jm33-m0/emp3r0rSelf‑healing Gossip Mesh C2 with Assisted Peer Discovery, Cross-Platform BOF Execution, and Scriptable Agents.
A self-healing, memory-only C2 for Linux and Windows — agents that survive broken links, never touch disk, and script their way through the Win32 API.
emp3r0r is a post-exploitation framework and C2 built for Linux and Windows environments where stealth and resilience aren't optional. Instead of assuming a reliable connection back to one server, agents form a self-healing mesh that keeps working when links break. Instead of asking the target for Python or PowerShell, they execute everything in memory. And instead of limiting you to one platform's tricks, emp3r0r runs Windows BOFs, Linux objects, and Starlark scripts — all fileless, all in-process.
Every agent carries its own scripting engine, so you can drop in new post-exploitation logic without compiling or shipping binaries.
Why this matters: writing and extending agent functionality becomes as simple as editing a script, with none of the footprint of dropping an interpreter or a new binary on the target.
Agents bind their identity to a cryptographic key the first time they talk to you — and that binding never changes.
Why this matters: session hijacking and agent cloning simply don't happen; every agent you talk to is the one you enrolled.
Every C2 and peer link uses ephemeral ECDH keys with session-derived encryption keys.
Why this matters: even if a long-term key is compromised later, it can't be used to decrypt traffic that already passed.
Agents discover each other and relay traffic through a gossip mesh, so the operation doesn't collapse when one link or one server disappears.
Why this matters: the network does the pivoting for you. Cut a link, lose a box, or block the C2 — agents re-route on their own.
Files move between agents directly, not just through the C2.
Why this matters: delivery is fast and mostly invisible to the C2 channel — ideal for egress-restricted environments.
Getting an agent in is treated as seriously as keeping it alive.
Why this matters: small, adaptable, and memory-hygienic initial access means you can land on hosts that would otherwise be out of reach.
Run compiled C modules in-process on either platform:
Why this matters: BOFs are only as good as their loader — emp3r0r runs them in-process with no new process and no trace left behind, on both Linux and Windows.
Native libraries are mapped into the agent's own address space and called there — no LoadLibrary, no dlopen, no file ever hits disk.
memmod loads PE DLLs on Windows and ELF .so on Linux, handling relocations, imports, and export calls in-process.memmod PE loader and the Sliver C2 / sliverarmory/reflektor ELF loader and call machinery.memdeps sits above it: a declared dependency is resolved from encrypted memfs/C2, mapped only for the operation that needs it, and unmapped on return.Why this matters: extending the agent with native code doesn't require a new binary, a loader service, or a file on disk.
Linux modules are Starlark scripts that can reach all the way into the kernel. The agent maps libbpf on demand and exposes its API to scripts as Go-backed builtins, so a module can enumerate, attach to, and tear down eBPF objects with no compiler and no child process.
ebpf_progs, ebpf_maps, ebpf_links, ebpf_detach, ebpf_map_wipe, ebpf_code_offset, and the long-lived ebpf_uprobe_start/ebpf_uprobe_stop.ssh_harvest is the worked example: it locates a pattern in sshd, attaches a long-lived uprobe, streams captured credentials live, and holds it until --disable — no ptrace, no breakpoints, no disk..so a module declares or supplies, and scripts can map bytes directly with mem_load_library.Why this matters: kernel-level tradecraft is a script plus a library the agent maps only while it needs it, then drops.
Once you're on a Windows host, emp3r0r lets you become the users on it — without ever dropping a tool.