BOF-Z-Labs.yaml

---
name: wProcessInjectionSrdi
description: "Injects any BOF to any process"
author: Z-Labs
Arch: ["x64", "x86"]
tags: ['windows','srdi','z-labs','TA0005','TA0004','T1055.001']
category: "Injection-BOF"
OS: Windows
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/wProcessInjectionSrdi.zig'
examples: '
 wProcessInjectionSrdi i:<bof_len_in_bytes> z:<pointer_to_bof_bytes> i:<pid>
'
arguments:
  - name: bof_data_len
    desc: "Length in bytes of BOF to be injected"
    type: integer
    required: true
  - name: bof_data_ptr
    desc: "Pointer to the bytes of the BOF to be injected"
    type: string
    required: true
  - name: pid
    desc: "PID"
    type: integer
    required: true
  - name: dump_shellcode
    desc: "When --dump-shellcode string is present final shellcode will be written to 'shellcode.bin' file."
    type: string
    required: false
errors:
- name: UnknownError
  code: 0xff
  message: "Unknown error"
---
name: "udpScanner"
description: "Universal UDP port sweeper"
author: "Z-Labs"
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['windows', 'linux','T0007','T0846.001', 'z-labs']
category: "SAR-BOF"
OS: "cross-platform"
entrypoint: "go"
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/udpScanner.zig'
examples: '
 Scanning provided IP range on most common UDP ports with builtin UDP probes:

   udpScanner str:192.168.0.1-32

 Scanning only cherry-picked ports (if no builtin UDP probe for the chosen port is available then length and content of the packet payload will be randomly generated:

   udpScanner str:192.168.0.1:123,161
   udpScanner str:102.168.1.1-128:53,427,137
   udpScanner str:192.168.0.1:100-200

 Example of running with provided UDP probes:

   udpScanner str:192.168.0.1-32 int:BUF_LEN str:BUF_MEMORY_ADDRESS

 UDP probe syntax (with example):

   <portSpec> <probeName> <hexadecimal encoded probe data>\n
   53,69,135,1761 dnsReq 000010000000000000000000

 Example of running udpScanner using cli4bofs tool and with UDP probes provided from the file:

   cli4bofs exec udpScanner 102.168.1.1-4:161,427 file:/tmp/udpPayloads
'
arguments:
  - name: IPSpec
    desc: "IP addresses specification, ex: 192.168.0.1; 10.0.0-255.1-254; 192.168.0.1:161,427,10-15"
    type: string
    required: true
  - name: BufLen
    desc: "length of UDP probes buffer"
    type: integer
    required: false
  - name: BufMemoryAddress
    desc: "memory address of UDP probes buffer"
    type: string
    required: false
---
name: "tcpScanner"
description: "TCP connect() port scanner"
author: "Z-Labs"
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['windows', 'linux','T0007','T0846.001', 'z-labs']
category: "SAR-BOF"
OS: "cross-platform"
entrypoint: "go"
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/tcpScanner.zig'
examples: '
 Scanning selected hosts and ports:

   tcpScanner str:192.168.0.1:80,22,443
   tcpScanner str:192.168.0.1:100-200
   tcpScanner str:102.168.1.1-128:445,81,8080-8089
arguments:
  - name: IPSpec
    desc: "IP addresses specification, ex: 192.168.0.1; 10.0.0-255.1-254; 192.168.0.1:161,427,10-15"
    type: string
    required: true
'
---
name: whoami
description: "Print current user"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['windows', 'linux','TA0007','T1033', 'z-labs']
category: "SAL-BOF"
OS: cross-platform
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/whoami.zig'
examples: '
 whoami
'
---
name: uname
description: "Print system information. With no flag, same as -s"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['linux','TA0007', 'T1082','z-labs']
category: 'SAL-BOF'
OS: Linux
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/coreutils/uname.zig'
examples: '
 uname
 uname -a

 Flags:
 -a    print all information
 -s    print the kernel name
 -n    print the network node hostname
 -r    print the kernel release
 -v    print the kernel version
 -m    print the machine hardware name
'
arguments:
- name: option
  desc: "Print only chosen system information. Supported options: -asnrvm"
  type: string
  required: false
---
name: hostid
description: "Print the numeric identifier for the current host"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['linux','TA0007', 'T1016','z-labs']
category: 'SAL-BOF'
OS: Linux
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/coreutils/hostid.zig'
examples: '
 hostid
'
---
name: hostname
description: "Show system host name"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['linux','TA0007', 'T1016','z-labs']
category: 'SAL-BOF'
OS: Linux
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/coreutils/hostname.zig'
examples: '
 hostname
'
---
name: uptime
description: "Tell how long the system has been running"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['linux','TA0007', 'T1082','z-labs']
category: 'SAL-BOF'
OS: Linux
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/coreutils/uptime.zig'
examples: '
 uptime
'
---
name: id
description: "Print user and group information for each specified USER, or (when USER omitted) for the current process"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['windows', 'linux','TA0007','T1033', 'z-labs']
category: "SAL-BOF"
OS: Linux
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/coreutils/id.zig'
examples: '
 id
 id root
'
arguments:
- name: user
  desc: "Prints user and group information for this user"
  type: string
  required: false
---
name: who
description: "Show who is logged on"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['linux','TA0007', 'T1082','z-labs']
category: 'SAL-BOF'
OS: Linux
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/coreutils/who.zig'
examples: '
 who
'
---
name: cat
description: "Print content of a file"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['windows', 'linux','TA0007', 'T1083', 'z-labs']
category: "FILES-BOF"
OS: cross-platform
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/cat.zig'
examples: '
 cat /etc/passwd
 cat C:\Windows\System32\drivers\etc\hosts
'
arguments:
- name: file_path
  desc: "path to the file to be printed"
  type: string
  required: true
errors:
- name: AccessDenied
  code: 0x1
  message: "Failed to open provided file"
- name: FileNotFound
  code: 0x2
  message: "File not found"
- name: AntivirusInterference
  code: 0x3
  message: "Possible Antivirus Interference while opening the file"
- name: FileNotProvided
  code: 0x4
  message: "No file provided"
- name: StreamTooLong
  code: 0x5
  message: "File is very large"
- name: UnknownError
  code: 0x6
  message: "Unknown error"
---
name: pwd
description: "Print name of current/working directory"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['windows', 'linux','TA0007', 'T1083', 'z-labs']
category: "FILES-BOF"
OS: cross-platform
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/pwd.zig'
examples: '
 pwd
'
errors:
- name: AccesDenied
  code: 0x1
  message: "Permission to read or search a component of the filename was denied"
- name: CwdUnlinked
  code: 0x2
  message: "The current working directory has been unlinked"
- name: NameTooLong
  code: 0x3
  message: "Name too long"
- name: UnknownError
  code: 0x4
  message: "Unknown error"
---
name: cd
description: "Change current working directory"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['windows', 'linux','TA0007', 'T1083', 'z-labs']
category: "FILES-BOF"
OS: cross-platform
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/cd.zig'
examples: '
 cd /etc
 cd C:\Windows
'
arguments:
- name: dir_path
  desc: "path to change to"
  type: string
  required: true
errors:
- name: AccessDenied
  code: 0x1
  message: "Access to the directory denied"
- name: SymLinkLoop
  code: 0x2
  message: "Symlink loop"
- name: NameTooLong
  code: 0x3
  message: "Directory too long"
- name: FileNotFound
  code: 0x4
  message: "No such directory"
- name: SystemResources
  code: 0x5
  message: "System resources"
- name: NotDir
  code: 0x6
  message: "No directory"
- name: DirNotProvided
  code: 0x7
  message: "Directory not provided"
- name: UnknownError
  code: 0x8
  message: "Unknown error"
---
name: ls
description: "List given directory content"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['windows', 'linux','TA0007', 'T1083', 'z-labs']
category: "FILES-BOF"
OS: cross-platform
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/ls.zig'
examples: '
 ls /
 ls C:\Windows\System32\
'
arguments:
- name: dir_path
  desc: "path to the directory to be listed"
  type: string
  required: true
errors:
- name: AccessDenied
  code: 0x1
  message: "Failed to open provided file"
- name: FileNotFound
  code: 0x2
  message: "File not found"
- name: AntivirusInterference
  code: 0x3
  message: "Possible Antivirus Interference while opening the file"
- name: DirNotProvided
  code: 0x4
  message: "No directory provided"
- name: UnknownError
  code: 0x5
  message: "Unknown error"
---
name: grep
description: "Print lines that match patterns"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['windows', 'linux','TA0007', 'T1083', 'z-labs']
category: "TEXT-BOF"
OS: cross-platform
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/grep.zig'
examples: '
 grep root /etc/passwd
 grep ^[^#\n] /etc/hosts
'
arguments:
- name: pattern
  desc: "Searched pattern in an extended regular expression syntax"
  type: string
  required: true
- name: file_path
  desc: "Path to the file for searching"
  type: string
  required: true
errors:
- name: AccessDenied
  code: 0x1
  message: "Failed to open provided file"
- name: FileNotFound
  code: 0x2
  message: "File not found"
- name: AntivirusInterference
  code: 0x3
  message: "Possible Antivirus Interference while opening the file"
- name: FileNotProvided
  code: 0x4
  message: "No file provided"
- name: StreamTooLong
  code: 0x5
  message: "File is very large"
- name: UnknownError
  code: 0x6
  message: "Unknown error"
---
name: find
description: "Search for files in a directory hierarchy. Simple version of find(1) utility"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['windows', 'linux','TA0007', 'T1083', 'z-labs']
category: "FILES-BOF"
OS: cross-platform
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/find.zig'
examples: '
 Considerations:
    -maxdepth hardcoded to 3
    symbolic links are not followed
    one find "test" supported at a time


 Find and list unix socket in a given directory:
   find /home/user -type s

 List files hich have r and w permission for their owner and group and only r for other users, without regard to the presence of any extra permission bits:
   find . -perm -664

 Search for set-user-ID files and directories, without regard to the presence of any extra permission bits:
   find . -perm -4000

 List files matching provided regex (match on the whole path, not a search):
   find /etc/apt -regex .*archive.*
'
arguments:
- name: dir_path
  desc: "path to the directory to be listed"
  type: string
  required: true
- name: test
  desc: "Type of test to conduct, supported: -type|-regex|-perm"
  type: string
  required: false
- name: test_param
  desc: "Parameter for selected test"
  type: string
  required: false
errors:
- name: AccessDenied
  code: 0x1
  message: "Failed to open provided file"
- name: FileNotFound
  code: 0x2
  message: "File not found"
- name: AntivirusInterference
  code: 0x3
  message: "Possible Antivirus Interference while opening the file"
- name: DirNotProvided
  code: 0x4
  message: "No directory provided"
- name: TestParamNotProvided
  code: 0x5
  message: "Test param (e.g. -type *file_type*) not provided"
- name: OutOfMemory
  code: 0x6
  message: "Not sufficient memory available"
- name: NoSuchTest
  code: 0x7
  message: "Urecognized test type provided"
- name: BadParameter
  code: 0x8
  message: "Parameter for chosen test is badly formatted"
- name: UnknownError
  code: 0x9
  message: "Unknown error"
---
name: "ifconfig"
description: "Displays the status of the currently active network interfaces; Manipulates current state of the device (euid = 0 or CAP_NET_ADMIN is required for that)"
author: "Z-Labs"
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['linux','TA0007', 'T1016','z-labs']
category: 'SAL-BOF'
OS: 'Linux'
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/net-tools/ifconfig.zig'
arguments:
- name: User
  desc: "Prints user and group information for this user"
  type: string
  required: false
examples: '
 ifconfig
 ifconfig eth0 down
 ifconfig eth0 promisc
 ifconfig eth0 -promisc
'
---
name: kmodLoader
description: "Loads and unloads Linux kernel modules images directly from memory"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['linux','TA0003', 'TA0004', 'T1547.006', 'DC0031', 'z-labs']
category: "Postex-BOF"
OS: Linux
api:
  - 'kmodLoad(module_image: [*]const u8, len: usize, param_values: [*:0]const u8) callconv(.c) u8'
  - 'kmodRemove(module_name: [*:0]const u8, flags: u32) callconv(.c) u8'
sources:
  - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/kmodLoader.zig'
examples: '
 See BOF-stager for an example of using this BOF.
'
arguments:
  - name: module_image
    desc: "memory address of kernel image module"
    type: string
    required: true
    api: kmodLoad
  - name: len
    desc: "size of kernel module image"
    type: integer
    required: true
    api: kmodLoad
  - name: param_values
    desc: "kernel module parameters in a form of: name[=value[,value...]] for each parameter"
    type: string
    required: true
    api: kmodLoad
  - name: module_name
    desc: "kernel module name to remove"
    type: string
    required: true
    api: kmodRemove
  - name: flags
    desc: "special flags"
    type: integer
    required: true
    api: kmodRemove
errors:
- name: NoRootPermissions
  code: 0x1
  message: "Root privileges are required to load kernel module"
---
name: lskmod
description: "Print the currently loaded kernel modules"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['linux','T0007','T1082', 'z-labs']
category: "SAL-BOF"
OS: Linux
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/lskmod.zig'
examples: '
 lskmod
'
errors:
- name: FaileOpenFailure
  code: 0x1
  message: "Failed to open '/proc/modules' file"
- name: UnknownError
  code: 0x2
  message: "Unknown error"
---
name: whereami
description: "Print hypervisor vendor signature from CPUID"
author: Z-Labs
Arch: ["x64", "x86"]
tags: ['windows', 'linux','T0007','T1082', 'z-labs']
category: "SAL-BOF"
OS: cross-platform
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/whereami.zig'
examples: '
 whereami
'
errors:
- name: UnknownHypervisor
  code: 0x1
  message: "Unknown vendor signature"
- name: UnknownError
  code: 0x2
  message: "Unknown error"
---
name: zcat
description: "Print content of a gzip compressed file"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['windows', 'linux','TA0007','T1083', 'z-labs']
category: "FILES-BOF"
OS: cross-platform
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/zcat.zig'
examples: '
 zcat /boot/config.gz
'
arguments:
- name: file_path
  desc: "path to the file to be printed"
  type: string
  required: true
errors:
- name: AccessDenied
  code: 0x1
  message: "Failed to open provided file"
- name: FileNotFound
  code: 0x2
  message: "File not found"
- name: AntivirusInterference
  code: 0x3
  message: "Possible Antivirus Interference while opening the file"
- name: FileNotProvided
  code: 0x4
  message: "No file provided"
- name: StreamTooLong
  code: 0x5
  message: "File is very large"
- name: UnknownError
  code: 0x6
  message: "Unknown error"
---
name: dirtypipe
description: "Privilege escalation exploit for 'dirtypipe' vulnerability (CVE-2022-0847) against Linux Kernel"
author: Z-Labs
Arch: ["x64", "x86", "aarch64", "arm"]
tags: ['linux','TA0004', 'T1068', 'z-labs']
category: "Elevation-BOF"
OS: Linux
sources:
    - 'https://raw.githubusercontent.com/The-Z-Labs/bof-launcher/main/bofs/src/dirtypipe.zig'
examples: '
 Basic usage of the BOF:
   dirtypipe /etc/shadow 913 "backdoor:xxx:10123::::::"

 Details about vulnerability and PoC exploit (author: Max Kellermann):
   https://dirtypipe.cm4all.com/
'
arguments:
- name: file_path
  desc: "path to a file that will be overwritten"
  type: string
  required: true
- name: offset
  desc: "offset in overwritten file"
  type: string
  required: true
- name: data
  desc: "data to be written to the provided at provided offset"
  type: string
  required: true
errors:
- name: FdProcessLimit
  code: 0x1
  message: "Too many file descriptors for a process"
- name: InvalidPipe
  code: 0x2
  message: "Pipe is invalid"
- name: PageBoundryOffset
  code: 0x3
  message: "Page boundry would be crossed (offset % PAGE_SIZE == 0)"
- name: FileOpenFailure
  code: 0x4
  message: "Failed to open file"
- name: SpliceFailure
  code: 0x5
  message: "Failure during splicing"
- name: WriteFailure
  code: 0x6
  message: "Failure during file write"
- name: ShortWrite
  code: 0x7
  message: "File write not fully complete"
- name: UnknownError
  code: 0x8
  message: "Unknown error"