This article describes BOFScale, which runs a modified Tailscale daemon and client entirely in-memory to tunnel TS2021 control traffic and DERP relay traffic over standard WebSockets through CloudFront or Fastly. It also shows how the stack uses Headscale, SOCKS5 port forwarding, and userspace networking to support covert access, routing, and NTLM relay operations while reducing disk, service, and child-process artifacts. #BOFScale #Tailscale #Headscale #CloudFront #Fastly #DERP #TS2021
Keypoints
- The modified Tailscale daemon runs inside the implant process as an async BOF-PE with no driver, service, disk state, or child processes.
- Standard WebSocket support was patched into Tailscale so DERP and TS2021 traffic can blend in with normal browser WebSocket traffic at CDN edges.
- Automatic fallback logic lets the client try the normal upgrade first and switch to WebSockets when a proxy or CDN blocks the standard path.
- A Docker Compose Headscale stack hosts the control plane and embedded DERP relay behind a CDN distribution, with init containers handling bootstrap tasks.
- socksportfwd bridges userspace networking limitations by forwarding local ports through the daemon’s SOCKS5 proxy to hosts on the tailnet.
- The example workflow shows attack VM enrollment, subnet route advertisement, and NTLM relay against an AD CS web enrollment target.
- The article highlights OPSEC reductions such as disabling logtail, removing child-process DNS actions, using in-memory state, and randomizing sockets and ports.
MITRE Techniques
- [T1105] Ingress Tool Transfer – The modified binaries and release artifacts are delivered through the accompanying repository and used to move tooling onto the target system (‘Build instructions and release binaries are available on the GitHub repository’).
- [T1057] Process Discovery – The operator uses status and peer tables to inspect connected nodes and their states (‘status fetches the current node status and formats a peer table’).
- [T1090.001] Internal Proxy – socksportfwd relays victim-originated connections through a SOCKS5 proxy to reach tailnet resources (‘forwarding local ports through the SOCKS5 server’).
- [T1090.003] Multi-hop Proxy – Traffic is chained from the victim host to the implant, then over the tailnet to the attack VM (‘relays data bidirectionally between the incoming connection and the SOCKS socket’).
- [T1090.002] External Proxy – The infrastructure is fronted by CloudFront or Fastly to hide the true origin (‘DERP relay servers and the control plane can sit behind CloudFront or Fastly’).
- [T1021.002] SMB/Windows Admin Shares – Local port 445 can be used after stopping SMB service to forward traffic into the tailnet (‘port 445 can be used instead by stopping the SMB service’).
- [T1047] Windows Management Instrumentation – Not mentioned.
- [T1046] Network Service Scanning – netcheck probes DERP connectivity and measures RTT across regions (‘runs a series of STUN Binding Requests against it’).
- [T1090] Proxy – The daemon’s traffic is intentionally routed through SOCKS5 and CDN-backed relays to obscure the final destination (‘Traffic relays over standard WebSockets’).
- [T1071.001] Web Protocols – TS2021 and DERP are tunneled over RFC 6455 WebSockets and HTTPS (‘standard Upgrade: websocket request’).
- [T1106] Native API – ICMP pings were replaced with Windows ICMP APIs to avoid spawning ping.exe (‘direct calls to the Windows ICMP API using IcmpCreateFile, IcmpSendEcho2, and IcmpCloseHandle’).
- [T1569.002] Service Execution – Not used; the article explicitly avoids creating a service by running entirely in-process (‘no driver, no service’).
Indicators of Compromise
- [Domain / CDN hostname ] CDN-fronted Headscale and DERP endpoint – d1a2b3c4e5f6g7.cloudfront.net, Fastly
- [Named pipe ] In-memory daemon socket path for local API access – .pipe8f3a1c2d-4b5e-6f7a-8b9c-0d1e2f3a4b5c, .pipe
- [IP address ] Example tailnet and victim-network addresses used in the workflow – 100.64.0.1, 192.168.0.20
- [URL / endpoint ] Headscale and relay paths used over reverse proxy – /ts2021, /derp, /key, /localapi/v0/status
- [File names ] Configuration and policy files referenced in the stack – headscale-config.yaml, derpmap.yaml, headplane-config.yaml, policy.json
- [Pre-auth key ] Enrollment keys generated for implants and operators – tskey-auth-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, and other 90-day keys
- [Port ] Services exposed by the stack and forwarder – 5566, 1080, 8888, 3000, 443
Read more: https://www.netspi.com/blog/technical-blog/red-teaming/bofscale-a-cdn-fronted-tailnet-from-a-bof-pe/