Extension-Kit on JustC2 Docs

SAL-BOF — Local Reconnaissance

Sun, 20 Sep 2026 00:00:00 +0000

The SAL-BOF (Situational Awareness — Local) module provides commands to gather information from the local system where the agent is running. These commands should be the first you run after gaining access to a machine to understand the environment before taking any further action.

SAR-BOF — Remote Reconnaissance

Sun, 20 Sep 2026 00:00:00 +0000

The SAR-BOF (Situational Awareness — Remote) module provides commands for network reconnaissance and remote system enumeration. These commands allow mapping the network, identifying active hosts, and discovering lateral movement targets, all from the agent without external tools.

Creds-BOF — Credential Extraction

Sun, 20 Sep 2026 00:00:00 +0000

The Creds-BOF module provides tools for credential extraction on Windows systems. It includes techniques ranging from social engineering to LSASS memory dumping, covering scenarios with both standard user and administrator privileges.

Process-BOF

Sun, 20 Sep 2026 00:00:00 +0000

Process-BOF provides commands for inspecting, analyzing, and controlling processes on the compromised system. These commands are essential for pre-injection reconnaissance, identifying sensitive processes, and temporarily controlling security processes.

Injection-BOF

Sun, 20 Sep 2026 00:00:00 +0000

Injection-BOF provides multiple shellcode injection techniques into remote processes. From classic section-based techniques to advanced PoolParty techniques that abuse Windows Thread Pool internals for EDR evasion.

Postex-BOF

Sun, 20 Sep 2026 00:00:00 +0000

Postex-BOF provides utilities for post-exploitation operations: firewall manipulation, screenshots, and advanced sensitive file searching on the compromised system.

Compatible agents: Beacon, Gopher, Kharon | Platform: Windows

Elevation-BOF

Sun, 20 Sep 2026 00:00:00 +0000

Elevation-BOF provides multiple techniques for escalating privileges on Windows systems. From obtaining SYSTEM tokens to UAC bypass and Potato-style attacks for service accounts.

Lateral Movement

Sun, 20 Sep 2026 00:00:00 +0000

The LateralMovement-BOF module provides commands for moving from a compromised machine to others within the network. It includes remote execution techniques, security token manipulation, and execution as other users.

Code Execution

Sun, 20 Sep 2026 00:00:00 +0000

The Execution-BOF module provides two mechanisms for executing arbitrary code in the agent’s process memory, without writing any files to disk on the target machine.

AD-BOF — Active Directory

Sun, 20 Sep 2026 00:00:00 +0000

The AD-BOF module provides fundamental tools for interacting with Active Directory during an authorized pentest engagement. It includes LDAP reconnaissance commands, credential extraction via DCSync, LAPS password reading, and WebDAV service manipulation.