BOF Reference

All 431 built-in BOFs (217 Windows + 115 Linux + 99 macOS) organized by category. Each BOF is called by its short name at the operator console. Linux BOFs run natively on macOS — the same POSIX .so format is loaded by the agent’s module loader on both platforms. 16 Linux-only BOFs (cgroup_escape, nsenter_host, persist_systemd, persist_preload, etc.) are filtered from macOS. macOS ships with platform-specific overrides for persist-cron and persist-bashrc.

Windows BOFs (217)

Recon (18 BOFs)

BOF	Description	Usage
cat	Display remote file contents	cat <path>
clipboard	Read clipboard text contents	clipboard
drives	Enumerate logical drives (type, free/total)	drives
get_priv	Enable privilege (~prefix for thread token)	get_priv <privilege>
get_productid	Read Windows ProductId for —machine-lock builds	get-productid
handles	List open handles for current process	handles
hostname	Print computer hostname	hostname
keylog	Keylogger (GetAsyncKeyState, tracks window title)	keylog start, keylog stop, keylog dump
listhandles	List open handles for target process	listhandles <pid>
ls	List directory (default: .\*)	ls [path]
pid	Show current process ID	pid
ppid	Show current PID, parent PID, and parent name	ppid
ps	List running processes (PID, name, user, arch)	ps
pwd	Print remote working directory	pwd
screenshot	Capture desktop to BMP	screenshot [path]
sysinfo	OS version, hostname, domain, arch	sysinfo
tokeninfo	Token details for current process	tokeninfo
whoami	Current user, privileges, and group memberships	whoami

Host Enumeration (15 BOFs)

BOF	Description	Usage
adv_audit_policies	Query advanced audit policy settings	adv_audit_policies
driversigs	Enumerate loaded driver signatures	driversigs
enum_local_sessions	Enumerate local interactive sessions	enum_local_sessions
env	Environment variables	env
find_loaded_module	Find processes with specific DLL loaded	find_loaded_module <dll>
get_dpapi_system	Retrieve DPAPI system master keys	get_dpapi_system
get_session_info	Current session info (ID, user, state)	get_session_info
ipconfig	Network adapter configuration	ipconfig
listmods	List loaded modules for process	listmods <pid>
locale	System locale and language info	locale
resources	System resource usage stats	resources
uptime	System uptime	uptime
useridletime	User idle/last input time	useridletime
whoami_full	Detailed whoami (all tokens, groups, privileges)	whoami_full
windowlist	Enumerate visible windows	windowlist

Execution (3 BOFs)

BOF	Description	Usage
cmd	Run shell command (cmd.exe /C)	cmd <command>
execute_assembly_inproc	Run .NET assembly in-process (full evasion)	execute-assembly [-r <ver>] <path> [args]
powershell	Run PowerShell command (hidden, no profile)	powershell <command>

File Operations (7 BOFs)

BOF	Description	Usage
cd	Change remote working directory	cd <path>
cp	Copy remote file	cp <src> <dst>
mkdir	Create remote directory	mkdir <path>
motw_remove	Remove Mark of the Web (Zone.Identifier ADS)	motw_remove <path>
mv	Move/rename remote file	mv <src> <dst>
rm	Delete remote file	rm <path>
upload	Upload local file to remote path	upload <local> <remote>

File & Hash (6 BOFs)

BOF	Description	Usage
cacls	File/folder ACL permissions	cacls <path>
dir	Directory listing with depth control	dir <path> [depth]
md5	MD5 hash of file	md5 <path>
sha1	SHA1 hash of file	sha1 <path>
sha256	SHA256 hash of file	sha256 <path>
vssenum	Enumerate Volume Shadow Copies	vssenum

Network (16 BOFs)

BOF	Description	Usage
arp	ARP table (neighbor cache)	arp
list_firewall_rules	Enumerate Windows Firewall rules	list_firewall_rules
listdns	DNS client cache entries	listdns
netloggedon	Enumerate logged-on users	netloggedon [host]
netloggedon_wts	Logged-on users (WTS API)	netloggedon_wts [host]
netsession	Enumerate net sessions (level 0 or 10)	netsession [host]
netsession_sweep	Net sessions — domain-wide DC sweep	netsession_sweep
netshares	Enumerate network shares	netshares [host]
netstat	Active TCP/UDP connections and listeners	netstat
netuptime	Remote host uptime via NetRemoteTOD	netuptime <host>
netuse	Map/list network drives (NetUseEnum)	netuse [host]
netview	Enumerate network shares and machines	netview
nslookup	DNS lookup (A/AAAA/ANY)	nslookup <domain>
probe	TCP port connectivity check	probe <host> <port>
routeprint	IP routing table	routeprint

Lateral Movement (4 BOFs)

BOF	Description	Usage
psexec	Lateral move via SCM service create/start	psexec <host> <cmd>
smb_upload	Copy file to remote host via SMB/UNC	smb_upload <local> <\\host\share\path>
winrm	Remote exec via WinRM (port 5985)	winrm <host> <command>
wmi_exec	Remote exec via WMI (Win32_Process.Create)	wmi_exec <host> <user> <pass> <cmd>

Privilege Escalation (3 BOFs)

BOF	Description	Usage
getsystem_token	Admin→SYSTEM via winlogon.exe token theft	getsystem_token
uacbypass_com	UAC bypass via CMSTPLUA COM + PEB masquerade	uacbypass_com <command>
uacbypass_tasksched	UAC bypass via VFServer factory + TaskScheduler	uacbypass_tasksched <command>

Privesc Enumeration (7 BOFs)

BOF	Description	Usage
enum_autoruns	Autorun entries with path/permission checks	enum_autoruns
enum_netlisteners	TCP/UDP listening ports with owning process	enum_netlisteners
enum_patches	Installed hotfixes/KBs for exploit matching	enum_patches
enum_persistence	WMI subs, writable PATH, extension handlers	enum-persistence [all|wmi|path|ext]
enum_schtasks	Non-MS scheduled tasks with writable actions	enum_schtasks
enum_services	Services with unquoted paths, modifiable configs	enum_services
privesc_checks	AlwaysInstallElevated, UAC, WDigest, LAPS, LSA	privesc_checks

Credential Dumping (12 BOFs)

BOF	Description	Usage
dump_chrome	Dump Chrome cookies/logins (App-Bound Encryption v20+)	dump-chrome [cookies|logins|all]
dump_chromium	Dump all Chromium browser creds (Chrome/Edge/Brave/Opera/Vivaldi)	dump-chromium [logins|cookies] [browser]
dump_firefox	Dump Firefox cookies/logins from all profiles	dump-firefox [cookies|logins|all]
dump_certs	Export certs with private keys as PFX from cert stores	dump-certs [user|machine|all]
dump_vault	Decrypt Windows Vault/Credential Manager entries	dump-vault
hashdump	Dump SAM/SYSTEM/SECURITY hives (parse with secretsdump)	hashdump
nanodump	Dump LSASS to file	nanodump [path]
nanodump_handledup	LSASS dump via handle duplication	nanodump-handledup
nanodump_spe	LSASS dump via WerFault Silent Process Exit (LOLBin)	nanodump-spe <dump|check|cleanup> [folder]
nanodump_spe_nopdata	LSASS dump via SPE without ProcData	nanodump-spe-nopdata
racecond_dump	LSASS dump via race condition	racecond-dump
rdp_thief	RDP credential theft via HWBP hooks in mstsc.exe	rdp-thief <inject|collect|eject> [pid]
samdump	In-memory SAM hash extraction via registry API (no files)	samdump
spe_dump	LSASS dump via Silent Process Exit	spe-dump

Credential Hunting (7 BOFs)

BOF	Description	Usage
autologon	Auto-logon creds in Winlogon registry	autologon
cred_files	Scan for credential files (web.config, .kdbx, etc)	cred_files
dpapi_creds	DPAPI decrypt Credential Manager entries	dpapi_creds
dpapi_keys	DPAPI master key file enumeration	dpapi_keys
enum_creds	Credential Manager entries (generic/domain)	enum_creds
psh_history	PowerShell ConsoleHost_history.txt (all users)	psh_history
wifi_passwords	Saved WiFi profiles and plaintext keys	wifi_passwords

Token Manipulation (4 BOFs)

BOF	Description	Usage
getuid	Show current identity (thread or process token)	getuid
make_token	Create token with alternate network credentials	make_token <domain\user> <password>
rev2self	Revert to original process identity	rev2self
steal_token	Steal and impersonate token from target process	steal_token <pid>

Persistence (7 BOFs)

BOF	Description	Usage
chrome_persist_install	Silent Chrome/Edge extension install (HMAC recalc)	chrome-persist-install [--browser chrome|edge] --server URL [--profile name] [--cover name] [--force]
chrome_persist_remove	Remove silently installed Chrome/Edge extension	chrome-persist-remove [--browser chrome|edge] [--force]
persist_comhijack	COM hijack persistence (install/remove/check)	persist-comhijack install <dll_path>, persist-comhijack remove, persist-comhijack check
persist_registry	Registry persistence (run/userinit/shell/ifeo/appinit/activeset)	persist-registry <method> <install|remove|check> [name] [payload]
persist_schtask	Scheduled task persistence (logon trigger)	persist_schtask <name> <exe_path>
persist_wmi	WMI event subscription persistence (survives reboot)	persist-wmi <install|remove|check> <name> [trigger] [payload]

Evasion (3 BOFs)

BOF	Description	Usage
detect_hooks	Scan ntdll/kernel32/kernelbase for EDR hooks	detect_hooks
etw_hijack	Blind ETW sessions by restarting with fake log	etw-hijack
unhook_dllnotif	Remove EDR DLL load notification callbacks	unhook_dllnotif

Injection (4 BOFs)

BOF	Description	Usage
createremotethread	Inject shellcode via CreateRemoteThread	createremotethread <pid> <bin_path>
knowndll_poison	Replace \KnownDlls handle, hijack DLL load	knowndll-poison <pid> <dll> <payload>
shspawnas	Spawn-as with creds + APC shellcode inject	shspawnas <domain\user> <pass> <bin_path>
threadless_inject	Threadless injection via export hook	threadless-inject <pid> <dll> <export> <shellcode>

Process Operations (3 BOFs)

BOF	Description	Usage
procdump	MiniDump process memory to file	procdump <pid> [path]
processdestroy	Close handles in target process	processdestroy <pid>
suspendresume	Suspend or resume a process	suspendresume <pid> suspend, suspendresume <pid> resume

User Management (5 BOFs)

BOF	Description	Usage
adduser	Add local/remote user account	adduser <name> <password> [host]
addusertogroup	Add user to group (global, falls back local)	addusertogroup <user> <group>
disableuser	Disable user account	disableuser <user>
enableuser	Enable/unlock user account	enableuser <user>
setuserpass	Set user password	setuserpass <user> <password>

Service Control (5 BOFs)

BOF	Description	Usage
sc_create	Create Windows service	sc_create <name> <binpath>
sc_delete	Delete service	sc_delete <name>
sc_start	Start service	sc_start <name>
sc_stop	Stop service (handles dependents)	sc_stop <name>
sc_trigger	Add device-arrival trigger to service	sc-trigger <name> <device>

Services & Tasks (9 BOFs)

BOF	Description	Usage
enum_filter_driver	Enumerate filesystem filter drivers (EDR)	enum_filter_driver
sc_enum	Enumerate services	sc_enum
sc_qc	Query service configuration	sc_qc <name>
sc_qdescription	Query service description	sc_qdescription <name>
sc_qfailure	Query service failure actions	sc_qfailure <name>
sc_qtriggerinfo	Query service trigger info	sc_qtriggerinfo <name>
sc_query	Query service status	sc_query <name>
schtasksenum	Enumerate scheduled tasks	schtasksenum
schtasksquery	Query specific scheduled task	schtasksquery <name>

Registry (4 BOFs)

BOF	Description	Usage
reg_delete	Delete registry key or value	reg_delete <key> [value]
reg_query	Query registry key/value remotely	reg_query <host> <key> [value]
reg_save	Save registry key to file	reg_save <key> <path>
reg_set	Set registry value	reg_set <key> <value> <data> <type>

Environment Recon (8 BOFs)

BOF	Description	Usage
defender_config	Defender status, exclusions, ASR rules, tamper	defender_config
defender_ctrl	Disable/enable RTP, add/remove path exclusions	defender-ctrl <action> [path]
enum_dns_cache	DNS resolver cache dump (internal host mapping)	enum_dns_cache
enum_firewall	Firewall profiles, default actions, enabled rules	enum_firewall
enum_pipes	Named pipes (services, IPC, impersonation targets)	enum_pipes
path_hijack	Writable PATH directories for DLL hijacking	path_hijack
sysmon_detect	Detect Sysmon service, driver, event log, binary	sysmon_detect
wsus_config	WSUS HTTP server check (WSUS injection)	wsus_config

AD Recon (2 BOFs)

BOF	Description	Usage
enum_adcs	AD CS template misconfigs (ESC1-ESC4, ESC6, ESC8)	enum_adcs
enum_kerberoast	Kerberoastable accounts (users with SPNs)	enum_kerberoast

Active Directory (15 BOFs)

BOF	Description	Usage
aadjoininfo	Azure AD join info for host	aadjoininfo
adcs_enum	Enumerate AD Certificate Services templates	adcs_enum
adcs_enum_com	ADCS enumeration via COM interface	adcs_enum_com
adcs_enum_com_alt	ADCS enumeration via COM (alternate method)	adcs_enum_com_alt
get_password_policy	Query domain/local password policy	get_password_policy
ldapsearch	LDAP search with custom filter	ldapsearch <filter> [attrs]
ldapsecuritycheck	LDAP security config audit	ldapsecuritycheck
netgroup	Enumerate domain groups / members	netgroup [group]
netlocalgroup	Enumerate local groups / members	netlocalgroup [group]
netlocalgroup_api	Local group membership (NetLocalGroupGetMembers)	netlocalgroup_api <group>
netuser	Detailed user account info	netuser <user>
netuserenum	Enumerate domain/local users	netuserenum
regsession	Enumerate registry-based sessions	regsession
tasklist	WMI process list (remote capable)	tasklist [host]
wmi_query	Run arbitrary WMI query	wmi_query <query>

System (1 BOF)

BOF	Description	Usage
shutdown	Shutdown or reboot (local/remote)	shutdown [host]

Chrome Extension (6 BOFs)

Commands available when a Chrome extension is installed via chrome-persist-install. These execute in the browser context, not the implant process.

BOF	Description	Usage
ext_cookies	Dump browser cookies (optional domain filter)	ext-cookies [domain]
ext_history	Browse history (default 100, optional search)	ext-history [query] [max]
ext_navigate	Navigate active tab to URL	ext-navigate <url>
ext_nmh	Execute commands via Native Messaging Host proxy	ext-nmh <cmd|whoami|ps|ping> [cmdline]
ext_screenshot	Capture visible tab as PNG screenshot	ext-screenshot
ext_tabs	List open browser tabs (URL, title)	ext-tabs

Cloud — AWS (15 BOFs)

BOFs for on-prem to cloud lateral movement. Discover cloud credentials on compromised hosts, validate and pivot into AWS infrastructure, and access cloud resources — all from the implant with no external tools. Both Windows COFF and Linux .so variants.

Credential Discovery & Validation:

BOF	Description	Usage
aws_whoami	STS GetCallerIdentity — validate creds, show account/ARN	aws-whoami [AK SK [token] [region]]
aws_imds_creds	Extract IAM role credentials from EC2 IMDS (v1/v2)	aws-imds-creds
aws_iam_enum	Enumerate IAM user/role policies and permissions	aws-iam-enum [AK SK [token] [region]]
aws_assume_role	STS AssumeRole to pivot into higher-privilege role	aws-assume-role <role_arn> [AK SK [token] [region]]
aws_cred_search	Scan filesystem, env vars, SSO caches, Credential Manager, and process memory for AWS credentials	aws-cred-search

Cloud Resource Access:

BOF	Description	Usage
aws_s3_ls	List S3 buckets and objects	aws-s3-ls [bucket[/prefix]] [AK SK [token] [region]]
aws_s3_get	Download S3 object contents	aws-s3-get <bucket> <key> [AK SK [token] [region]]
aws_ec2_enum	Enumerate EC2 instances (ID, type, IP, state)	aws-ec2-enum [AK SK [token] [region]]
aws_lambda_enum	List Lambda functions	aws-lambda-enum [AK SK [token] [region]]
aws_secrets_manager	List and read Secrets Manager secrets	aws-secrets-manager [secret_name] [AK SK [token] [region]]
aws_ssm_params	Read SSM Parameter Store parameters by path	aws-ssm-params [path] [AK SK [token] [region]]
aws_ec2_userdata	Read EC2 user-data scripts via IMDS (often contains creds)	aws-ec2-userdata

Lateral Movement:

BOF	Description	Usage
aws_ssm_exec	Execute commands on EC2 via SSM SendCommand (no direct connection)	aws-ssm-exec <instance_id> <command> [AK SK [token] [region]]
aws_lambda_exec	Invoke Lambda function with controlled input	aws-lambda-exec <function_name> [payload] [AK SK [token] [region]]
aws_ec2_connect	Push temporary SSH key via EC2 Instance Connect (60s window)	aws-ec2-connect <instance_id> <ssh_pubkey> [user] [AK SK [token] [region]]

All AWS BOFs support explicit credentials (AK SK [token] [region]) or auto-discover from IMDS/environment when run on EC2. JSON response parsing is built-in — no external tools or libraries required.

Cloud — Azure (8 BOFs)

BOFs for Azure resource enumeration and lateral movement via the Azure Resource Manager API. Authenticate with a managed identity token from IMDS or an operator-supplied Bearer token. Both Windows COFF and Linux .so variants.

BOF	Description	Usage
azure_imds_token	Request managed identity OAuth2 token from Azure IMDS	azure-imds-token [resource]
azure_cred_search	Search environment and metadata for Azure credentials	azure-cred-search
azure_whoami	Identify current Azure principal (subscriptions + tenant)	azure-whoami [token]
azure_keyvault	List Key Vault secrets and retrieve secret values	azure-keyvault <vault> [secret] [token]
azure_storage_ls	List Azure Storage containers and blobs	azure-storage-ls <account> [container] [token]
azure_blob_get	Download blob content from Azure Storage	azure-blob-get <account> <container> <blob> [token]
azure_vm_enum	Enumerate Azure VMs across subscriptions	azure-vm-enum [subscription] [token]
azure_vm_runcommand	Execute commands on Azure VMs via Run Command API	azure-vm-runcommand <vm> <rg> <subscription> <cmd> [token]

Cloud — Entra ID (14 BOFs)

BOFs for Microsoft Entra ID (Azure AD) identity-plane enumeration, credential access, and privilege escalation via the Microsoft Graph API. Authenticate with a managed identity token from IMDS or an operator-supplied Bearer token. Both Windows COFF and Linux .so variants.

Identity Enumeration:

BOF	Description	Usage
entra_whoami	Show current Entra ID identity (tenant, UPN, roles)	entra-whoami [token]
entra_users	List Entra ID users with key attributes	entra-users [token]
entra_groups	List Entra ID groups	entra-groups [token]
entra_group_members	List members of an Entra ID group	entra-group-members <group_id> [token]
entra_roles	List Entra ID directory roles and assignments	entra-roles [token]
entra_role_members	List members of a specific directory role	entra-role-members <role_id> [token]
entra_sps	List Entra ID service principals	entra-sps [token]
entra_condaccess	List conditional access policies	entra-condaccess [token]

Credential & Secret Access:

BOF	Description	Usage
entra_app_secrets	List application registrations with credentials	entra-app-secrets [token]
entra_app_add_secret	Add a client secret to an application registration	entra-app-add-secret <object_id> [token] [display_name]
entra_oauth_grants	List OAuth2 permission grants (delegated permissions)	entra-oauth-grants [token]

Privilege Escalation:

BOF	Description	Usage
entra_role_assign	Assign a directory role to a principal	entra-role-assign <role_id> <principal_id> [token]
entra_app_roles	List app role assignments for a service principal	entra-app-roles <sp_id> [token]
entra_pim	List PIM eligible role assignments	entra-pim [token]

All Azure and Entra ID BOFs support explicit Bearer tokens or auto-discover from Azure IMDS when run on an Azure VM with a managed identity. JSON response parsing is built-in — no external tools or Azure CLI required.

Cloud — GCP (8 BOFs)

BOFs for GCP resource enumeration and lateral movement via GCP REST APIs. Authenticate with a service account OAuth2 token from the GCP metadata server or an operator-supplied Bearer token. Both Windows COFF and Linux .so variants.

Credential Discovery & Validation:

BOF	Description	Usage
gcp_metadata_token	Steal service account OAuth2 token from GCP metadata server	gcp-metadata-token
gcp_cred_search	Scan filesystem for GCP credential files (ADC, service account keys, gcloud configs)	gcp-cred-search
gcp_whoami	Identify current GCP principal, project, and token scopes	gcp-whoami [token]

Cloud Resource Access:

BOF	Description	Usage
gcp_vm_enum	Enumerate GCE instances across all zones	gcp-vm-enum [token [project_id]]
gcp_storage_ls	List GCS buckets or objects	gcp-storage-ls [bucket] [token [project_id]]
gcp_storage_get	Download object from GCS (up to 4MB)	gcp-storage-get <bucket> <object> [token]
gcp_secrets	List or retrieve secrets from Secret Manager	gcp-secrets [secret_name] [token [project_id]]
gcp_iam_enum	Enumerate service accounts and IAM policy	gcp-iam-enum [token [project_id]]

All GCP BOFs support explicit Bearer tokens or auto-discover from the GCP metadata server when run on a GCE instance with a service account. JSON response parsing is built-in — no gcloud CLI required.

---

Linux/macOS BOFs (115 Linux / 99 macOS)

Recon (18 BOFs)

BOF	Description	Usage
arp_table	ARP/neighbor cache for host discovery	arp-table
cat	Read file contents (1MB max)	cat <path>
cloud_detect	Detect AWS/GCP/Azure/DO via DMI/cloud-init	cloud-detect
container	Detect Docker/K8s/LXC/VM environment	container
crons	Enumerate crontabs, systemd timers, at jobs	crons
dmesg_leaks	Scan dmesg for kernel pointers and credentials	dmesg-leaks
dns	DNS lookup (forward or reverse)	dns <host|ip> [-r]
env	Environment variables	env
fstab_mounts	Parse fstab/mounts for nosuid gaps, cred leaks	fstab-mounts
hostname	System hostname	hostname
id	uid/gid/groups (like id command)	id
ifconfig	Network interfaces (IPv4/IPv6, flags)	ifconfig
ls	Directory listing with permissions	ls [path]
netstat	TCP/UDP connections from /proc/net	netstat
pid	Agent PID and image path	pid
ppid	Agent PID, parent PID, and parent image	ppid
ps	List processes from /proc	ps
pwd	Current working directory	pwd
uname_mod	Kernel version and system info	uname
unix_sockets	Find writable UNIX sockets owned by root	unix-sockets
whoami	Current user (uid/euid)	whoami

File Operations (7 BOFs)

BOF	Description	Usage
cd	Change agent working directory	cd <path>
chmod	Change file permissions (octal mode)	chmod <mode> <path>
cp	Copy file (preserves permissions)	cp <src> <dst>
mkdir	Create directory (-p for recursive)	mkdir <path> [-p]
mv	Move/rename file or directory	mv <src> <dst>
rm	Remove file/directory (-r recursive)	rm <path> [-r]
upload	Upload file to remote path	upload <local> <remote>

Execution (2 BOFs)

BOF	Description	Usage
bash	Execute command via /bin/bash -c (stderr merged)	bash <command>
sh	Execute command via /bin/sh (stderr merged)	sh <command>

Credential Access (8 BOFs)

BOF	Description	Usage
backup_files	Find .bak, .sql, .db, .kdbx backup files	backup-files
history	Read shell history files for all users	history
kerberos_enum	Keytabs, krb5cc caches, Samba/SSSD credential DBs	kerberos-enum
mail_enum	Read user mail for credentials (/var/mail)	mail-enum
passwd_policy	Password aging, complexity, login.defs policy	passwd-policy
proc_creds	Find cred files in /proc/fd and secrets in environ	proc-creds
shadow	Read /etc/shadow password hashes	shadow
sshkeys	Harvest SSH keys from all users	sshkeys

Privilege Escalation (11 BOFs)

BOF	Description	Usage
caps	Enumerate process and file capabilities	caps
kernel_suggest	Suggest kernel exploits by version (CVE database)	kernel-suggest
ldso_hijack	Check ld.so.preload/conf for writable paths	ldso-hijack
pam_audit	Audit PAM configs for rogue auth modules	pam-audit
passwd_add	Add uid=0 user to /etc/passwd (needs write access)	passwd-add <user> <pass>
profile_d_perms	Writable scripts in profile.d, init.d, cron.d	profile-d-perms
sudo_check	Check sudo -l for NOPASSWD and GTFOBins abuse	sudo-check
sudo_tokens	Check for reusable sudo timestamp tokens	sudo-tokens
suid	Find SUID/SGID binaries	suid
svc_misconfig	Audit systemd services for writable ExecStart	svc-misconfig
sys_protections	ASLR, ptrace, seccomp, AppArmor, SELinux status	sys-protections
writable	Find writable sensitive files and PATH binaries	writable

Persistence (4 BOFs)

BOF	Description	Usage
persist_bashrc	Shell profile hook (.bashrc/.profile injection)	persist-bashrc <cmd> [target]
persist_cron	Crontab persistence (default */5 * * * *)	persist-cron <cmd> [sched]
persist_preload	LD_PRELOAD persistence (requires root)	persist-preload <so_path>
persist_systemd	Systemd service (user if non-root, system if root)	persist-systemd <name> <cmd>

Lateral Movement (4 BOFs)

BOF	Description	Usage
portscan	TCP connect scan with async sockets	portscan <host> [ports]
ssh_copy	Copy file to remote host via SCP	ssh-copy <src> <user@host:dst> [key]
ssh_exec	Execute command via SSH on remote host	ssh-exec <user@host> <cmd> [key]
ssh_spray	Spray all discovered SSH keys against target	ssh-spray <host> [users]

Evasion (4 BOFs)

BOF	Description	Usage
filehide	Hide file (dot rename, immutable attr, or both)	filehide <path> [method]
logclean	Scrub utmp/wtmp/btmp/lastlog + auth.log/secure	logclean <user> [host]
procmask	Change process name via prctl (e.g. kworker/0:1)	procmask <name>
timestomp	Copy timestamps from reference file or set explicit	timestomp <file> <ref|time>

Container Escape (5 BOFs)

BOF	Description	Usage
cgroup_escape	Cgroup v1 release_agent host command execution	cgroup-escape <cmd>
docker_sock	Docker socket escape — run cmd on host via container	docker-sock [sock] [cmd]
k8s_tokens	Find K8s service account tokens and kubeconfigs	k8s-tokens
mount_escape	Mount namespace escape via /proc/1/root or remount	mount-escape [file]
nsenter_host	Nsenter into host PID 1 namespaces for cmd execution	nsenter-host [cmd]

Kubernetes (3 BOFs)

BOF	Description	Usage
k8s_enum	Enumerate pods, services, namespaces, and deployments	k8s-enum <host> <port> <token>
k8s_secrets	List and dump Kubernetes secrets	k8s-secrets <host> <port> <token>
k8s_rbac	Enumerate roles, cluster roles, and bindings	k8s-rbac <host> <port> <token>

All K8s BOFs use bearer token authentication (from a mounted service account or supplied via args) and parse JSON responses from the Kubernetes API server. No kubectl or external tools required.

Cloud — AWS (15 BOFs)

BOFs for on-prem to cloud lateral movement. Discover cloud credentials on compromised hosts, validate and pivot into AWS infrastructure, and access cloud resources — all from the implant with no external tools. Both Windows COFF and Linux .so variants.

Credential Discovery & Validation:

BOF	Description	Usage
aws_whoami	STS GetCallerIdentity — validate creds, show account/ARN	aws-whoami [AK SK [token] [region]]
aws_imds_creds	Extract IAM role credentials from EC2 IMDS (v1/v2)	aws-imds-creds
aws_iam_enum	Enumerate IAM user/role policies and permissions	aws-iam-enum [AK SK [token] [region]]
aws_assume_role	STS AssumeRole to pivot into higher-privilege role	aws-assume-role <role_arn> [AK SK [token] [region]]
aws_cred_search	Scan filesystem, env vars, SSO caches, and process memory for AWS credentials	aws-cred-search

Cloud Resource Access:

BOF	Description	Usage
aws_s3_ls	List S3 buckets and objects	aws-s3-ls [bucket[/prefix]] [AK SK [token] [region]]
aws_s3_get	Download S3 object contents	aws-s3-get <bucket> <key> [AK SK [token] [region]]
aws_ec2_enum	Enumerate EC2 instances (ID, type, IP, state)	aws-ec2-enum [AK SK [token] [region]]
aws_lambda_enum	List Lambda functions	aws-lambda-enum [AK SK [token] [region]]
aws_secrets_manager	List and read Secrets Manager secrets	aws-secrets-manager [secret_name] [AK SK [token] [region]]
aws_ssm_params	Read SSM Parameter Store parameters by path	aws-ssm-params [path] [AK SK [token] [region]]
aws_ec2_userdata	Read EC2 user-data scripts via IMDS (often contains creds)	aws-ec2-userdata

Lateral Movement:

BOF	Description	Usage
aws_ssm_exec	Execute commands on EC2 via SSM SendCommand (no direct connection)	aws-ssm-exec <instance_id> <command> [AK SK [token] [region]]
aws_lambda_exec	Invoke Lambda function with controlled input	aws-lambda-exec <function_name> [payload] [AK SK [token] [region]]
aws_ec2_connect	Push temporary SSH key via EC2 Instance Connect (60s window)	aws-ec2-connect <instance_id> <ssh_pubkey> [user] [AK SK [token] [region]]

Cloud — Azure (8 BOFs)

BOFs for Azure resource enumeration and lateral movement via the Azure Resource Manager API. Authenticate with a managed identity token from IMDS or an operator-supplied Bearer token.

BOF	Description	Usage
azure_imds_token	Request managed identity OAuth2 token from Azure IMDS	azure-imds-token [resource]
azure_cred_search	Search environment and metadata for Azure credentials	azure-cred-search
azure_whoami	Identify current Azure principal (subscriptions + tenant)	azure-whoami [token]
azure_keyvault	List Key Vault secrets and retrieve secret values	azure-keyvault <vault> [secret] [token]
azure_storage_ls	List Azure Storage containers and blobs	azure-storage-ls <account> [container] [token]
azure_blob_get	Download blob content from Azure Storage	azure-blob-get <account> <container> <blob> [token]
azure_vm_enum	Enumerate Azure VMs across subscriptions	azure-vm-enum [subscription] [token]
azure_vm_runcommand	Execute commands on Azure VMs via Run Command API	azure-vm-runcommand <vm> <rg> <subscription> <cmd> [token]

Cloud — Entra ID (14 BOFs)

BOFs for Microsoft Entra ID (Azure AD) identity-plane enumeration, credential access, and privilege escalation via the Microsoft Graph API. Authenticate with a managed identity token from IMDS or an operator-supplied Bearer token.

Identity Enumeration:

BOF	Description	Usage
entra_whoami	Show current Entra ID identity (tenant, UPN, roles)	entra-whoami [token]
entra_users	List Entra ID users with key attributes	entra-users [token]
entra_groups	List Entra ID groups	entra-groups [token]
entra_group_members	List members of an Entra ID group	entra-group-members <group_id> [token]
entra_roles	List Entra ID directory roles and assignments	entra-roles [token]
entra_role_members	List members of a specific directory role	entra-role-members <role_id> [token]
entra_sps	List Entra ID service principals	entra-sps [token]
entra_condaccess	List conditional access policies	entra-condaccess [token]

Credential & Secret Access:

BOF	Description	Usage
entra_app_secrets	List application registrations with credentials	entra-app-secrets [token]
entra_app_add_secret	Add a client secret to an application registration	entra-app-add-secret <object_id> [token] [display_name]
entra_oauth_grants	List OAuth2 permission grants (delegated permissions)	entra-oauth-grants [token]

Privilege Escalation:

BOF	Description	Usage
entra_role_assign	Assign a directory role to a principal	entra-role-assign <role_id> <principal_id> [token]
entra_app_roles	List app role assignments for a service principal	entra-app-roles <sp_id> [token]
entra_pim	List PIM eligible role assignments	entra-pim [token]

All Azure, Entra ID, and AWS BOFs support explicit tokens/credentials or auto-discover from IMDS when run on a cloud VM. JSON response parsing is built-in — no external tools or CLIs required.

Cloud — GCP (8 BOFs)

BOFs for GCP resource enumeration and lateral movement via GCP REST APIs. Authenticate with a service account OAuth2 token from the GCP metadata server or an operator-supplied Bearer token.

Credential Discovery & Validation:

BOF	Description	Usage
gcp_metadata_token	Steal service account OAuth2 token from GCP metadata server	gcp-metadata-token
gcp_cred_search	Scan filesystem for GCP credential files (ADC, service account keys, gcloud configs)	gcp-cred-search
gcp_whoami	Identify current GCP principal, project, and token scopes	gcp-whoami [token]

Cloud Resource Access:

BOF	Description	Usage
gcp_vm_enum	Enumerate GCE instances across all zones	gcp-vm-enum [token [project_id]]
gcp_storage_ls	List GCS buckets or objects	gcp-storage-ls [bucket] [token [project_id]]
gcp_storage_get	Download object from GCS (up to 4MB)	gcp-storage-get <bucket> <object> [token]
gcp_secrets	List or retrieve secrets from Secret Manager	gcp-secrets [secret_name] [token [project_id]]
gcp_iam_enum	Enumerate service accounts and IAM policy	gcp-iam-enum [token [project_id]]

All AWS, Azure, Entra ID, and GCP BOFs support explicit tokens/credentials or auto-discover from IMDS/GCP metadata server when run on a cloud VM. JSON response parsing is built-in — no external tools or CLIs required.