62 lines
2.5 KiB
C
62 lines
2.5 KiB
C
/*
|
|
* Beacon Object Files (BOF)
|
|
* -------------------------
|
|
* A Beacon Object File is a light-weight post exploitation tool that runs
|
|
* with Beacon's inline-execute command.
|
|
*
|
|
* Cobalt Strike 4.1.
|
|
*/
|
|
|
|
/* data API */
|
|
typedef struct {
|
|
char * original; /* the original buffer [so we can free it] */
|
|
char * buffer; /* current pointer into our buffer */
|
|
int length; /* remaining length of data */
|
|
int size; /* total size of this buffer */
|
|
} datap;
|
|
|
|
DECLSPEC_IMPORT void BeaconDataParse(datap * parser, char * buffer, int size);
|
|
DECLSPEC_IMPORT int BeaconDataInt(datap * parser);
|
|
DECLSPEC_IMPORT short BeaconDataShort(datap * parser);
|
|
DECLSPEC_IMPORT int BeaconDataLength(datap * parser);
|
|
DECLSPEC_IMPORT char * BeaconDataExtract(datap * parser, int * size);
|
|
|
|
/* format API */
|
|
typedef struct {
|
|
char * original; /* the original buffer [so we can free it] */
|
|
char * buffer; /* current pointer into our buffer */
|
|
int length; /* remaining length of data */
|
|
int size; /* total size of this buffer */
|
|
} formatp;
|
|
|
|
DECLSPEC_IMPORT void BeaconFormatAlloc(formatp * format, int maxsz);
|
|
DECLSPEC_IMPORT void BeaconFormatReset(formatp * format);
|
|
DECLSPEC_IMPORT void BeaconFormatFree(formatp * format);
|
|
DECLSPEC_IMPORT void BeaconFormatAppend(formatp * format, char * text, int len);
|
|
DECLSPEC_IMPORT void BeaconFormatPrintf(formatp * format, char * fmt, ...);
|
|
DECLSPEC_IMPORT char * BeaconFormatToString(formatp * format, int * size);
|
|
DECLSPEC_IMPORT void BeaconFormatInt(formatp * format, int value);
|
|
|
|
/* Output Functions */
|
|
#define CALLBACK_OUTPUT 0x0
|
|
#define CALLBACK_OUTPUT_OEM 0x1e
|
|
#define CALLBACK_ERROR 0x0d
|
|
#define CALLBACK_OUTPUT_UTF8 0x20
|
|
|
|
DECLSPEC_IMPORT void BeaconPrintf(int type, char * fmt, ...);
|
|
DECLSPEC_IMPORT void BeaconOutput(int type, char * data, int len);
|
|
|
|
/* Token Functions */
|
|
DECLSPEC_IMPORT BOOL BeaconUseToken(HANDLE token);
|
|
DECLSPEC_IMPORT void BeaconRevertToken();
|
|
DECLSPEC_IMPORT BOOL BeaconIsAdmin();
|
|
|
|
/* Spawn+Inject Functions */
|
|
DECLSPEC_IMPORT void BeaconGetSpawnTo(BOOL x86, char * buffer, int length);
|
|
DECLSPEC_IMPORT void BeaconInjectProcess(HANDLE hProc, int pid, char * payload, int p_len, int p_offset, char * arg, int a_len);
|
|
DECLSPEC_IMPORT void BeaconInjectTemporaryProcess(PROCESS_INFORMATION * pInfo, char * payload, int p_len, int p_offset, char * arg, int a_len);
|
|
DECLSPEC_IMPORT void BeaconCleanupProcess(PROCESS_INFORMATION * pInfo);
|
|
|
|
/* Utility Functions */
|
|
DECLSPEC_IMPORT BOOL toWideChar(char * src, wchar_t * dst, int max);
|