From 2f2a3cdde47f86c1ac1523a7c2700acb462d5a2a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andrei=20S=C3=82NTOMA?= Date: Fri, 27 Feb 2026 16:07:02 +0200 Subject: [PATCH 1/3] Make boolean parameter strings received from starkiller lowercase --- .../modules/bof/credentials/nanodump.py | 32 +++++++++++-------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/empire/server/modules/bof/credentials/nanodump.py b/empire/server/modules/bof/credentials/nanodump.py index 67de3cdf1..4bf545111 100644 --- a/empire/server/modules/bof/credentials/nanodump.py +++ b/empire/server/modules/bof/credentials/nanodump.py @@ -17,33 +17,37 @@ def generate( "DumpPath": params.get("write", "find_me.dmp"), "WriteFile": "1" if params.get("write") else "0", "Chunksize": params.get("chunksize") if params.get("chunksize") else "0", - "ValidSignature": "1" if params.get("valid") == "true" else "0", - "Fork": "1" if params.get("fork") == "true" else "0", - "Snapshot": "1" if params.get("snapshot") == "true" else "0", - "DuplicateHandle": "1" if params.get("duplicate") == "true" else "0", - "ElevateHandle": "1" if params.get("elevate-handle") == "true" else "0", + "ValidSignature": "1" if params.get("valid").lower() == "true" else "0", + "Fork": "1" if params.get("fork").lower() == "true" else "0", + "Snapshot": "1" if params.get("snapshot").lower() == "true" else "0", + "DuplicateHandle": "1" if params.get("duplicate").lower() == "true" else "0", + "ElevateHandle": "1" if params.get("elevate-handle").lower() == "true" else "0", "DuplicateElevate": ( - "1" if params.get("duplicate-elevate") == "true" else "0" + "1" if params.get("duplicate-elevate").lower() == "true" else "0" ), - "GetPID": "1" if params.get("getpid") == "true" else "0", + "GetPID": "1" if params.get("getpid").lower() == "true" else "0", "SecLogonLeakLocal": ( - "1" if params.get("seclogon-leak-local") == "true" else "0" + "1" if params.get("seclogon-leak-local").lower() == "true" else "0" ), "SecLogonLeakRemote": ( - "1" if params.get("seclogon-leak-remote") == "true" else "0" + "1" if params.get("seclogon-leak-remote").lower() == "true" else "0" ), "SecLogonLeakRemoteBinary": ( - "0" if params.get("seclogon-leak-remote") == "true" else "" + "0" if params.get("seclogon-leak-remote").lower() == "true" else "" ), "SecLogonDuplicate": ( - "1" if params.get("seclogon-duplicate") == "true" else "0" + "1" if params.get("seclogon-duplicate").lower() == "true" else "0" ), - "SpoofCallstack": "1" if params.get("spoof-callstack") == "true" else "0", - "SilentProcessExit": "1" if params.get("silent-process-exit") else "0", + "SpoofCallstack": "1" if params.get("spoof-callstack").lower() == "true" else "0", + "SilentProcessExit": "1" if params.get("silent-process-exit").lower() else "0", "SilentProcessExitBinary": params.get("silent-process-exit", ""), - "Shtinkering": "1" if params.get("shtinkering") == "true" else "0", + "Shtinkering": "1" if params.get("shtinkering").lower() == "true" else "0", } + import debugpy + # debugpy.wait_for_client() + # breakpoint() + return main_menu.modulesv2.generate_script_bof( module=module, params=params_dict, From e2033be094c0f4594cd5e5ea914f366fa2c35725 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andrei=20S=C3=82NTOMA?= Date: Fri, 27 Feb 2026 16:07:39 +0200 Subject: [PATCH 2/3] Remove chunk-size parameter from bof nanodump module Disassembling nanodump.x64.o with objdump reveals only 18 parameter are accepted by the binary, but 19 are specified in nanodump.yaml and nanodump.py. Examining previous commits (more specifically, 698cf4b) revealed that a potential cause could be the addition of the chunksize parameter. Manual testing revealed that is the case. --- empire/server/modules/bof/credentials/nanodump.py | 5 ----- empire/server/modules/bof/credentials/nanodump.yaml | 6 +++--- 2 files changed, 3 insertions(+), 8 deletions(-) diff --git a/empire/server/modules/bof/credentials/nanodump.py b/empire/server/modules/bof/credentials/nanodump.py index 4bf545111..5236e64d0 100644 --- a/empire/server/modules/bof/credentials/nanodump.py +++ b/empire/server/modules/bof/credentials/nanodump.py @@ -16,7 +16,6 @@ def generate( "ProcessID": params.get("pid") if params.get("pid") else "0", "DumpPath": params.get("write", "find_me.dmp"), "WriteFile": "1" if params.get("write") else "0", - "Chunksize": params.get("chunksize") if params.get("chunksize") else "0", "ValidSignature": "1" if params.get("valid").lower() == "true" else "0", "Fork": "1" if params.get("fork").lower() == "true" else "0", "Snapshot": "1" if params.get("snapshot").lower() == "true" else "0", @@ -44,10 +43,6 @@ def generate( "Shtinkering": "1" if params.get("shtinkering").lower() == "true" else "0", } - import debugpy - # debugpy.wait_for_client() - # breakpoint() - return main_menu.modulesv2.generate_script_bof( module=module, params=params_dict, diff --git a/empire/server/modules/bof/credentials/nanodump.yaml b/empire/server/modules/bof/credentials/nanodump.yaml index 4d32d034d..76d9b3bd6 100644 --- a/empire/server/modules/bof/credentials/nanodump.yaml +++ b/empire/server/modules/bof/credentials/nanodump.yaml @@ -7,8 +7,8 @@ description: Beacon Object File (BOF) that creates a minidump of the LSASS proce using various evasion techniques to bypass security monitoring. Supports multiple dumping methods including handle duplication, process forking, snapshot creation, and seclogon handle leaking. Can generate both valid and invalid signature dumps, - with options for chunked writing and various privilege escalation techniques to - access LSASS memory while avoiding detection. + with various privilege escalation techniques to access LSASS memory while avoiding + detection. software: '' tactics: [TA0006] techniques: [T1003.001] @@ -138,7 +138,7 @@ bof: x86: bof/nanodump/nanodump.x86.o x64: bof/nanodump/nanodump.x64.o entry_point: '' - format_string: iziiiiiiiiiiiziiizi + format_string: iziiiiiiiiiiziiizi script_path: '' script_end: '' advanced: From ec158f7e6b3f003d47e83706feac5061cb3ccdf7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andrei=20S=C3=82NTOMA?= Date: Fri, 27 Feb 2026 16:16:21 +0200 Subject: [PATCH 3/3] Add entry to CHANGELOG.md --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 27204fa1d..72ed5d96e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,6 +21,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Fixed stop-job handlers in PowerShell and Python agents crashing when the target job doesn't exist +- Fixed bof nanodump module not running ## [6.4.1] - 2026-02-15 - Fixed the `docs/quickstart/installation/README.md` file to specify a previously missing reference to Ubuntu