
|
|
|
If the BOF produces no output, the command will indicate successful execution.
|
|
|
|
## OPSEC Considerations
|
|
|
|
- **MEDIUM OPSEC RISK**: In-process execution reduces some detection vectors compared to process spawning
|
|
- **Process Create Artifact**: BOF execution creates a "Process Create" artifact that is logged in Mythic
|
|
- **Memory Allocation**: BOFs allocate executable memory (PAGE_EXECUTE_READWRITE) which may be detected by EDR solutions
|
|
- **API Monitoring**: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged by EDR/XDR
|
|
- **Memory Scanning**: Allocated executable memory may be scanned by EDR memory protection features
|
|
- **No New Process**: Unlike `shell`, BOFs execute in-process, reducing some detection vectors
|
|
- **Thread Isolation**: BOFs execute in a separate thread with a 30-second timeout to prevent agent crashes
|
|
|
|
## Technical Details
|
|
|
|
### COFF Loader
|
|
|
|
The COFF loader implementation:
|
|
- Supports x64 COFF files (IMAGE_FILE_MACHINE_AMD64)
|
|
- Handles relocations (IMAGE_REL_AMD64_ADDR64, IMAGE_REL_AMD64_ADDR32NB, IMAGE_REL_AMD64_REL32)
|
|
- Resolves internal Beacon API functions
|
|
- Resolves external symbols via LoadLibraryA/GetProcAddress
|
|
- Maps sections with PAGE_EXECUTE_READWRITE permissions
|
|
|
|
### Thread Isolation
|
|
|
|
BOFs are executed in a separate thread to prevent agent crashes:
|
|
- **Timeout**: 30-second timeout for BOF execution
|
|
- **Thread Termination**: If BOF hangs, the thread is terminated after timeout
|
|
- **Output Capture**: Output is captured even if BOF hangs or times out
|
|
- **Agent Stability**: Main agent thread continues to function even if BOF crashes
|
|
|
|
### Beacon API Compatibility
|
|
|
|
The following Beacon API functions are supported:
|
|
- `BeaconPrintf` - Formatted output (captured and returned)
|
|
- `BeaconOutput` - Raw output (captured and returned)
|
|
- `BeaconDataParse` - Parse input data
|
|
- `BeaconDataInt`, `BeaconDataShort`, `BeaconDataExtract` - Data extraction
|
|
- `BeaconUseToken`, `BeaconRevertToken` - Token manipulation
|
|
- `BeaconIsAdmin` - Admin check
|
|
|
|
### Argument Serialization
|
|
|
|
Arguments are serialized using the Packer class format:
|
|
- Each argument is prefixed with its size (4 bytes, little-endian)
|
|
- Arguments are packed sequentially: `[size:4][data][size:4][data]...`
|
|
- The total buffer size is prepended to the argument buffer
|
|
- Boolean values are converted to integers (0 or 1) before serialization
|
|
|
|
## Error Handling
|
|
|
|
The command handles various error scenarios:
|
|
- **File Not Found**: Returns error if BOF file cannot be retrieved from Mythic
|
|
- **Invalid COFF**: Returns error if file is not a valid COFF or unsupported architecture
|
|
- **Symbol Resolution Failure**: Warns if external symbols cannot be resolved
|
|
- **Execution Failure**: Returns error if BOF entry point cannot be found or execution fails
|
|
|
|
## Related
|
|
|
|
- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process
|
|
- [Artifacts Support](../features.md#artifacts-support)
|
|
|
|
---
|
|
|
|
**Command Category:** Execution & Control
|
|
**Requires Admin:** No
|
|
**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/)
|
|
|