Tag: Beacon Object File
-
Ghost in the Beacon: Mastering In-Memory PE Execution with BOF RunPE
BOF RunPE is a Beacon Object File for Cobalt Strike that executes PE files entirely in-memory within the beacon process. Unlike traditional fork&run, no child process is spawned, no console is created, and no pipe is used – all output is captured via IAT hooking and redirected to the beacon console. Key Features No Process Creation: PE…
-
BOF-PE: New PE Concept Revolutionizes C2 Capabilities with Full C++ Support
Beacon Object File (BOF) support has been at the cornerstone of capability for any modern C2 platform since its inception by Cobalt Strike 4.1 back in 2020. It was a major step forward towards integrating a modular and extensible design whilst still being able to interact with the C2 platform itself via the Beacon API.…
-
No-Consolation: Stealthy In-Memory PE Execution for Beacon
No-Consolation This is a Beacon Object File (BOF) that executes unmanaged PEs inline and retrieves their output without allocating a console (i.e. spawning conhost.exe). Feature Supports 64 and 32 bits Supports EXEs and DLLs Does not create new processes Links modules to the PEB Saves binaries in memory Supports C++ exceptions (x64 only) Custom loads…