emp3r0r is a memory-only, self-healing C2 and post-exploitation framework for Linux and Windows, documented here for authorized red team operators and defensive researchers studying stealthy implant architectures.
| Tool | jm33-m0/emp3r0r — a self-healing, memory-only C2 and post-exploitation framework for Linux and Windows, written in Go under GPL-3.0 |
| Category | Command-and-control framework / post-exploitation tooling |
| Primary Use | Authorized red team engagements and lab research where operators need resilient agent meshes, fileless BOF/Starlark execution, and SOCKS5 pivoting across segmented networks |
| Safe Use | Deployment only within contracted, authorized penetration tests, isolated lab environments, or defensive malware research; use against systems you do not own or control is outside its legitimate purpose |
| Telemetry Note | Defenders should watch for randomized JA3 fingerprints via uTLS, CBOR-encoded beacon traffic over HTTP/2 polling streams, SMB named-pipe and KCP peer links, and in-process loading of PE/ELF objects without LoadLibrary/dlopen calls — behavioral patterns rather than stable static signatures |
emp3r0r occupies a distinctive niche in the open-source offensive tooling landscape: a post-exploitation framework and C2 written in Go, distributed under GPL-3.0, and currently sitting at roughly 1,755 stars on GitHub with its default development branch at v4. What separates it from the familiar commercial-and-open C2 crowd is a design philosophy the README states up front — agents that assume the network is hostile and unreliable, that never touch disk, and that treat extensibility as a scripting problem rather than a compilation problem. For defenders and authorized red teams alike, it is a useful case study in where modern implant design is heading.
The architectural centerpiece is the autonomous P2P gossip mesh. Rather than every agent beaconing home to a single server, agents discover each other and relay traffic peer-to-peer, with automatic re-routing around dead relays. Peers connect over what the README calls camouflage mTLS 1.3, Windows SMB named pipes, or reliable UDP via KCP, with encryption at every hop. The operational consequence is that segments with no direct C2 egress remain reachable through their neighbors — the mesh does the pivoting instead of the operator manually chaining proxies.
Scriptability is the second pillar. Every agent embeds a Starlark interpreter, meaning post-exploitation logic ships as plain script files with a small JSON manifest — no Python, Bash, or PowerShell on the target, and no spawned command interpreters. The built-in API surface covers file I/O, HTTP, and command execution, and on Windows scripts can proxy straight into native Win32 functions in system DLLs. From a defender's perspective this is significant: traditional detection logic keyed on interpreter child processes finds nothing to key on here.
Cross-platform module execution follows the same in-process discipline. emp3r0r loads Windows COFF/BOF binaries with typed argument packing, Linux ELF relocatable objects directly into agent memory, and Crystal-Kit PICO modules with SilentMoonwalk callstack spoofing. Bundled module suites include Kerbeus-BOF, Remote-OPs, and a situational awareness package. The loader itself, memmod, maps PE DLLs and ELF .so files into the agent's address space — handling relocations, imports, and export calls — explicitly building on WireGuard's memmod PE loader and the Sliver/reflektor ELF machinery, a candid acknowledgment of its upstream lineage.
Identity and crypto design is unusually well thought out for an open-source C2. Agents use TOFU cryptographic identity pinning: the agent binds to a key on first contact, and any later re-enrollment attempt with different credentials is rejected as an impostor. Every C2 and peer link uses ephemeral ECDH keys with session-derived encryption for perfect forward secrecy, so a later compromise of a long-term key cannot retroactively decrypt captured traffic. For defenders intercepting and storing C2 traffic, this means decryption upon key recovery is off the table.
Initial access tooling receives equal attention. Listeners exist for HTTP, TCP, and UDP with customizable malleable profiles, and a roughly 2KB stager built on direct Linux syscalls — no libc dependency, no toolchain on the target. Pluggable stager transports and self-unpacking packers are described as defeating static signature matching, and stage code is claimed to respect read/write/execute discipline, never mapping pages RWX. The transport layer randomizes TLS fingerprints with uTLS and encodes control traffic in compact CBOR rather than JSON, keeping the channel lean and boring on the wire.
The Linux side is where emp3r0r gets genuinely interesting from a research standpoint. Linux modules are Starlark scripts that can reach into the kernel: the agent maps libbpf on demand and exposes it through Go-backed builtins such as ebpf_progs, ebpf_maps, ebpf_links, ebpf_detach, and long-lived uprobe controls ebpf_uprobe_start/ebpf_uprobe_stop. The README's worked example, ssh_harvest, attaches a uprobe to sshd and streams captured credentials live — no ptrace, no breakpoints, no disk artifact. The same on-demand loader generalizes to any declared .so, with mem_load_library available for mapping raw bytes.
Windows identity tradecraft is handled through a token-aware module system. Modules accept --token to steal an access token from a running process, --user to create disposable netonly sessions that borrow a target identity for outbound access only, and --ticket to import Kerberos tickets for pass-the-ticket. Tickets live per logon session, quarantining privileged material in a session the operator can purge. These capabilities are documented for lateral movement workflows in authorized engagements and should be understood by blue teams as a reason to monitor token manipulation and unusual logon session activity rather than on-disk artifacts.
Pivoting closes the operational loop. socks_start 1080 stands up a SOCKS5 endpoint on the C2 that tunnels through a chosen agent, and the operator-side tun2socks start --route 10.10.0.0/24 creates a transparent TUN device routing only named subnets through it. A P2P filesystem complements this: files move agent-to-agent over encrypted tunnels, cached in memory as encrypted blobs, with automatic fallback to the C2 if no peer holds a copy. Storage throughout is memory-first — an AES-GCM-encrypted virtual filesystem with any disk spill written only as headerless encrypted blobs.
Modularity is a defensive-relevant detail: agents compile from independently gated features. install.py --agent-slim strips optional transports like KCP, h2conn, uTLS, DoH, and the CDN proxy, yielding a Windows DLL or Linux .so at roughly 11–13 MB, shrinking to 4–6 MB after shellcode conversion via donut or malasada. --agent-tags compiles out arbitrary feature subsets, and no_mesh opts out of the P2P layer entirely. The rationale is explicit — fewer dependencies and a shorter string table give EDR and AV less to key on. Researchers cloning the repo (git clone https://github.com/jm33-m0/emp3r0r) should consult OPERATOR.md, the module development guide, and TESTING.md for full deployment context.
For blue teams, the detection story is behavioral, not signature-driven. The combination of randomized JA3 fingerprints, CBOR-framed HTTP/2 streams, named-pipe and KCP peer chatter, in-process library mapping that bypasses LoadLibrary and dlopen monitoring, and headerless encrypted blob files on disk where spills occur defines a tradecraft profile worth hunting for in telemetry. Studying emp3r0r in a lab — snapshots, isolated networks, full authorization — is one of the more efficient ways to understand what memory-only, mesh-based implants look like from both sides of the wire, and the README itself is a remarkably candid architecture document for exactly that purpose.
jm33-m0/emp3r0r.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.