BOF Reference

All 235 built-in BOFs (168 Windows + 67 Linux) organized by category. Each BOF is called by its short name at the operator console.

Windows BOFs (168)

Recon (18 BOFs)

BOF	Description	Usage
cat	Display remote file contents	cat <path>
clipboard	Read clipboard text contents	clipboard
drives	Enumerate logical drives (type, free/total)	drives
get_priv	Enable privilege (~prefix for thread token)	get_priv <privilege>
get_productid	Read Windows ProductId for —machine-lock builds	get-productid
handles	List open handles for current process	handles
hostname	Print computer hostname	hostname
keylog	Keylogger (GetAsyncKeyState, tracks window title)	keylog start, keylog stop, keylog dump
listhandles	List open handles for target process	listhandles <pid>
ls	List directory (default: .\*)	ls [path]
pid	Show current process ID	pid
ppid	Show current PID, parent PID, and parent name	ppid
ps	List running processes (PID, name, user, arch)	ps
pwd	Print remote working directory	pwd
screenshot	Capture desktop to BMP	screenshot [path]
sysinfo	OS version, hostname, domain, arch	sysinfo
tokeninfo	Token details for current process	tokeninfo
whoami	Current user, privileges, and group memberships	whoami

Host Enumeration (15 BOFs)

BOF	Description	Usage
adv_audit_policies	Query advanced audit policy settings	adv_audit_policies
driversigs	Enumerate loaded driver signatures	driversigs
enum_local_sessions	Enumerate local interactive sessions	enum_local_sessions
env	Environment variables	env
find_loaded_module	Find processes with specific DLL loaded	find_loaded_module <dll>
get_dpapi_system	Retrieve DPAPI system master keys	get_dpapi_system
get_session_info	Current session info (ID, user, state)	get_session_info
ipconfig	Network adapter configuration	ipconfig
listmods	List loaded modules for process	listmods <pid>
locale	System locale and language info	locale
resources	System resource usage stats	resources
uptime	System uptime	uptime
useridletime	User idle/last input time	useridletime
whoami_full	Detailed whoami (all tokens, groups, privileges)	whoami_full
windowlist	Enumerate visible windows	windowlist

Execution (8 BOFs)

BOF	Description	Usage
cmd	Run shell command (cmd.exe /C)	cmd <command>
execute_assembly	Run .NET assembly via fork & run (full evasion)	execute-assembly <path> [args]
execute_assembly_inproc	Run .NET assembly in-process (full evasion)	execute-assembly-inproc <path> [args]
execute_assembly_inproc_no_eva	Run .NET assembly in-process (no evasion, BD-safe)	execute-assembly-inproc-noeva <path> [args]
execute_assembly_no_eva	Run .NET assembly via fork & run (no evasion, BD-safe)	execute-assembly-noeva <path> [args]
execute_assembly_proxy	Run .NET assembly via proxy loader (fork & run)	execute-assembly-proxy <path> [args]
execute_assembly_std	Run .NET assembly via standard loader (fork & run)	execute-assembly-std <path> [args]
powershell	Run PowerShell command (hidden, no profile)	powershell <command>

File Operations (7 BOFs)

BOF	Description	Usage
cd	Change remote working directory	cd <path>
cp	Copy remote file	cp <src> <dst>
mkdir	Create remote directory	mkdir <path>
motw_remove	Remove Mark of the Web (Zone.Identifier ADS)	motw_remove <path>
mv	Move/rename remote file	mv <src> <dst>
rm	Delete remote file	rm <path>
upload	Upload local file to remote path	upload <local> <remote>

File & Hash (6 BOFs)

BOF	Description	Usage
cacls	File/folder ACL permissions	cacls <path>
dir	Directory listing with depth control	dir <path> [depth]
md5	MD5 hash of file	md5 <path>
sha1	SHA1 hash of file	sha1 <path>
sha256	SHA256 hash of file	sha256 <path>
vssenum	Enumerate Volume Shadow Copies	vssenum

Network (16 BOFs)

BOF	Description	Usage
arp	ARP table (neighbor cache)	arp
list_firewall_rules	Enumerate Windows Firewall rules	list_firewall_rules
listdns	DNS client cache entries	listdns
netloggedon	Enumerate logged-on users	netloggedon [host]
netloggedon_wts	Logged-on users (WTS API)	netloggedon_wts [host]
netsession	Enumerate net sessions (level 0 or 10)	netsession [host]
netsession_sweep	Net sessions — domain-wide DC sweep	netsession_sweep
netshares	Enumerate network shares	netshares [host]
netstat	Active TCP/UDP connections and listeners	netstat
netuptime	Remote host uptime via NetRemoteTOD	netuptime <host>
netuse	Map/list network drives (NetUseEnum)	netuse [host]
netview	Enumerate network shares and machines	netview
nslookup	DNS lookup (A/AAAA/ANY)	nslookup <domain>
probe	TCP port connectivity check	probe <host> <port>
routeprint	IP routing table	routeprint

Lateral Movement (4 BOFs)

BOF	Description	Usage
psexec	Lateral move via SCM service create/start	psexec <host> <cmd>
smb_upload	Copy file to remote host via SMB/UNC	smb_upload <local> <\\host\share\path>
winrm	Remote exec via WinRM (port 5985)	winrm <host> <command>
wmi_exec	Remote exec via WMI (Win32_Process.Create)	wmi_exec <host> <user> <pass> <cmd>

Privilege Escalation (3 BOFs)

BOF	Description	Usage
getsystem_token	Admin→SYSTEM via winlogon.exe token theft	getsystem_token
uacbypass_com	UAC bypass via CMSTPLUA COM + PEB masquerade	uacbypass_com <command>
uacbypass_tasksched	UAC bypass via VFServer factory + TaskScheduler	uacbypass_tasksched <command>

Privesc Enumeration (7 BOFs)

BOF	Description	Usage
enum_autoruns	Autorun entries with path/permission checks	enum_autoruns
enum_netlisteners	TCP/UDP listening ports with owning process	enum_netlisteners
enum_patches	Installed hotfixes/KBs for exploit matching	enum_patches
enum_persistence	WMI subs, writable PATH, extension handlers	enum-persistence [all|wmi|path|ext]
enum_schtasks	Non-MS scheduled tasks with writable actions	enum_schtasks
enum_services	Services with unquoted paths, modifiable configs	enum_services
privesc_checks	AlwaysInstallElevated, UAC, WDigest, LAPS, LSA	privesc_checks

Credential Dumping (9 BOFs)

BOF	Description	Usage
dump_chrome	Dump Chrome cookies/logins (App-Bound Encryption v20+)	dump-chrome [cookies|logins|all]
dump_firefox	Dump Firefox cookies/logins from all profiles	dump-firefox [cookies|logins|all]
hashdump	Dump SAM/SYSTEM/SECURITY hives (parse with secretsdump)	hashdump
nanodump	Dump LSASS to file	nanodump [path]
nanodump_handledup	LSASS dump via handle duplication	nanodump-handledup
nanodump_spe	LSASS dump via WerFault Silent Process Exit (LOLBin)	nanodump-spe <dump|check|cleanup> [folder]
nanodump_spe_nopdata	LSASS dump via SPE without ProcData	nanodump-spe-nopdata
racecond_dump	LSASS dump via race condition	racecond-dump
rdp_thief	RDP credential theft via HWBP hooks in mstsc.exe	rdp-thief <inject|collect|eject> [pid]
samdump	In-memory SAM hash extraction via registry API (no files)	samdump
spe_dump	LSASS dump via Silent Process Exit	spe-dump

Credential Hunting (6 BOFs)

BOF	Description	Usage
autologon	Auto-logon creds in Winlogon registry	autologon
cred_files	Scan for credential files (web.config, .kdbx, etc)	cred_files
dpapi_keys	DPAPI master key file enumeration	dpapi_keys
enum_creds	Credential Manager entries (generic/domain)	enum_creds
psh_history	PowerShell ConsoleHost_history.txt (all users)	psh_history
wifi_passwords	Saved WiFi profiles and plaintext keys	wifi_passwords

Token Manipulation (4 BOFs)

BOF	Description	Usage
getuid	Show current identity (thread or process token)	getuid
make_token	Create token with alternate network credentials	make_token <domain\user> <password>
rev2self	Revert to original process identity	rev2self
steal_token	Steal and impersonate token from target process	steal_token <pid>

Persistence (5 BOFs)

BOF	Description	Usage
persist_comhijack	COM hijack persistence (install/remove/check)	persist-comhijack install <dll_path>, persist-comhijack remove, persist-comhijack check
persist_registry	Registry persistence (run/userinit/shell/ifeo/appinit/activeset)	persist-registry <method> <install|remove|check> [name] [payload]
persist_schtask	Scheduled task persistence (logon trigger)	persist_schtask <name> <exe_path>
persist_wmi	WMI event subscription persistence (survives reboot)	persist-wmi <install|remove|check> <name> [trigger] [payload]

Evasion (3 BOFs)

BOF	Description	Usage
detect_hooks	Scan ntdll/kernel32/kernelbase for EDR hooks	detect_hooks
etw_hijack	Blind ETW sessions by restarting with fake log	etw-hijack
unhook_dllnotif	Remove EDR DLL load notification callbacks	unhook_dllnotif

Injection (4 BOFs)

BOF	Description	Usage
createremotethread	Inject shellcode via CreateRemoteThread	createremotethread <pid> <bin_path>
inject_test	Test injection stub (dev/debug)	inject_test
knowndll_poison	Replace \KnownDlls handle, hijack DLL load	knowndll-poison <pid> <dll> <payload>
shspawnas	Spawn-as with creds + APC shellcode inject	shspawnas <domain\user> <pass> <bin_path>
threadless_inject	Threadless injection via export hook	threadless-inject <pid> <dll> <export> <shellcode>

Process Operations (3 BOFs)

BOF	Description	Usage
procdump	MiniDump process memory to file	procdump <pid> [path]
processdestroy	Close handles in target process	processdestroy <pid>
suspendresume	Suspend or resume a process	suspendresume <pid> suspend, suspendresume <pid> resume

User Management (5 BOFs)

BOF	Description	Usage
adduser	Add local/remote user account	adduser <name> <password> [host]
addusertogroup	Add user to group (global, falls back local)	addusertogroup <user> <group>
disableuser	Disable user account	disableuser <user>
enableuser	Enable/unlock user account	enableuser <user>
setuserpass	Set user password	setuserpass <user> <password>

Service Control (5 BOFs)

BOF	Description	Usage
sc_create	Create Windows service	sc_create <name> <binpath>
sc_delete	Delete service	sc_delete <name>
sc_start	Start service	sc_start <name>
sc_stop	Stop service (handles dependents)	sc_stop <name>
sc_trigger	Add device-arrival trigger to service	sc-trigger <name> <device>

Services & Tasks (9 BOFs)

BOF	Description	Usage
enum_filter_driver	Enumerate filesystem filter drivers (EDR)	enum_filter_driver
sc_enum	Enumerate services	sc_enum
sc_qc	Query service configuration	sc_qc <name>
sc_qdescription	Query service description	sc_qdescription <name>
sc_qfailure	Query service failure actions	sc_qfailure <name>
sc_qtriggerinfo	Query service trigger info	sc_qtriggerinfo <name>
sc_query	Query service status	sc_query <name>
schtasksenum	Enumerate scheduled tasks	schtasksenum
schtasksquery	Query specific scheduled task	schtasksquery <name>

Registry (4 BOFs)

BOF	Description	Usage
reg_delete	Delete registry key or value	reg_delete <key> [value]
reg_query	Query registry key/value remotely	reg_query <host> <key> [value]
reg_save	Save registry key to file	reg_save <key> <path>
reg_set	Set registry value	reg_set <key> <value> <data> <type>

Environment Recon (8 BOFs)

BOF	Description	Usage
defender_config	Defender status, exclusions, ASR rules, tamper	defender_config
defender_ctrl	Disable/enable RTP, add/remove path exclusions	defender-ctrl <action> [path]
enum_dns_cache	DNS resolver cache dump (internal host mapping)	enum_dns_cache
enum_firewall	Firewall profiles, default actions, enabled rules	enum_firewall
enum_pipes	Named pipes (services, IPC, impersonation targets)	enum_pipes
path_hijack	Writable PATH directories for DLL hijacking	path_hijack
sysmon_detect	Detect Sysmon service, driver, event log, binary	sysmon_detect
wsus_config	WSUS HTTP server check (WSUS injection)	wsus_config

AD Recon (2 BOFs)

BOF	Description	Usage
enum_adcs	AD CS template misconfigs (ESC1-ESC4, ESC6, ESC8)	enum_adcs
enum_kerberoast	Kerberoastable accounts (users with SPNs)	enum_kerberoast

Active Directory (15 BOFs)

BOF	Description	Usage
aadjoininfo	Azure AD join info for host	aadjoininfo
adcs_enum	Enumerate AD Certificate Services templates	adcs_enum
adcs_enum_com	ADCS enumeration via COM interface	adcs_enum_com
adcs_enum_com_alt	ADCS enumeration via COM (alternate method)	adcs_enum_com_alt
get_password_policy	Query domain/local password policy	get_password_policy
ldapsearch	LDAP search with custom filter	ldapsearch <filter> [attrs]
ldapsecuritycheck	LDAP security config audit	ldapsecuritycheck
netgroup	Enumerate domain groups / members	netgroup [group]
netlocalgroup	Enumerate local groups / members	netlocalgroup [group]
netlocalgroup_api	Local group membership (NetLocalGroupGetMembers)	netlocalgroup_api <group>
netuser	Detailed user account info	netuser <user>
netuserenum	Enumerate domain/local users	netuserenum
regsession	Enumerate registry-based sessions	regsession
tasklist	WMI process list (remote capable)	tasklist [host]
wmi_query	Run arbitrary WMI query	wmi_query <query>

System (1 BOF)

BOF	Description	Usage
shutdown	Shutdown or reboot (local/remote)	shutdown [host]

---

Linux BOFs (67)

Recon (18 BOFs)

BOF	Description	Usage
arp_table	ARP/neighbor cache for host discovery	arp-table
cat	Read file contents (1MB max)	cat <path>
cloud_detect	Detect AWS/GCP/Azure/DO via DMI/cloud-init	cloud-detect
container	Detect Docker/K8s/LXC/VM environment	container
crons	Enumerate crontabs, systemd timers, at jobs	crons
dmesg_leaks	Scan dmesg for kernel pointers and credentials	dmesg-leaks
dns	DNS lookup (forward or reverse)	dns <host|ip> [-r]
env	Environment variables	env
fstab_mounts	Parse fstab/mounts for nosuid gaps, cred leaks	fstab-mounts
hostname	System hostname	hostname
id	uid/gid/groups (like id command)	id
ifconfig	Network interfaces (IPv4/IPv6, flags)	ifconfig
ls	Directory listing with permissions	ls [path]
netstat	TCP/UDP connections from /proc/net	netstat
pid	Agent PID and image path	pid
ppid	Agent PID, parent PID, and parent image	ppid
ps	List processes from /proc	ps
pwd	Current working directory	pwd
uname_mod	Kernel version and system info	uname
unix_sockets	Find writable UNIX sockets owned by root	unix-sockets
whoami	Current user (uid/euid)	whoami

File Operations (7 BOFs)

BOF	Description	Usage
cd	Change agent working directory	cd <path>
chmod	Change file permissions (octal mode)	chmod <mode> <path>
cp	Copy file (preserves permissions)	cp <src> <dst>
mkdir	Create directory (-p for recursive)	mkdir <path> [-p]
mv	Move/rename file or directory	mv <src> <dst>
rm	Remove file/directory (-r recursive)	rm <path> [-r]
upload	Upload file to remote path	upload <local> <remote>

Execution (2 BOFs)

BOF	Description	Usage
bash	Execute command via /bin/bash -c (stderr merged)	bash <command>
sh	Execute command via /bin/sh (stderr merged)	sh <command>

Credential Access (8 BOFs)

BOF	Description	Usage
backup_files	Find .bak, .sql, .db, .kdbx backup files	backup-files
history	Read shell history files for all users	history
kerberos_enum	Keytabs, krb5cc caches, Samba/SSSD credential DBs	kerberos-enum
mail_enum	Read user mail for credentials (/var/mail)	mail-enum
passwd_policy	Password aging, complexity, login.defs policy	passwd-policy
proc_creds	Find cred files in /proc/fd and secrets in environ	proc-creds
shadow	Read /etc/shadow password hashes	shadow
sshkeys	Harvest SSH keys from all users	sshkeys

Privilege Escalation (11 BOFs)

BOF	Description	Usage
caps	Enumerate process and file capabilities	caps
kernel_suggest	Suggest kernel exploits by version (CVE database)	kernel-suggest
ldso_hijack	Check ld.so.preload/conf for writable paths	ldso-hijack
pam_audit	Audit PAM configs for rogue auth modules	pam-audit
passwd_add	Add uid=0 user to /etc/passwd (needs write access)	passwd-add <user> <pass>
profile_d_perms	Writable scripts in profile.d, init.d, cron.d	profile-d-perms
sudo_check	Check sudo -l for NOPASSWD and GTFOBins abuse	sudo-check
sudo_tokens	Check for reusable sudo timestamp tokens	sudo-tokens
suid	Find SUID/SGID binaries	suid
svc_misconfig	Audit systemd services for writable ExecStart	svc-misconfig
sys_protections	ASLR, ptrace, seccomp, AppArmor, SELinux status	sys-protections
writable	Find writable sensitive files and PATH binaries	writable

Persistence (4 BOFs)

BOF	Description	Usage
persist_bashrc	Shell profile hook (.bashrc/.profile injection)	persist-bashrc <cmd> [target]
persist_cron	Crontab persistence (default */5 * * * *)	persist-cron <cmd> [sched]
persist_preload	LD_PRELOAD persistence (requires root)	persist-preload <so_path>
persist_systemd	Systemd service (user if non-root, system if root)	persist-systemd <name> <cmd>

Lateral Movement (4 BOFs)

BOF	Description	Usage
portscan	TCP connect scan with async sockets	portscan <host> [ports]
ssh_copy	Copy file to remote host via SCP	ssh-copy <src> <user@host:dst> [key]
ssh_exec	Execute command via SSH on remote host	ssh-exec <user@host> <cmd> [key]
ssh_spray	Spray all discovered SSH keys against target	ssh-spray <host> [users]

Evasion (4 BOFs)

BOF	Description	Usage
filehide	Hide file (dot rename, immutable attr, or both)	filehide <path> [method]
logclean	Scrub utmp/wtmp/btmp/lastlog + auth.log/secure	logclean <user> [host]
procmask	Change process name via prctl (e.g. kworker/0:1)	procmask <name>
timestomp	Copy timestamps from reference file or set explicit	timestomp <file> <ref|time>

Container Escape (5 BOFs)

BOF	Description	Usage
cgroup_escape	Cgroup v1 release_agent host command execution	cgroup-escape <cmd>
docker_sock	Docker socket escape — run cmd on host via container	docker-sock [sock] [cmd]
k8s_tokens	Find K8s service account tokens and kubeconfigs	k8s-tokens
mount_escape	Mount namespace escape via /proc/1/root or remount	mount-escape [file]
nsenter_host	Nsenter into host PID 1 namespaces for cmd execution	nsenter-host [cmd]