Remote-BOF-Runner

Remote BOF Runner is a Havoc extension framework for remote execution of Beacon Object Files (BOFs) using a PIC loader made with Crystal Palace.

Installation Commands

Architecture

Components

1. BOF Injector

The BOF component is responsible for:

• Creating and suspending a dummy process.
• Injecting the Crystal Palace loader + the target BOF into the dummy process.
• Establishing an IPC channel (named pipe) for output communication.
• Receiving and aggregating output from the remote BOF execution.

2. PIC Loader (Crystal Palace)

The PIC loader consists of:

• Crystal Palace Loader: Handles memory allocation, BSS section management, and safe execution context initialization.
• Remote BOF Payload: The actual BOF code to execute (whoami, ipconfig, cacls, reg-query, etc.).
• Argument Marshalling: Serialized arguments passed through the loader for remote BOF execution.

Execution Flow

Key Features

1. Process Isolation

• BOF execution occurs in a separate, isolated process.
• Minimizes impact on beacon process stability.
• Enables execution in arbitrary process contexts.

2. IPC Output Forwarding

• Named pipe-based communication channel.
• Transparent output redirection from remote BOF.
• Message fragmentation handling (8KB accumulation buffer).
• Protocol delimiter filtering.

3. .NET Process Execution

The primary use case is executing BOFs in native .NET processes:

Why Direct CLR Loading in Beacon is Risky: Loading .NET assemblies directly in the beacon process is inherently unsafe and detectable:

• The beacon process (usually a native binary like cmd.exe or rundll32.exe) does not normally spawn a CLR.
• When a CLR is loaded into a non .NET process, should triggers immediate EDR/XDR alerts.

A Possible Solution: Native .NET Process Injection: Instead of loading CLR into the beacon, we inject and execute our inline-execute-assembly BOF into a process that is already .NET-native:

This approach leverages the fact that executing .NET within a .NET process is indistinguishable from normal application behavior.

4. Crystal Palace Integration

• Position-independent code execution.
• Dynamic API resolution via hash-based function lookups.
• No import address table dependencies.
• Suitable for deep injection scenarios.

Execution Modes

Local Execution

Remote Host Execution

Registry Queries

.NET Assembly Execution

Example Output:

Available BOFs

• whoami - Display current user and group information (CS-Situational-Awareness-BOF).
• ipconfig - Show network adapter configuration (CS-Situational-Awareness-BOF).
• cacls - List file permissions (CS-Situational-Awareness-BOF).
• reg-query - Query Windows Registry (CS-Situational-Awareness-BOF).
• execute-assembly - Loads a .NET assembly into the actual process (https://github.com/VoldeSec/PatchlessInlineExecute-Assembly).
• bof - Execute custom BOF binaries.

Operational Security Considerations

⚠️ Important: This project is a Proof-of-Concept and does NOT prioritize OPSEC by default.

Recommended Modifications

Both the BOF Injector and PIC Loader require significant hardening for adversary simulations:

BOF Injector Hardening

• Implement custom process creation methods (not CreateProcessW).
• Use alternative injection techniques beyond standard WriteProcessMemory.
• Obfuscate IPC pipe naming (randomize identifiers).

PIC Loader Hardening

• Encrypt communication protocol (pipe messages).
• Implement YARA rule evasion for known signatures.
• Add a method to evade process hooks (indirect syscalls, unhooking methods, etc.).
• Add an encryption method to store the target BOF + Args.

References

• Crystal Palace
• LibIPC - Crystal Palace shared library for inter-process communication, based on Named Pipes.
• PatchlessInlineExecute-Assembly - BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.
• CS-Situational-Awareness-BOF - Situational Awareness commands implemented using Beacon Object Files.

Disclaimer

This tool is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. Users are responsible for ensuring compliance with all applicable laws and regulations.