SAR-BOF — Remote Reconnaissance

The SAR-BOF (Situational Awareness — Remote) module provides commands for network reconnaissance and remote system enumeration. These commands allow mapping the network, identifying active hosts, and discovering lateral movement targets, all from the agent without external tools.

Compatible agents: Beacon, Gopher (Windows)

smartscan#

TCP port scanner with IP range and CIDR notation support. Allows controlled discovery of active services on the network.

smartscan 192.168.1.0/24 445,3389,22,80,443
smartscan 10.0.0.1-10.0.0.50 80-100,443,8080
smartscan 172.16.0.0/16 445 --timeout 3000 --threads 4

When to use: To map the internal network after local reconnaissance. Scan common ports such as:

• 445 (SMB) — To identify lateral movement targets
• 3389 (RDP) — Accessible remote desktops
• 1433 (MSSQL) — SQL Server instances
• 5985/5986 (WinRM) — For remote execution with invoke winrm
• 88 (Kerberos) — Domain controllers
• 389/636 (LDAP/LDAPS) — Directory services

Adjust --timeout and --threads based on the network: low values for fast local networks, high values for slow or firewalled networks. Keep threads low to avoid detection.

taskhound#

Enumerates scheduled tasks from a remote host through the ITaskService COM interface.

taskhound DC01
taskhound FILESERVER01 --filter backup

When to use: Scheduled tasks reveal valuable information:

• Script paths that may be modifiable for persistence
• Service accounts used to run the tasks (potential credential targets)
• Execution patterns that reveal maintenance operations
• Installed software from the tasks it runs

Use --filter to search for specific tasks like “backup”, “update”, or “sync” that typically run with elevated privileges.

quser#

Queries active user sessions on a remote host.

quser DC01
quser 10.0.0.50

When to use: To identify which users are logged into a system before performing lateral movement. Allows you to:

• Confirm whether a target user is logged into a specific system
• Verify whether a domain admin has an active session (target for token theft)
• Assess the risk of detection when accessing a system with active users
• Identify disconnected sessions that could be hijacked

nbtscan#

NetBIOS name scanner with automatic target registration in the GUI.

nbtscan 192.168.1.0/24
nbtscan 10.0.0.0/16 --timeout 3000 --threads 4

Automatic target registration: Hosts discovered by nbtscan are automatically registered in JustC2’s Targets panel. This allows quickly visualizing all discovered systems and using them as targets for subsequent operations (lateral movement, enumeration, etc.).

When to use: As the first network discovery tool. NetBIOS provides:

• Computer name
• Domain/workgroup name
• Service status (file server, domain controller, etc.)
• MAC addresses

It is less intrusive than a full port scan and provides immediate context about the Windows infrastructure on the network.

Recommended workflow#

1. nbtscan on the local subnet — Discover Windows hosts and register them as targets
2. smartscan with key ports (445, 3389, 5985, 1433, 88) — Identify available services
3. quser on hosts of interest — Check active user sessions
4. taskhound on key servers — Search for tasks and service accounts

Combine these results with information from SAL-BOF to build a complete map of the environment before proceeding with credential extraction or lateral movement.