bof_sal
Perform Windows host reconnaissance and privilege escalation checks, including ARP tables, directory permissions, network connections, and system uptime.
Instructions
SAL-BOF: Situational Awareness Local — Windows host reconnaissance.
arp — List ARP table cacls — List file/directory permissions. Example: cacls C:\test.txt dir [directory] [/s] — List directory contents (recursive with /s). Example: dir C:\Users /s env — List process environment variables ipconfig — List IPv4 addresses, hostname, DNS servers listdns — List DNS cache entries and resolve them netstat — Display active network connections nslookup [-s server] [-t type] — DNS query. Example: nslookup google.com -s 8.8.8.8 -t A routeprint — List IPv4 routes uptime — Show system boot time and uptime useridletime — Show user idle time in seconds/minutes/hours/days whoami — Run whoami /all (groups, privileges, SID)
privcheck all — Run ALL privilege escalation checks privcheck alwayselevated — Check AlwaysInstallElevated registry setting privcheck autologon — Check Winlogon autologon credentials privcheck credmanager — Enumerate Windows Credential Manager privcheck hijackablepath — Check PATH for writable directories privcheck modautorun — Check for modifiable autorun executables privcheck modsvc — Check for services with modifiable DACL privcheck pshistory — Check PowerShell PSReadLine history file privcheck tokenpriv — List token privileges and highlight vulnerable ones privcheck uacstatus — Check UAC status and integrity level privcheck unattendfiles — Check for leftover unattend.xml files privcheck unquotedsvc — Check for unquoted service paths privcheck vulndrivers — Check for known vulnerable drivers (loldrivers.io)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| command | Yes | ||
| args | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |