CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
/*
2
 * Beacon Object Files (BOF)
3
 * -------------------------
4
 * A Beacon Object File is a light-weight post exploitation tool that runs
5
 * with Beacon's inline-execute command.
6
 *
7
 * Additional BOF resources are available here:
8
 *   - https://github.com/Cobalt-Strike/bof_template
9
 *
10
 * Cobalt Strike 4.x
11
 * ChangeLog:
12
 *    1/25/2022: updated for 4.5
13
 */
14

15
/* data API */
16
typedef struct {
17
	char * original; /* the original buffer [so we can free it] */
18
	char * buffer;   /* current pointer into our buffer */
19
	int    length;   /* remaining length of data */
20
	int    size;     /* total size of this buffer */
21
} datap;
22

23
DECLSPEC_IMPORT void    BeaconDataParse(datap * parser, char * buffer, int size);
24
DECLSPEC_IMPORT char *  BeaconDataPtr(datap * parser, int size);
25
DECLSPEC_IMPORT int     BeaconDataInt(datap * parser);
26
DECLSPEC_IMPORT short   BeaconDataShort(datap * parser);
27
DECLSPEC_IMPORT int     BeaconDataLength(datap * parser);
28
DECLSPEC_IMPORT char *  BeaconDataExtract(datap * parser, int * size);
29

30
/* format API */
31
typedef struct {
32
	char * original; /* the original buffer [so we can free it] */
33
	char * buffer;   /* current pointer into our buffer */
34
	int    length;   /* remaining length of data */
35
	int    size;     /* total size of this buffer */
36
} formatp;
37

38
DECLSPEC_IMPORT void    BeaconFormatAlloc(formatp * format, int maxsz);
39
DECLSPEC_IMPORT void    BeaconFormatReset(formatp * format);
40
DECLSPEC_IMPORT void    BeaconFormatAppend(formatp * format, char * text, int len);
41
DECLSPEC_IMPORT void    BeaconFormatPrintf(formatp * format, char * fmt, ...);
42
DECLSPEC_IMPORT char *  BeaconFormatToString(formatp * format, int * size);
43
DECLSPEC_IMPORT void    BeaconFormatFree(formatp * format);
44
DECLSPEC_IMPORT void    BeaconFormatInt(formatp * format, int value);
45

46
/* Output Functions */
47
#define CALLBACK_OUTPUT      0x0
48
#define CALLBACK_OUTPUT_OEM  0x1e
49
#define CALLBACK_OUTPUT_UTF8 0x20
50
#define CALLBACK_ERROR       0x0d
51

52
DECLSPEC_IMPORT void   BeaconOutput(int type, char * data, int len);
53
DECLSPEC_IMPORT void   BeaconPrintf(int type, char * fmt, ...);
54

55

56
/* Token Functions */
57
DECLSPEC_IMPORT BOOL   BeaconUseToken(HANDLE token);
58
DECLSPEC_IMPORT void   BeaconRevertToken();
59
DECLSPEC_IMPORT BOOL   BeaconIsAdmin();
60

61
/* Spawn+Inject Functions */
62
DECLSPEC_IMPORT void   BeaconGetSpawnTo(BOOL x86, char * buffer, int length);
63
DECLSPEC_IMPORT void   BeaconInjectProcess(HANDLE hProc, int pid, char * payload, int p_len, int p_offset, char * arg, int a_len);
64
DECLSPEC_IMPORT void   BeaconInjectTemporaryProcess(PROCESS_INFORMATION * pInfo, char * payload, int p_len, int p_offset, char * arg, int a_len);
65
DECLSPEC_IMPORT BOOL   BeaconSpawnTemporaryProcess(BOOL x86, BOOL ignoreToken, STARTUPINFO * si, PROCESS_INFORMATION * pInfo);
66
DECLSPEC_IMPORT void   BeaconCleanupProcess(PROCESS_INFORMATION * pInfo);
67

68
/* Utility Functions */
69
DECLSPEC_IMPORT BOOL   toWideChar(char * src, wchar_t * dst, int max);
70

71