emp3r0r

项目说明

A self-healing, memory-only C2 for Linux and Windows — agents that survi links, ne disk, and script their way through the Win32 API.

![Discord]()
![GitHub Sponsors]()

!GitHub go.mod Go
![Tests]()
!GitHub License
![GitHub release]()

---

What is emp3r0r?

emp3r0r is a post-exploitation framework and C2 built for Linux and Windows en where stealth and resilience aren't optional. Instead of assuming a reliable connection back to one server, agents form a self-healing mesh that keeps working when links break. Instead of asking the target for Python or PowerShell, they execute e in memory. And instead of limiting you to one platform's tricks, emp3r0r runs Windows BOFs, Linux objects, and Starlark scripts — all fileless, all in-process.

---

Key Highlights & Unique Features

🐍 Scriptable Agents (Embedded Starlark Engine & Win32 API Proxy)

Every agent carries its own scripting engine, so you can drop in new post-exploitation logic without compiling or shipping binaries.

Scripts run entirely in memory — no Python, Bash, or PowerShell required on the target, and no command interpreters spawned.

A full set of built-in APIs covers file I/O, HTTP, command execution, and more, straight from script code.

On Windows, scripts can call nati functions directly — the agent proxies straight into system DLLs.

Modules are plain Starlark files with a small JSON manifest, so adding your own is easy and fileless.

Why this matters: writing and extending agent functionality becomes as simple as editing a script, with none of the footprint of dropping an interpreter or a new binary on the target.

---

🔐 TOFU Cryptographic Identity Pinning

Agents bind their identity to a cryptographic key the first time they talk to you — and that binding ne.

Re-enrollment with different credentials is treated as an impostor and rejected.

Removing an agent is an explicit operator decision, not something a stolen key can do quietly.

Why this matters: session hijacking and agent cloning simply don't happen; every agent you talk to is the one you enrolled.

---

🔒 Perfect Forward Secrecy (PFS)

Every C2 and peer link uses ephemeral ECDH keys with session-deri keys.

Why this matters: even if a long-term key is compromised later, it can't be used to decrypt traffic that already passed.

---

🕸️ Autonomous P2P Gossip Mesh Network

Agents discover each other and relay traffic through a gossip mesh, so the operation doesn't collapse when one link or one ser.

Peers connect o mTLS 1.3 or reliable UDP (KCP), with every hop encrypted.

Traffic routes around dead relays automatically — no manual proxy surgery mid-operation.

Segments with no direct C2 access still stay reachable through their neighbors.

Why this matters: the network does the pi for you. Cut a link, lose a box, or block the C2 — agents re-route on their own.

---

📂 P2P Filesystem

Files mo agents directly, not just through the C2.

Transfers ride encrypted peer-to-peer tunnels, so internal networks don't bottleneck on your server.

Files are cached in agent memory as encrypted blobs and served to peers on demand.

If no peer has a file, the agent fetches it from the C2 automatically.

Why this matters: delivery is fast and mostly in to the C2 channel — ideal for egress-restricted en.

---

📡 Multi-Protocol Listeners & Pluggable Stagers

Getting an agent in is treated as seriously as keeping it alive.

HTTP, TCP, and UDP listeners with reliable framing and customizable HTTP profiles.

A roughly 2KB stager built on direct Linux syscalls — no libc, no toolchain on the target.

Pluggable stager transports and self-unpacking packers let you blend initial access into whate your target allows, and defeat static signature matching along the way.

Stage and agent code respect read/write/execute discipline — never RWX.

Why this matters: small, adaptable, and memory-hygienic initial access means you can land on hosts that would otherwise be out of reach.

---

🧩 Nati BOF & PICO Support (COFF, ELF & PICO)

Run compiled C modules in-process on either platform:

Windows COFF/BOF binaries with typed argument packing.

Linux ELF relocatable objects loaded straight into agent memory.

Crystal-Kit PICO modules with SilentMoonwalk callstack spoofing.

Kerbeus-BOF, Remote-OPs, and a Situational Awareness suite ship ready to use.

Why this matters: BOFs are only as good as their loader — emp3r0r runs them in-process with no new process and no trace left behind, on both Linux and Windows.

---

🧬 In-Memory Library Loader (memmod)

Nati are mapped into the agent's own address space and called there — no LoadLibrary, no dlopen, no file ever hits disk.

memmod loads PE DLLs on Windows and ELF .so on Linux, handling relocations, imports, and export calls in-process.

It builds on pro work: WireGuard's memmod PE loader and the Sliver C2 / sli/reflektor ELF loader and call machinery.

memdeps sits above it: a declared dependency is resolved from encrypted memfs/C2, mapped only for the operation that needs it, and unmapped on return.

Why this matters: extending the agent with native code doesn't require a new binary, a loader service, or a file on disk.

---

🐧 Linux Modules & eBPF

Linux modules are Starlark scripts that can reach all the way into the kernel. The agent maps libbpf on demand and exposes its API to scripts as Go-backed builtins, so a module can enumerate, attach to, and tear down eBPF objects with no compiler and no child process.

The builtins mirror libbpf: ebpf_progs, ebpf_maps, ebpf_links, ebpf_detach, ebpf_map_wipe, ebpf_code_offset, and the long-lived ebpf_uprobe_start/ebpf_uprobe_stop.

ssh_harvest is the worked example: it locates a pattern in sshd, attaches a long-li, streams captured credentials live, and holds it until --disable — no ptrace, no breakpoints, no disk.

libbpf is not the only option: the same on-demand loader handles any .so a module declares or supplies, and scripts can map bytes directly with mem_load_library.

Why this matters: kernel-le is a script plus a library the agent maps only while it needs it, then drops.

---

🔑 Windows Tokens, Netonly Sessions & Kerberos Tickets (PTT)

Once you're on a Windows host, emp3r0r lets you _become_ the users on it — without e a tool.

Steal an access token from any running process and use it e: Go modules, Starlark, BOFs.

Create disposable netonly sessions with a module's --user flag: they keep your agent's own identity and only borrow the target user's for outbound access — any password works, nothing is e.

Import Kerberos tickets with the --ticket flag for full pass-the-ticket: your network identity becomes the ticket's (say, the Domain Admin) while your local identity ne.

Every token-aware module accepts --token, --user, and --ticket, so switching identity is one flag away — including creating a session and loading a ticket in a single command.

Tickets live per logon session, so the DA material stays quarantined in a disposable session you can purge, and the agent process itself stays clean.

Why this matters: lateral mo to machines running no agent at all — SMB shares, service control, CIFS — becomes a normal part of your workflow, authenticated as the user you', not as a tool on disk.

---

🧦 SOCKS5 Pi & Operator-Side tun2socks

Pi burning another implant: the C2 runs a SOCKS5 proxy that relays through the agent you select, and the operator side can go one step further with a transparent TUN device.

socks_start 1080 gives you a SOCKS5 endpoint on the C2 that tunnels through the chosen agent — point proxychains or any tool at it and you're inside the target network.

tun2socks start --route 10.10.0.0/24 creates a TUN device that routes only the subnets you name through that proxy — e else keeps using your normal connection.

The result looks like it originates from the agent, with no per-tool proxy configuration.

Why this matters: reach entire agent-side networks transparently — curl a DC, use any tool — with egress that appears to come from the target network, not your operator box.

---

🎭 Pluggable C2 Transport, uTLS JA3 E & CBOR Protocol

Choose beacon-style HTTP polling or streaming HTTP/2 — both with malleable profiles.

TLS fingerprints are randomized with uTLS, so the channel doesn't stand out in network telemetry.

Control traffic rides a compact CBOR protocol — smaller, faster, and harder to parse than JSON.

Why this matters: the C2 channel is made to look like ordinary traffic and stay lean on the wire.

---

💾 Encrypted Memory-First Storage

Agent file operations run against an in-memory, AES-GCM-encrypted filesystem; large data spills to disk only as encrypted blobs with no identifiable headers.

P2P-capable agents cache what they fetch and share it with peers, shrinking C2 traffic further.

Why this matters: even disk is treated as hostile — the agent keeps no plaintext artifacts around to find.

---

Quick Start

1. C2 Ser

Building emp3r0r requires Docker or Podman on the host — no local Go toolchain.

The installer builds e in a throwaway container and prepares the operator kit. Useful flags: --lightweight (Linux/Windows amd64 only, fastest), --targets OS/ARCH,..., --debug, --skip-build.

Launch the server:

2. Operator Machine Setup

Connect using the WireGuard credentials the ser:

3. Generate Agent Payloads

Inside the operator console:

Mesh nodes may run different transports. Each agent ad the transport and
port its relay listens on, and dialers always use the _peer's_ ad
transport, so a mixed mesh (for example Windows SMB nodes alongside Linux mTLS
nodes) routes through a peer that shares a usable transport instead of assuming
e runs the local default. smb is only accepted for Windows payloads;
kcp/mtls work e.

---

Documentation & Resources

🛠️ Module De Guide: core/modules/module_de.md

🧪 Testing Guide: TESTING.md

📝 Security Policy: SECURITY.md

📜 Changelog: CHANGELOG.md

---

Support De

If emp3r0r has pro in your security research and testing, consider supporting its continued de via GitHub Sponsors.

项目信息

开发语言：Go

Star 数：1765

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Self‑healing Gossip Mesh C2 with Assisted Peer Discovery, Cross-Platform BOF Execution, and Scriptable Agents.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	emp3r0r - Self‑healing Gossip Mesh C2 with Assisted Peer Dis
所属分类	病毒分析
发布作者	admin
发布时间	2026-10-05 23:12:26
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	523
讨论数量	0
主题状态	正常讨论中

emp3r0r - Self‑healing Gossip Mesh C2 with Assisted Peer Dis