项目介绍
项目地址：https://github.com/chryzsh/redteam-bofs
    一组用于开发后操作的信标对象文件（BOF）。包括凭证查找、系统枚举、事件日志分析和权限管理工具。

| Project          | Commands                                                                                                                                                                                                                                           | Deploy            | Source                         |
|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------|--------------------------------|
| cookie-monster   | cookie-monster                                                                                                                                                                                                                                     | with redteam-bofs | KingOfTheNOPs/cookie-monster   |
| Kerbeus-BOF      | krb_asktgt, krb_asktgs, krb_s4u, krb_ptt, krb_klist, krb_dump, etc.                                                                                                                                                                                | standalone        | RalfHacker/Kerbeus-BOF         |
| LNKgenerator-BOF | LNKgenerator                                                                                                                                                                                                                                       | with redteam-bofs | KingOfTheNOPs/LNKgenerator-BOF |
| SQL-BOF          | sql-whoami, sql-query, sql-xpcmd, sql-links, etc.                                                                                                                                                                                                  | standalone        | Tw1sm/SQL-BOF                  |
| OperatorsKit     | addtaskscheduler, credprompt                                                                                                                                                                                                                       | with redteam-bofs | REDMED-X/OperatorsKit          |
| PrivKit          | privcheck, privkit-alwaysinstallelevated, privkit-autologon, privkit-credmanager, privkit-hijackablepath, privkit-modifiableautorun, privkit-modifiablesvc, privkit-tokenprivileges, privkit-unquotedsvcpath, privkit-pshistory, privkit-uacstatus | with redteam-bofs | mertdas/PrivKit                |

| BOF                                    | Description                                                                                                                                   | Usage |
|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-------|
| adduser-domaingroup                    | Adds a user to a domain group via NetGroupAddUser, falling back to NetLocalGroupAddMembers for domain-local/builtin groups (target a DC)      | Usage |
| adduser-localgroup                     | Adds a user to a local group on a Windows computer                                                                                            | Usage |
| bkread                                 | Reads a file with SeBackupPrivilege and backup semantics, without changing ACLs                                                               | Usage |
| checkaccess                            | Probes read access for a directory path and subfolders (depth-1 or recursive)                                                                 | Usage |
| credguard-check                        | Checks Credential Guard, HVCI, LSA Protection, VBS status                                                                                     | Usage |
| curl                                   | HTTP/HTTPS requests with TLS fingerprinting                                                                                                   | Usage |
| decrypt-credmanager                    | Decrypts Windows Credential Manager entries using DPAPI                                                                                       | Usage |
| dpapi-unprotect                        | Decrypts an arbitrary DPAPI blob (with optional entropy) in the current user's context                                                        | Usage |
| dsreg-status                           | Reports documented dsregcmd /status device, tenant, user, and proxy state                                                                     | Usage |
| edge-passdump                          | Dumps plaintext passwords saved in Microsoft Edge from process memory                                                                         | Usage |
| enum-credmanager                       | Lists Windows Credential Manager entries (no decryption)                                                                                      | Usage |
| enum-creds                             | Credential-focused file enumeration with optional app-data discovery and inline content dump                                                  | Usage |
| enum-logon-events                      | Queries Security Event Log for logon events (4624)                                                                                            | Usage |
| enum-registry                          | Extracts RDP history, installed software, env vars, WSL/Docker info across all loaded user hives                                              | Usage |
| enum-stored-accounts                   | Lists service accounts, tasks with stored passwords, and per-profile DPAPI material (which tokens are worth stealing)                         | Usage |
| enum-user-right                        | Lists accounts assigned an effective LSA user right; defaults to SeMachineAccountPrivilege                                                    | Usage |
| fake-windows-popup-async (BOF-PE, x64) | Shows native Windows credential UI over a dimmed desktop; runs as an async BOF job so the beacon stays responsive                             | Usage |
| enumshares                             | Enumerate remote shares and test filesystem access (single host)                                                                              | Usage |
| enumshares-file                        | Enumerate remote shares from an uploaded hostnames file                                                                                       | Usage |
| listpipes                              | Lists named pipes for IPC reconnaissance                                                                                                      | Usage |
| lsfiles                                | Recursive file/directory listing with wildcards, date/size filters                                                                            | Usage |
| nslookup-file                          | Resolves a file of hostnames with parallel DNS queries                                                                                        | Usage |
| removeuser-domaingroup                 | Removes a user from a domain group via NetGroupDelUser, falling back to NetLocalGroupDelMembers for domain-local/builtin groups (target a DC) | Usage |
| removeuser-localgroup                  | Removes a user from a local group on a Windows computer (or a domain-local group when targeted at a DC)                                       | Usage |
| sccm-wmi                               | Recovers SCCM Network Access Account credentials from live WMI policy as SYSTEM (CRED-3)                                                      | Usage |
| sccm-disk                              | Recovers SCCM Network Access Account credentials from on-disk OBJECTS.DATA as SYSTEM (CRED-4)                                                 | Usage |
| sccm-local-recon                       | Local SCCM client recon: paths, cache permissions, ManagementPoints, log UNC/URL scraping (RECON-7)                                           | Usage |
| tcpscan                                | TCP connect scan of a single host                                                                                                             | Usage |
| tcpscan-file                           | TCP connect scan of hosts from an uploaded file (accepts nslookup-file output)                                                                | Usage |

红队工具BOF合集