Title here
Summary here
Extension-Kit
The Extension-Kit is a collection of BOF (Beacon Object Files) modules that significantly extend JustC2 agent capabilities during post-exploitation operations on Windows systems. Each module is loaded as a position-independent C object file that executes directly within the agent’s process without creating new processes or writing files to disk.
Compatible agents
All Extension-Kit commands are available for the following agents on the Windows platform:
- Beacon — C++ agent cross-compiled with MinGW
- Gopher — Go-based agent
- Kharon — Additional agent (available in some modules)
Included modules
| Module | Description |
|---|---|
| SAL-BOF | Local system reconnaissance (ARP, networking, privileges, environment variables) |
| SAR-BOF | Remote network reconnaissance (port scanning, NetBIOS, remote sessions) |
| Creds-BOF | Credential extraction (SAM, LSASS, browser cookies) |
| Process-BOF | Process manipulation (module search, handles, freezing) |
| Injection-BOF | Code injection into processes (section, PoolParty, 32→64 bit) |
| Postex-BOF | General post-exploitation (firewall, screenshots, file search) |
| Elevation-BOF | Privilege escalation (token impersonation, UAC bypass, Potato) |
| LateralMovement-BOF | Lateral movement (PsExec, WinRM, SCShell, tokens) |
| Execution-BOF | Binary execution (.NET assemblies, in-memory PE) |
| AD-BOF | Active Directory (DCSync, LDAP search, LAPS, WebDAV, BadSuccessor) |
| ADCS-BOF | Active Directory Certificate Services exploitation |
| Kerbeus-BOF | Kerberos attacks (AS-REP/Kerberoasting, tickets, S4U, delegation) |
| SQL-BOF | Microsoft SQL Server exploitation |
| LDAP-BOF | Full LDAP operations (query, create, modify, delete AD objects) |
| RelayInformer | Relay protection assessment (SMB signing, LDAP signing, channel binding) |
Enabling the Extension-Kit
To enable the Extension-Kit in your JustC2 instance:
- Copy the
Extension-Kit/directory into the server’sdist/directory:
cp -r Extension-Kit/ dist/Extension-Kit/- Edit the
dist/profile.yamlfile and make sure theaxscriptsline is uncommented:
axscripts:
- "Extension-Kit/extension-kit.axs"- Restart the JustC2 server to load the scripts.
Once loaded, the new commands will appear in the help menu (help) of each connected agent.
Concept: Beacon Object Files (BOF)
BOFs are C object files compiled as position-independent code (PIC). Unlike running an external binary, a BOF is loaded and executed directly in the agent process’s memory, which provides:
- No disk writes — No executable files are created on the target system
- No process creation — Execution occurs within the agent’s existing process
- Low profile — Smaller footprint detectable by security solutions
- Flexibility — New capabilities can be added without recompiling the agent