需先编译出 BOF 并将 screenshotBOF.cna 导入 Cobalt Strike 才能使用；save method 1 和 2 仅限 Cobalt Strike；不做任何规避处理，依赖所用 WinAPI 本身不敏感
ScreenshotBOF
CodeXTF2MIT活跃维护Cobalt Strike 的替代截图模块，直接调用 WinAPI 截屏，不走 fork & run，截图数据在内存中回传，减少进程创建痕迹。
An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.
release2.0发布于 2025-02-09 15:32 UTC509star66fork同步于 2026-11-07 07:33 UTC
用 WinAPI 截图替代 Cobalt Strike 的 fork & run，避免被监控的截图 BOF
Cobalt Strike 的替代截图模块，直接调用 WinAPI 截屏，不走 fork & run，截图数据在内存中回传，减少进程创建痕迹。
核心能力
- 用 WinAPI 截图，不触发 fork & run 行为
- 支持 JPEG 压缩并可在内存中下载为截图或文件
- 可捕获最小化窗口的画面
- 支持灰度、JPEG 质量与缩放以减小文件体积
- 提供 save method 0/1/2 三种保存方式
容易踩的坑
内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README
- release2.0Release 2.0最新正式版2025-02-09 · 2025-02-09 15:32 UTC
Major release 2.0
- JPEG is used in place of BMP
- Moved to mingw
- Added beacon screenshot callback option
- Removed BMP renderer (it will be missed)
credits for code snippets I stole (with permission) when writing this update
- screenshot callback function by @BinaryFaultline
- bitmap to jpeg from https://github.com/WKL-Sec/HiddenDesktop
and everyone else who helped debug my cursed code :P
- release1.2Release 1.2 (Hotfixed)2025-02-07 · 2025-02-07 09:18 UTC
查看更新说明
Added support for specific PID window capture (even when minimized)
requires cobalt strike 4.10 due to WinAPI count limit- 8/2/2025 Hotfix: Supports Cobalt Strike 4.9!
- in_memory_downloadrelease 1.12022-10-25 · 2022-10-25 16:33 UTC
查看更新说明
- In memory download support. CobaltStrike specific.
- BMP renderer
- 11/30/2022 hotfix for a filename truncation bug
13/8/2024: Added Sliver formatted version (extension.dll). Precompiled BOFs same as standard version, just with the extension.json file.
- releaserelease 1.02022-10-23 · 2022-10-23 09:40 UTC
查看更新说明
Stable
用户点评
登录用户的真实使用记录，可按版本和硬件筛选共 0 条
还没有人点评。第一个说出真实体验的人最有价值。
ScreenshotBOF
An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.
Features
- JPEG compression
- In memory download as screenshot or as file
- Supports capturing of minimized windows
- Grayscale, JPEG quality and Downscaling to reduce file size
Self Compilation
- git clone the repo
- run
make
Save methods:
- drop file to disk
- download file over beacon (Cobalt Strike only)
- download file over beacon as a screenshot (Cobalt Strike only)
PID
0: capture full screen (PID = 0) specific PID: capture specific PID (works even when minimized!)
Usage
- import the screenshotBOF.cna script into Cobalt Strike
- use the command screenshot_bof {local filename} {save method 0/1/2} {pid/0} {grayscale 0/1} {quality 0-100} {scale 0-100}
- running
screenshot_bofwith no arguments will pop a GUI dialog
- running
beacon> screenshot_bof file.jpg 2 21964 0 90 100
[*] Running screenshot BOF by (@codex_tf2)
[+] host called home, sent: 12421 bytes
[+] received output:
Downloading JPEG over beacon as a screenshot with filename file.jpg
[*] received screenshot of Screenshot from Admin (26kb)
[+] received output:
Screenshot saved/downloaded successfully
Notes
- no evasion is performed, which should be fine since the WinAPIs used are not malicious
Why did I make this?
Cobalt Strike uses a technique known as fork & run for many of its post-ex capabilities, including the screenshot command. While this behaviour provides stability, it is now well known and heavily monitored for. This BOF is meant to provide a more OPSEC safe version of the screenshot capability.
Credits
- Save BMP to file from https://stackoverflow.com/a/60667564
- in memory download from https://github.com/anthemtotheego/CredBandit
- @BinaryFaultline for (deprecated) BMP rendering in aggressorscript, and screenshot callback function
- bitmap to jpeg from https://github.com/WKL-Sec/HiddenDesktop
Disclaimer
usual disclaimer here, I am not responsible for any crimes against humanity you may commit or nuclear war you may cause using this piece of poorly written code.