Skip to content

Commit 2da573a

Browse files
committed
Update README.md
1 parent 3d3e79a commit 2da573a

File tree

1 file changed

+38
-1
lines changed

1 file changed

+38
-1
lines changed

README.md

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,43 @@ You can also use the shorthand method of just the class name, but this will only
4949
bofnet_execute HelloWorld @_EthicalChaos_
5050
```
5151

52+
## Cobalt Strike Client Integrations
53+
54+
The BeaconObject class implements functionality to allow custom implementations of screen capture, file downloads (from memory 😊), keylogger and hash dumps. If, for example, the built in keylogger or screen capture implementation is causing Windows Defender or other AV engines to kill your beacon, you can implement your own. The relevant functions are documented below.
55+
56+
```C#
57+
void SendScreenShot(byte[] jpgData, int session, string userName, string title)
58+
```
59+
* `jpgData` Raw JPEG image data.
60+
* `session` User session id the screen capture was taken from.
61+
* `userName` The user name running under the session.
62+
* `title` The title of the window to name for the screen shot.
63+
64+
```C#
65+
SendKeystrokes(string keys, int session, string userName, string title)
66+
```
67+
68+
* `keys` The sequence of keys captured.
69+
* `session` User session id the screen capture was taken from.
70+
* `userName` The user name running under the session.
71+
* `title` The title of the window to application the keys were captured from.
72+
73+
```C#
74+
DownloadFile(string fileName, Stream fileData)
75+
```
76+
77+
* `fileName` The file name to use for the metadata within beacon.
78+
* `fileData` A readable stream that will be used for the file content.
79+
80+
`DownloadFile` will lock beacon and become unresponsive until the download completes!
81+
82+
83+
```C#
84+
SendHashes(UserHash[] userHashes)
85+
```
86+
87+
* `userHashes` A collection of usernames that have been captured.
88+
5289
## Beacon Command Reference
5390

5491
| Command | Description |
@@ -63,7 +100,7 @@ bofnet_execute HelloWorld @_EthicalChaos_
63100
| bofnet_jobs | List all currently active BOF.NET jobs |
64101
| bofnet_jobstatus *job_id* | Dump any pending console buffer from the background job |
65102
| bofnet_jobkill *job_id* | Dump any pending console buffer from the background job then kill it. Warning, can cause deadlocks when terminating a thread that have transitioned into native code |
66-
| bofnet_boo *booscript.boo* | Compile and execute Boo script in seperate temporary AppDomain |
103+
| bofnet_boo *booscript.boo* | Compile and execute Boo script in seperate temporary AppDomain |
67104

68105
## Caveats
69106

0 commit comments

Comments
 (0)