A Beacon Object File (BOF) for Cobalt Strike and Mythic C2 that implements COM hijacking for persistence on Windows systems.
☆39Feb 17, 2026Updated 8 months ago
Alternatives and similar repositories for COM_Hijack_BOF
Users that are interested in COM_Hijack_BOF are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A PoC of User-Defined Reflective Loader for Havoc Framework built with Cystal Palace☆50Oct 18, 2026Updated 3 weeks ago
- Cross-platform situational-awareness BOFs for Windows, Linux, and macOS☆16Oct 15, 2026Updated 3 weeks ago
- AWS S3 User-Defined C2☆27Oct 6, 2026Updated last month
- example use of defining your own injection technique for explicit injection and or spawn (fork & run)☆19Jan 3, 2026Updated 10 months ago
- OneDrive as a covert C2 transport for Cobalt Strike☆79Sep 19, 2026Updated last month
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- 0-Click RCE for XWorm -> v7.5 (latest)☆17Oct 22, 2026Updated 3 weeks ago
- Async BOF that notifies the operator when a user connects to a local or remote target system.☆34Jul 30, 2026Updated 3 months ago
- macOS Container Payload Wrapper☆23Mar 13, 2026Updated 8 months ago
- Beacon Object File (BOF) Template☆100Oct 14, 2026Updated last month
- Busybox-style Beacon Object Files for *nix post-exploitation. Reimplements common Unix utilities as BOFs for use in stripped environments…☆45Jun 14, 2026Updated 5 months ago
- BOF POC of the DSCourier project / invoking WinGet via COM☆90Apr 23, 2026Updated 6 months ago
- .NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on dis…☆41Oct 11, 2026Updated last month
- Cobalt Strike BOF for extracting Firefox passwords and cookies. Decrypts saved credentials using NSS, supports key3.db/key4.db, logins.js…☆42Jul 5, 2026Updated 4 months ago
- UnderlayCopy is an @Adaptix-Framework post-exploitation BOF tool for copying locked files and registry hives using low-level NTFS volume …☆13Nov 25, 2025Updated 11 months ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Internal Monologue BOF☆84Dec 28, 2024Updated last year
- Repository for various Beacon Object Files (BOFs)☆186Oct 22, 2026Updated 3 weeks ago
- dcsync bof☆54Feb 13, 2026Updated 9 months ago
- Application-scoped Windows network brownouts in native C and BOF form☆23Aug 18, 2026Updated 2 months ago
- open source implementation of the UDC2 spec used in Cobalt Strike☆62Jul 4, 2026Updated 4 months ago
- async beacon object file for notification on process creation☆18Mar 24, 2026Updated 7 months ago
- One of the most powerful primitives for Windows default configuration LPE☆53Updated this week
- Versatile SOCKS5 proxying tool☆16Jun 28, 2026Updated 4 months ago
- Collection of UAC Bypass Techniques Weaponized as BOFs☆23Jan 5, 2026Updated 10 months ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Beacon Object File (BOF) implementation of the dnscmd.exe functionality used to obtain remote code execution on an ADIDNS server by explo…☆59Jul 8, 2026Updated 4 months ago
- Stack spoofing Detection for CET processes by comparing shadow and user stacks.☆41May 22, 2026Updated 5 months ago
- BOF for Havoc that copies locked Windows files (SAM, SYSTEM, NTDS.dit) via raw MFT parsing — no VSS, no Registry APIs, no PowerShell☆137Apr 6, 2026Updated 7 months ago
- ☆72Jul 12, 2026Updated 4 months ago
- A Cobalt Strike Beacon Object File that exploits the BlueHammer vulnerability that to obtain a copy of the SAM database.☆167Apr 15, 2026Updated 6 months ago
- Post-ex tool to interact with chromium browser when CDP is enabled☆47Updated this week
- Another Injection Technique which eliminates creations of thread in remote process☆29Jul 7, 2026Updated 4 months ago
- A Cobalt Strike BOF implementation of the SilentHarvest registry dumping technique☆185Apr 14, 2026Updated 6 months ago
- Sophisticated In-Memory PE loader for Cobalt Strike☆24Jan 24, 2026Updated 9 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- C library for Diffie Hellman key exchange with Curve448 und Curve25519. Extracted from OpenSSL.☆11Jan 7, 2021Updated 5 years ago
- A BOF for enumerating version information for DLLs associated for a Beacon process.☆16Nov 23, 2021Updated 4 years ago
- A concept of using a ROP chain paired with a WRMSR primitive to call kernel functions and map unsigned drivers through BYOVD (AmdTools64.…☆69Sep 21, 2026Updated last month
- Port of the EDRSilencer tool (https://github.com/netero1010/EDRSilencer) to BOF format☆37Oct 22, 2024Updated 2 years ago
- Havoc C2 BOF port of the KslD.sys BYOVD technique. Credential extraction from lsass via physical memory — no OpenProcess, no auditable AP…☆150Apr 22, 2026Updated 6 months ago
- An alternative to the builtin clipboard feature in Cobalt Strike that adds the capability to enable/disable and dump the clipboard histor…☆117Apr 16, 2026Updated 6 months ago
- This is a project aimed to make every other Saas product a C2, confluence is just the beginning.☆23Oct 21, 2026Updated 3 weeks ago
Are these results useful?