GetProcAddress, LoadLibraryA, GetModuleHandle, and FreeLibrary are available within BOF files. BeaconOutput is an internal Beacon API to send output to the operator. It's the function that's called by inline-execute and arguments are passed to it.

The function go is similar to main in any other C program. Use inline-execute in Beacon to run the BOF.Д«eacon> inline-execute /path/to/hello.o these are argumentsД«eacon.h contains definitions for several internal Beacon APIs. The above commands will produce a hello.o file. The same exploit, built as a BOF, is Д«eaconPrintf(CALLBACK_OUTPUT, 'Hello World: %s', args) A UAC bypass privilege escalation Reflective DLL implementation may weigh in at 100KB+. They run inside of a Beacon process and are cleaned up after the capability is done.Д«OFs are also very small.

These tools rely on an OPSEC expensive fork&run pattern that involves a process create and injection for each post-exploitation action. Cobalt Strike already has tools to use PowerShell. One of the key roles of an command&control platform is to provide ways to use external post-exploitation functionality. Way to rapidly extend the Beacon agent with new post-exploitation features. A Beacon Object File (BOF) is a compiled C program, written to a convention that allows it to execute within a Beacon process and use internal Beacon APIs.

Cobalt strike beacon setup