FindObjects-BOF : A Cobalt Strike Beacon Object File (BOF) Project Which Uses Direct System Calls To Enumerate Processes For Specific Loaded Modules Or Process Handles

FindObjects-BOF is a Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles.

What Is This Repository For?

  • Use direct systems calls within Beacon Object files to enumerate processes for specific loaded modules (e.g. winhttp.dll, amsi.dll or clr.dll).
  • Use direct systems calls within Beacon Object files to enumerate processes for specific process handles (e.g. lsass.exe).
  • Avoid using the Windows and Native APIs as much as possible (to avoid userland hooks).
  • Execute this code within the beacon process using Beacon object files to avoid fork&run.

Why Do I Need This?

Utilizing direct systems calls via inline assembly in BOF code provides a more opsec safe way of interacting with the system. Using direct system calls avoids AV/EDR software intercepting user-mode API calls.

  • The FindModule bof can be used to identify processes which have a certain module loaded, for example the .NET runtime clr.dll or the winhttp.dll module. This information can be used to select a more opsec safe spawnto candidate when using Cobalt Strike’s execute-assembly or before injecting an exfill beacon shellcode using the shinject command.
  • The FindProcHandle bof can be used to identify processes with a specific process handle in use, for example processes using a handle to the lsass.exe process. If there’s a process within the system with a lsass.exe process handle, we could use this existing process/handle to read or write memory without opening a new process handle. This bypasses certain AV/EDR’s capabilities of detecting and blocking LSASS process/memory access.

How Do I Set This Up?

We will not supply compiled binaries. You will have to do this yourself:

  • Clone this repository.
  • Make sure you have the Mingw-w64 compiler installed. On Mac OSX for example, you can use the ports collection to install Mingw-w64 (sudo port install mingw-w64).
  • Run the make command to compile the Beacon object file.
  • Within Cobalt Strike use the Script Manager to load the FindObjects.cna script.
  • Within a Cobalt Strike beacon context use the FindProcHandle or FindModule command with the required parameters (e.g. module or process name).