Skip to content

Latest commit

 

History

History
66 lines (51 loc) · 2.29 KB

README.md

File metadata and controls

66 lines (51 loc) · 2.29 KB
Raw

Various BOF collection

Name Description
ChromiumKeyDump BOF implementation of Chlonium tool to dump Chrome/Edge Masterkey and download Cookie/Login Data files
Sleeper BOF to call the SetThreadExecutionState function to prevent host from Sleeping

How to compile:

  • Visual Studio:
x86:
"C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars32.bat"
cl.exe /c /GS- /TP BOF.cpp /FoBOF.o

x64:
"C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat"
cl.exe /c /GS- /TP BOF.cpp /FoBOF.x64.o
  • MinGW:
x86: i686-w64-mingw32-gcc -c BOF.cpp -o BOF.o
x64: x86_64-w64-mingw32-gcc -c BOF.cpp -o BOF.x64.o

After compiling, place the object files (.o) into the bin folder and load the (.cna) files to Cobalt Strike.

ChromiumKeyDump

Usage:

chromiumkeydump [edge|chrome] [argument(required)] [ChromePath(optional)]
                Arguments       Description
                ---------       -----------
                masterkey       Dump Masterkey
                cookies         Download Chrome Cookies file
                logindata       Download Chrome Login Data file
                all             Dump Masterkey and download files
                
                ChromePath      Path to custom installation directory
                                !Set the path to where the [User Data] folder is located!

                                Example: D:\\Programs\\
                                         C:\\Users\\USER\\AppData\\Local

References:

https://github.com/rxwx/chlonium

Sleeper

Usage:

sleeper [argument(required)]
               Arguments      Description
               ---------      -----------
               off            Set the `ES_CONTINUOUS` flag and return to Default state
               on             Set the `ES_SYSTEM_REQUIRED` flag to prevent the Sleep
               force          Set the `ES_SYSTEM_REQUIRED|ES_AWAYMODE_REQUIRED` flags to prevent the Sleep, 
                              even if the Sleep button is pressed

References:

https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-setthreadexecutionstate