cli4bofs/BOF-misc.yaml at main · The-Z-Labs/cli4bofs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
---
name: ppenum
description: "Read the protection level of a process"
author: rasta-mouse
Arch: ["x64", "x86"]
tags: ['windows', 'host-recon']
OS: Windows
entrypoint: "go"
sources:
    - 'https://raw.githubusercontent.com/rasta-mouse/PPEnum/refs/heads/main/ppenum.c'
examples: '
'
arguments:
  - name: pid
    desc: "process PID"
    type: integer
    required: true
---
name: detect-hooks
description: "Attempts to detect userland API hooks in place by AV/EDR"
author: X-Force-Red
Arch: ["x64", "x86"]
tags: ['windows', 'host-recon', 'xforcered']
OS: Windows
entrypoint: "go"
sources:
    - 'https://raw.githubusercontent.com/xforcered/Detect-Hooks/refs/heads/main/src/detect-hooks.c'
    - 'https://raw.githubusercontent.com/xforcered/Detect-Hooks/refs/heads/main/src/detect-hooks.h'
examples: '
  detect-hooks
'
---
name: CredMan
description: "Dumps the credential manager by abusing the SeTrustedCredmanAccess Privilege"
author: jsecu
Arch: ["x64", "x86"]
tags: ['windows', 'lateral-movement']
OS: Windows
entrypoint: "go"
sources:
    - 'https://raw.githubusercontent.com/jsecu/CredManBOF/refs/heads/main/CredMan.c'
examples: '
  credman "filepath1" "filepath2" pid
'
arguments:
  - name: pid
    desc: "encrypted backup file location"
    type: wstring
    required: true
  - name: pid
    desc: "decrypted backup file location"
    type: wstring
    required: true
  - name: pid
    desc: "user process PID"
    type: integer
    required: true
---
name: No-consolation
srcfile: "entry"
description: "Attempts to detect userland API hooks in place by AV/EDR"
author: Fortra
Arch: ["x64", "x86"]
tags: ['windows', 'execution', 'fortra']
category: "Execution-BOF"
OS: Windows
entrypoint: "go"
sources:
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/source/apisetlookup.c'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/source/console.c'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/source/entry.c'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/source/hwbp.c'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/source/loader.c'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/source/peb.c'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/source/runner.c'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/source/utils.c'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/include/apisetlookup.h'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/include/bofdefs.h'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/include/console.h'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/include/entry.h'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/include/hwbp.h'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/include/loader.h'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/include/output.h'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/include/peb.h'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/include/runner.h'
  - 'https://raw.githubusercontent.com/fortra/No-Consolation/refs/heads/main/include/utils.h'
examples: '
'