This repository implements a Cobalt Strike Beacon Object File (BOF) that loads .NET assemblies directly into memory while employing hardware breakpoint-based techniques to bypass AMSI and ETW monitoring without patching memory. The core functionality resides in the C source file which handles .NET runtime initialization, assembly loading, and the innovative hardware breakpoint mechanism for security bypass. The project includes an Aggressor script for integration with Cobalt Strike's command framework. The code demonstrates advanced Windows API manipulation, COM interop for .NET hosting, and stealth techniques that avoid traditional memory patching detectable by EDR solutions.
LSA Whisperer BOF is a Cobalt Strike Beacon Object File (BOF) port of Evan McBroom's LSA Whisperer tool, enabling red team operators to interact with Windows authentication packages (MSV1_0, Kerberos, CloudAP) through legitimate LSA client APIs (LsaCallAuthenticationPackage). It recovers DPAPI credential keys (including under Credential Guard), dumps Kerberos tickets as base64 .kirbi blobs, performs selective ticket purging, extracts Entra ID/AD FS SSO cookies, and generates NTLMv1 responses for hash cracking—all without opening handles to LSASS or touching process memory. The architecture comprises three independent BOF modules (msv1_0, kerberos, cloudap) sharing a common LSA communication layer and comprehensive header definitions for undocumented LSA structures. The code is well-structured, handles privilege separation (untrusted vs. trusted LSA connections), and provides detailed error messages. It targets red team operations and requires Cobalt Strike for execution.