Coffee is a custom implementation of the original Cobalt Strike's beaconinlineexecute. It is written in Rust and supports most of the features of the Cobalt Strike compatibility layer. Coffee is structured so it can be used as a library in other projects too.
The original blog post can be found here: https://labs.hakaioffsec.com/coffee-a-coff-loader-made-in-rust/
```bash $ coffee.exe -h Coffee: A COFF loader made in Rust
Usage: coffee.exe [OPTIONS] --bof-path
Arguments: [ARGS]... Arguments to the BOF passed after the "--" delimiter, supported types are: str, wstr, int, short
Options:
-b, --bof-path
Arguments for the BOF can be passed after the -- delimiter. Each argument must be prefixed with the type of the argument followed by a colon (:). The following types are supported:
str - A null-terminated stringwstr - A wide null-terminated stringint - A signed 32-bit integershort - A signed 16-bit integerUsing the dir.x64.o BOF from the trustedsec/CS-Situational-Awareness-BOF repository and passing arguments to the BOF:
bash
coffee.exe --bof-path .\dir.x64.o -- wstr:"C:\\Windows\\System32"
bash
cargo add coffee-ldr
Coffee can be used as a library in other projects. The following example shows how to use Coffee to load a BOF and execute the BOF:
```rust use coffee_ldr::loader::Coffee;
fn main() { let whoami_bof: [u8; 6771] = [ 0x64, 0x86, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x14, 0x00, 0x00, 0x33, 0x00, 0x00, ... ];
let _ = Coffee::new(&whoami_bof).unwrap().execute(None, None, None);
} ```
The example above will execute the BOF passed as an array of bytes and show the output in console.
The detailed documentation can be found at: https://docs.rs/coffee-ldr/latest/coffee_ldr/loader/struct.Coffee.html
bash
cargo build --release
Coffee is licensed under the GNU GPLv3 license. See LICENSE for more information.
Pull requests are welcome. Please open an issue first to discuss what you would like to change.
Thanks to the amazing people who have written about COFF loaders and helped me understand the format: