Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
BlueSAM — A Cobalt Strike Beacon Object File that exploits the BlueHammer vulnerability that to obtain a copy of the SAM database. | Kitploit
Tools/GitHubGitHub/incursi0n/bluesam
Penetration Testing FrameworksExploitationPost-ExploitationCommand and ControlRed TeamingPayload Development
GitHubincursi0n/bluesam

BlueSAM

A Cobalt Strike Beacon Object File that exploits the BlueHammer vulnerability that to obtain a copy of the SAM database.

View Repository
1672724 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

BlueSAM BOF

A Cobalt Strike Beacon Object File adaptation of BlueHammer that attempts to obtain a copy of the SAM database through Windows Defender update/VSS behavior and process offline registry data from Beacon.

Credits to Nightmare-Eclipse's BlueHammer (https://github.com/Nightmare-Eclipse/BlueHammer) for the original PoC.

To start

  1. Git clone the repo
  2. Run make

Usage

  1. Import the bluesam.cna script into Cobalt Strike
  2. Use the command bluesam
root@kitploit:~
bluesam
Command         Description
(none)          Runs the BlueSAM BOF with the default target behavior.
any argument    Shows this help menu.

Sample run

image

Credits:

  • https://github.com/Nightmare-Eclipse/BlueHammer
  • https://github.com/MEhrn00/boflink
  • https://github.com/trustedsec/CS-Situational-Awareness-BOF/tree/master/src/base_template
  • https://github.com/CodeXTF2/bof_template
Download Tool