BOFScale A CDN-Fronted Tailnet from a BOF-PE

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://netspi.com/blog/technical-blog/red-teaming/bofscale-a-cdn-fronted-tailnet-from-a-bof-pe
• Blog Title: BOFScale: A CDN-Fronted Tailnet from a BOF-PE
• Suggested Section: Generic Hacking > Tunneling and Port Forwarding, with cross-references from Windows Hardening > Cobalt Strike and Active Directory Methodology > Force NTLM Privileged Authentication

🎯 Content Summary

Overview and architecture

BOFScale is an open-source red-team toolset that runs a modified Tailscale network overlay entirely inside a Windows C2 implant. It avoids installing a TUN driver, Windows service, persistent state file, or child processes. Its control-plane and relay traffic is transported as RFC 6455 WebSockets over TCP/443, allowing the operator-controlled Headscale and DERP infrastructure to sit behind CloudFront or Fastly and resemble ordinary CDN-fronte...

🔧 Technical Details

Convert proprietary HTTP upgrades into CDN-compatible WebSockets: When a control or relay protocol uses a non-standard HTTP upgrade that a CDN rejects, encapsulate the same protocol stream in RFC 6455 WebSockets. Preserve the normal dialing path but retry through WebSockets on intermediary-specific responses, such as HTTP 500 for TS2021 and HTTP 426 for DERP. Set a protocol-specific WebSocket subprotocol, retain system-proxy support, and optionally force WebSocket mode when the standard path is known to be blocked.

Run a network overlay entirely inside an implant: Compile a network daemon as a CGo c-shared DLL/BOF-PE, execute it as an asynchronous job, select a pure userspace network stack, store state in memory, and expose the local control API through a randomized Windows named pipe. Redirect stdout and stderr through an operating-system pipe into the C2 output API. Host the Go runtime in a sacrificial process because unloading ...

🤖 Agent Actions

Updated src/generic-hacking/tunneling-and-port-forwarding.md with a BOFScale section covering:

• CDN-compatible TS2021/DERP WebSocket transport.
• In-process userspace Tailscale and named-pipe control.
• SOCKS5 bridging and NTLM relay separation.
• Go runtime unloading caveat.
• Technical detection indicators and YARA rules.
• Numbered references to the primary repository and NetSPI article.

Validation passed for references, citations, internal links, source URLs, forbidden sources, and git diff --check. Only the intended file changed. mdbook was unavailable for a full build.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://netspi.com/blog/technical-blog/red-teaming/bofscale-a-cdn-fronted-tailnet-from-a-bof-pe

Content Categories: Based on the analysis, this content was categorized under "Generic Hacking > Tunneling and Port Forwarding, with cross-references from Windows Hardening > Cobalt Strike and Active Directory Methodology > Force NTLM Privileged Authentication".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0