emp3r0r v4.15.0 — Self‑healing Gossip Mesh C2 with Assisted Peer Discovery, Cross-Platform BOF Execution, and Scriptable Agents.

emp3r0r

A self-healing, memory-only C2 for Linux and Windows — agents that survive broken links, never touch disk, and script their way through the Win32 API.

GitHub go.mod Go version GitHub License

What is emp3r0r?

emp3r0r is a post-exploitation framework and C2 built for Linux and Windows environments where stealth and resilience aren't optional. Instead of assuming a reliable connection back to one server, agents form a self-healing mesh that keeps working when links break. Instead of asking the target for Python or PowerShell, they execute everything in memory. And instead of limiting you to one platform's tricks, emp3r0r runs Windows BOFs, Linux objects, and Starlark scripts — all fileless, all in-process.

Key Highlights & Unique Features

🐍 Scriptable Agents (Embedded Starlark Engine & Win32 API Proxy)

Every agent carries its own scripting engine, so you can drop in new post-exploitation logic without compiling or shipping binaries.

Scripts run entirely in memory — no Python, Bash, or PowerShell required on the target, and no command interpreters spawned.
A full set of built-in APIs covers file I/O, HTTP, command execution, and more, straight from script code.
On Windows, scripts can call native Win32 functions directly — the agent proxies straight into system DLLs.
Modules are plain Starlark files with a small JSON manifest, so adding your own is easy and fileless.

Why this matters: writing and extending agent functionality becomes as simple as editing a script, with none of the footprint of dropping an interpreter or a new binary on the target.

🔐 TOFU Cryptographic Identity Pinning

Agents bind their identity to a cryptographic key the first time they talk to you — and that binding never changes.

Re-enrollment with different credentials is treated as an impostor and rejected.
Removing an agent is an explicit operator decision, not something a stolen key can do quietly.

Why this matters: session hijacking and agent cloning simply don't happen; every agent you talk to is the one you enrolled.

🔒 Perfect Forward Secrecy (PFS)

Every C2 and peer link uses ephemeral ECDH keys with session-derived encryption keys.

Why this matters: even if a long-term key is compromised later, it can't be used to decrypt traffic that already passed.

🕸️ Autonomous P2P Gossip Mesh Network

Agents discover each other and relay traffic through a gossip mesh, so the operation doesn't collapse when one link or one server disappears.

Peers connect over camouflage mTLS 1.3, Windows SMB named pipes, or reliable UDP (KCP), with every hop encrypted.
Traffic routes around dead relays automatically — no manual proxy surgery mid-operation.
Segments with no direct C2 access still stay reachable through their neighbors.

Why this matters: the network does the pivoting for you. Cut a link, lose a box, or block the C2 — agents re-route on their own.

📂 P2P Filesystem

Files move between agents directly, not just through the C2.

Transfers ride encrypted peer-to-peer tunnels, so internal networks don't bottleneck on your server.
Files are cached in agent memory as encrypted blobs and served to peers on demand.
If no peer has a file, the agent fetches it from the C2 automatically.

Why this matters: delivery is fast and mostly invisible to the C2 channel — ideal for egress-restricted environments.

📡 Multi-Protocol Listeners & Pluggable Stagers

Getting an agent in is treated as seriously as keeping it alive.

HTTP, TCP, and UDP listeners with reliable framing and customizable HTTP profiles.
A roughly 2KB stager built on direct Linux syscalls — no libc, no toolchain on the target.
Pluggable stager transports and self-unpacking packers let you blend initial access into whatever channel your target allows, and defeat static signature matching along the way.
Stage and agent code respect read/write/execute discipline — never RWX.

Why this matters: small, adaptable, and memory-hygienic initial access means you can land on hosts that would otherwise be out of reach.

🧩 Native Cross-Platform BOF & PICO Support (COFF, ELF & PICO)

Run compiled C modules in-process on either platform:

Windows COFF/BOF binaries with typed argument packing.
Linux ELF relocatable objects loaded straight into agent memory.
Crystal-Kit PICO modules with SilentMoonwalk callstack spoofing.
Kerbeus-BOF, Remote-OPs, and a Situational Awareness suite ship ready to use.

Why this matters: BOFs are only as good as their loader — emp3r0r runs them in-process with no new process and no trace left behind, on both Linux and Windows.

🧬 In-Memory Library Loader (memmod)

Native libraries are mapped into the agent's own address space and called there — no LoadLibrary, no dlopen, no file ever hits disk.

memmod loads PE DLLs on Windows and ELF .so on Linux, handling relocations, imports, and export calls in-process.
It builds on proven upstream work: WireGuard's memmod PE loader and the Sliver C2 / sliverarmory/reflektor ELF loader and call machinery.
memdeps sits above it: a declared dependency is resolved from encrypted memfs/C2, mapped only for the operation that needs it, and unmapped on return.

Why this matters: extending the agent with native code doesn't require a new binary, a loader service, or a file on disk.

🐧 Linux Modules & eBPF

Linux modules are Starlark scripts that can reach all the way into the kernel. The agent maps libbpf on demand and exposes its API to scripts as Go-backed builtins, so a module can enumerate, attach to, and tear down eBPF objects with no compiler and no child process.

The builtins mirror libbpf: ebpf_progs, ebpf_maps, ebpf_links, ebpf_detach, ebpf_map_wipe, ebpf_code_offset, and the long-lived ebpf_uprobe_start/ebpf_uprobe_stop.
ssh_harvest is the worked example: it locates a pattern in sshd, attaches a long-lived uprobe, streams captured credentials live, and holds it until --disable — no ptrace, no breakpoints, no disk.
libbpf is not the only option: the same on-demand loader handles any .so a module declares or supplies, and scripts can map bytes directly with mem_load_library.

Why this matters: kernel-level tradecraft is a script plus a library the agent maps only while it needs it, then drops.

🔑 Windows Tokens, Netonly Sessions & Kerberos Tickets (PTT)

Once you're on a Windows host, emp3r0r lets you become the users on it — without ever dropping a tool.