Coffee

Coffee is a custom implementation of the original Cobalt Strike's beaconinlineexecute. It is written in Rust and supports most of the features of the Cobalt Strike compatibility layer. Coffee is structured so it can be used as a library in other projects too.

The original blog post can be found here: https://labs.hakaioffsec.com/coffee-a-coff-loader-made-in-rust/

Usage

```bash $ coffee.exe -h Coffee: A COFF loader made in Rust

Usage: coffee.exe [OPTIONS] --bof-path [-- ...]

Arguments: [ARGS]... Arguments to the BOF passed after the "--" delimiter, supported types are: str, wstr, int, short

Options: -b, --bof-path Path to the Beacon Object File (BOF) -e, --entrypoint The entrypoint name to execute in case of a custom entrypoint name [default: go] -v, --verbosity Verbosity level, 0 = ERROR, 1 = WARN, 2 = INFO, 3 = DEBUG, 4 = TRACE [default: 0] -h, --help Print help -V, --version Print version ```

Arguments

Arguments for the BOF can be passed after the -- delimiter. Each argument must be prefixed with the type of the argument followed by a colon (:). The following types are supported:

str - A null-terminated string
wstr - A wide null-terminated string
int - A signed 32-bit integer
short - A signed 16-bit integer

Example

Using the dir.x64.o BOF from the trustedsec/CS-Situational-Awareness-BOF repository and passing arguments to the BOF:

bash coffee.exe --bof-path .\dir.x64.o -- wstr:"C:\\Windows\\System32"

Building from source

Install Rust from https://rustup.rs/
Clone the repository
Build the project using

bash cargo build --release

License

Coffee is licensed under the GNU GPLv3 license. See LICENSE for more information.

Contributing

Pull requests are welcome. Please open an issue first to discuss what you would like to change.

References

Thanks to the amazing people who have written about COFF loaders and helped me understand the format: