BOFScale Runs Tailscale In-Memory to Route C2 Traffic Through CDN-Fronted WebSockets
Summary
BOFScale runs a modified Tailscale daemon inside a BOF-PE implant and routes traffic through CDN-fronted WebSockets. The article details its Headscale setup, an NTLM relay workflow, and detection opportunities.
Key points
- BOFScale runs a modified Tailscale daemon in-process as an asynchronous BOF-PE, using userspace networking and in-memory state without a driver or service.
- Patches enable Tailscale’s DERP relay and TS2021 control traffic to use standard WebSockets, allowing a Headscale tailnet to operate behind CloudFront or Fastly.
- A companion SOCKS5 port forwarder bridges local connections to tailnet hosts; implants can also advertise routes into the victim network.
- The demonstrated workflow uses PetitPotam to coerce domain-controller authentication and relay it through the implant to AD CS, obtaining a certificate for the DC machine account.
- Stealth measures include avoiding disk state and child processes; the daemon exposes a SOCKS5 listener on 0.0.0.0:1080, which defenders can monitor.
- Suggested detections include YARA scans of process memory and monitoring WebSocket upgrades using the derp or ts2021 subprotocols; network inspection requires TLS visibility.
Article Details
- Attack Vectors
- The research implementation runs a modified network daemon as an asynchronous, memory-resident BOF-PE inside an implant process, without a kernel driver, service, persistent node state, or post-startup child processes.
- Control-plane and relay connections use standard RFC 6455 WebSockets through CDN infrastructure, allowing operator-controlled infrastructure to blend with ordinary CDN traffic.
- Advertised subnet routes allow an operator machine to reach internal victim-network hosts through the implant.
- A local TCP forwarder carries incoming authentication traffic through the daemon's SOCKS5 proxy to an operator-controlled relay listener.
- The demonstration coerces a domain controller into WebDAV authentication, relays its NTLM authentication to a web enrollment endpoint, and obtains a certificate for the domain controller machine account.
- Defensive Notes
- Scan process memory using the supplied component-specific and generic YARA rules. The source reports zero false positives against legitimate binaries compiled from the same source tree, not against all software.
- Look for Go runtime signatures and heaps inside processes that are not expected to contain Go code.
- Inspect randomly named UUID pipes with the permissive SDDL D:(A;;GA;;;WD), which the source says differs from a legitimate installation.
- Enumerate listening sockets and their owning processes. The daemon exposes an unauthenticated SOCKS5 listener on 0.0.0.0:1080, making it reachable beyond loopback where network access permits.
- With TLS inspection, detect outbound WebSocket upgrades whose Sec-WebSocket-Protocol header contains derp or ts2021, especially from unrelated processes or hosts without an authorized installation.
- Correlate unexpected SOCKS5 listeners, anomalous process ownership, and outbound CDN WebSocket traffic; individual signals are not conclusive.
- Memory signatures can fail after string changes, recompilation, or binary obfuscation. Review generic-rule matches in context because other BOF-PE tooling may match.
- Without TLS inspection or a TLS-terminating proxy, the WebSocket subprotocol headers are not visible to network-layer detection.
MITRE ATT&CK
T1055 · Process InjectionThe article describes injecting the daemon into a sacrificial process to isolate crashes caused by unmapping its Go runtime.T1071.001 · Web ProtocolsImplant control-plane and relay traffic uses HTTP WebSocket upgrades over HTTPS, with derp or ts2021 subprotocol headers.T1090.001 · Internal Proxysocksportfwd accepts connections on the compromised host and forwards them through the daemon's SOCKS5 proxy to a relay listener on the tailnet.T1090.002 · External ProxyOperator-controlled DERP infrastructure relays traffic between implants and the attack VM through a CDN-fronted deployment.T1557.001 · Name Resolution Poisoning and SMB RelayThe demonstration uses PetitPotam to coerce domain-controller NTLM authentication and ntlmrelayx to relay it to the AD CS web enrollment endpoint.T1572 · Protocol TunnelingThe modified implementation tunnels TS2021 control sessions and DERP relay traffic through standard RFC 6455 WebSockets.T1649 · Steal or Forge Authentication CertificatesThe demonstrated relay obtains and saves a certificate for the domain controller's machine account as DC01$.pfx.
Vendors
Products
AD CSThe AD CS server at 192.168.0.20 is the relay target.CloudFronta WebSocket connection, which means both the DERP relay servers and the control plane can sit behind CloudFront or Fastly without any special handling.Fastlyconnection, which means both the DERP relay servers and the control plane can sit behind CloudFront or Fastly without any special handling.HeadplaneIt combines Headscale with its embedded DERP relay and the Headplane admin UI, all configured from the start to sit behind a CDN distribution.HeadscaleThis matters because fronting the DERP servers and a self-hosted Headscale instance behind a CDN is a straightforward way to make the traffic blend in, as long as Tailscale is actually speaking standard WebSockets.LinuxMaking it work properly on Windows and Linux for DERP, and extending it to the TS2021 control protocol, required a handful of targeted changes to the codebase.Microsoft WindowsMaking it work properly on Windows and Linux for DERP, and extending it to the TS2021 control protocol, required a handful of targeted changes to the codebase.TailscaleRunning Tailscale as a network layer for C2 traffic is not a new idea.
Tools
BOFScaleWe have also include bofscale.yara in the GitHub repository which can detect all three components without generating false positives against legitimate tailscale binaries.ntlmrelayxWith tailscaled running and the node enrolled, socksportfwd binds port 8888 on the compromised host and forwards to a machine on the tailnet running ntlmrelayx.PetitPotamPetitPotam is then used to coerce dc01 at 192.168.0.10 into authenticating to the compromised host.socksportfwdThe third is socksportfwd, which bridges the gap that exists in userspace networking mode by forwarding local ports through the SOCKS5 server that tailscaled exposes, routing traffic to any node on the tailnet.tailscaleRunning Tailscale as a network layer for C2 traffic is not a new idea.tailscaledThe first is tailscaled, a modified Tailscale daemon compiled as a BOF-PE that runs as an async background job inside the implant.YARAWe have also include bofscale.yara in the GitHub repository which can detect all three components without generating false positives against legitimate tailscale binaries.