Skip to content

CHANGELOG.md

Latest commit

 

History

History
1288 lines (758 loc) · 88.3 KB

CHANGELOG.md

File metadata and controls

1288 lines (758 loc) · 88.3 KB
Raw

Changelog

4.17.0 (2026-09-09)

Features

  • loader: add a shellcode loader for Windows SCM-based workflows. (f6a115d)

Bug Fixes

  • console: command history not saved (b6763ad)
  • loader: move indirect syscalls to common/ntsys; fix stack-frame and (4b6c7c3)
  • module: do not inject Windows impersonation flags where they don't make sense (bc0f0df)

4.16.2 (2026-09-07)

Bug Fixes

4.16.1 (2026-09-07)

Bug Fixes

  • agent: guard empty/whitespace-only command frames from panicking (4b3dfe4)
  • sanitize: strip complete CSI/OSC terminal escape sequences (39508a1)
  • transport: make IPinCIDR overflow-safe, emit real IPs, add ParseTarget (eb6014c)
  • util: memfs — write-time RAM budget from free memory, spill to unmarked temp files (6084a49)

4.16.0 (2026-09-06)

Features

  • module: cifs download (7e38ec2)
  • module: monitor module dir and dynamically reload modules on-demand (1328f7a)

Bug Fixes

  • improve c2 server shutdown logic (9b71e6f)
  • logging: write logs in plaintext for better parsing compatibility (0eecd43)
  • module: promote SA/Remote-OPs BOF to top level command (without prefixes) (104e105)

4.15.0 (2026-09-04)

Features

  • module: cifs module (file upload and deletion via CIFS) (d96c479)
  • module: SCShell (e1b81be)

Bug Fixes

  • incorrect module parameter caching (c33e485)
  • payload arch selection (a23503a)
  • prepare module dependencies (6af129c)

4.14.0 (2026-09-03)

Features

  • socks5: SOCKS5 pivot relayed through agents (463b5a3)
  • tun2socks: integrate sing-tun to enable tun2socks on operator side (be3f58d)

Bug Fixes

  • C2: expand PFS coverage to all possible paths and improve secure conn tunnel (5d844ea)
  • cleanup incomplete (dfcf308)
  • resolve names too in case own IP gets routed (8ecf010)
  • tun2socks: panic (cb7d017)

4.13.0 (2026-09-02)

Features

  • agent: structured CBOR listings and --quiet for token/session completion (36e76a3)
  • agent: wire make_token/import_ticket into agent commands and modules (8c6e313)
  • driver: implement Windows kernel driver loading and management (059064c)
  • kkyum: add kkyum LOL driver module with Starlark entrypoint (demo driver loader) (de8913e)
  • module: implement multi-file module support with companion file caching in memfs (a7299a3)
  • priv: implement make_token netlogon sessions and Kerberos ticket import (7f79f9a)
  • SA: detailed error reporting in starlark modules; add starlarkrunner (b5fc1d3)
  • script: add Starlark bindings for Windows driver and DLL reflective loading APIs (04b5ec9)
  • syscall: add SilentMoonwalk call-stack spoofing via cgo (fb220ad)

Bug Fixes

  • make_token: netonly PTT container, atomic session-name and token fixes (5c6b1ca)
  • priv: \ escaping issue and command suggestion inconsistency (bce4665)
  • syscall: disable SilentMoonwalk in cgo builds, use pure-Go syscall path (8214b43)

4.12.2 (2026-08-26)

Bug Fixes

  • build: garble master branch has upgraded to Go 1.27. Pinning garble at v0.17.0 to retain Go 1.26 compatibility (254786f)
  • injection: fix thread injection (priv) module with operator-selected token support (a602c9f)

4.12.1 (2026-08-24)

Bug Fixes

  • stager: configurable build to address compatibility issues (7f23309)
  • stager: improve robustness in symbol resolution (ce88f92)

4.12.0 (2026-08-24)

Features

  • add optional TLS to standalone listener (37863cf)
  • replace XOR obfuscation with RC4 encryption in stager (7c6d1e3)
  • stager: add libcurl transport with shared runtime dynamic loading (7430aea)
  • stager: modular download transports (2d01718)
  • stager: pluggable packer, allowing users to implement their own packer code to hide the stager payload (afd7b1d)

Bug Fixes

  • avoid RWX memory allocation in unpacker code (2effa7d)

4.11.0 (2026-08-21)

Features

  • add crystal-kit module tests (de48cad)
  • add crystal-kit PICO loader and packer modules (52db8e7)

Bug Fixes

  • avoid memset/memcpy relocations in crystal-kit postex-loader (25740a0)
  • crystal-kit: avoid memset/memcpy relocations Crystal Palace cannot process (e0c40ea)
  • crystal-kit: harden loaders and make build portable (d63ecde)
  • crystal-loader: prevent potential deadlock in reader_thread (8a6cf30)
  • modcustom: ensure deterministic command generation by sorting flags and adding shell quoting (c6f5170)
  • silent moon walk generates broken callstack (d493318)

4.10.0 (2026-08-16)

Features

  • add SA BOF (7e3046c)
  • add Vectored Exception Handler for COFF/BOF execution safety on Windows (50d7d27)
  • add Windows build steps for COFFLoader and BOF fixtures (43cada0)
  • adopt coffloader for Windows BOF loading (2ad97fd)
  • agent: add exponential reconnect backoff (61344d7)
  • coffloader module from Sliver (f8843da)
  • config: add operator idle timeout option (37df3d5)
  • config: default operator idle timeout to 30 minutes (7f036d7)
  • fork memmod from wireguard-windows and make it use indirect syscalls (a87b487)
  • implement CRT symbol resolution for bare imports on Windows (c88d9ed)
  • implement operator idle tracking and enhance command dispatch logging (57e9e07)
  • selective build (only builds selected payload types to save time) (92912e2)
  • server: enforce operator-idle admission and queue commands (c409209)
  • server: gate all agent routes on operator presence and idle (5bae8a0)

Bug Fixes

  • ensure COFF arguments are packed with zero values when missing (7b126bf)
  • operator idle timeout handling and last-seen consistency (9de5a28)
  • operator: use fresh agent entry for last seen status (cb78da0)
  • server: reject check-in payload UUID mismatches (342c9b2)
  • Starlark argument handling (285ef18)

4.9.2 (2026-08-10)

Bug Fixes

  • ldapsearch doesn't return anything (7d0a598)
  • donut not automatically installed (70073f0)
  • module flags incorrectly cached and sent (2abe8ae)
  • starlark crashes agent process (6ed4506)

4.9.1 (2026-08-10)

Bug Fixes

  • --token autocompletion should only provide SID (9c9d02d)
  • build.py output is not in order (93b9b6d)
  • list_tokens autocompletion (d329e76)
  • RevertThread error (f5a7185)
  • steal_token should support --token parameter too (8e81938)
  • binary data gets printed with BOF (10900db)
  • goffloader crash (adaf785)
  • output pane needs to be wider (84e2852)

4.9.0 (2026-08-09)

Features

  • allow modules to run with cached token (aa4566b)
  • implement direct syscalls and token manipulation primitives for Windows (98b2d73)
  • run BOFs with token (a7c92f7)
  • starlark engine passes token to scripts (8e8b4cb)
  • syscall: add Windows syscall support for amd64 architecture (1bbb0fc)

Bug Fixes

  • .exe suffix shouldn't be blindly added (970c75a)
  • improve error reporting in thread token impersonation (b37c2a3)
  • improve stability of steal_token (b7f4b64)
  • make starlark modules aware of thread token (029acc4)

4.8.0 (2026-07-26)

Features

  • impersonate starlark module (c324c54)
  • expose agent functions to starlark (a06ef86)

Bug Fixes

  • main() causes the scripts to run twice (ec2672e)
  • do not terminated active session on key error (c2e2b27)
  • int len (47f5494)
  • silent key verification error to avoid console being overflown by errors (a48c8ea)

4.7.1 (2026-07-26)

Bug Fixes

  • implement utility functions in Go for starlark (6d68fa5)
  • improve panic recovery in starlark runners (3ba7111)
  • starlark script syntax (5a0174f)
  • translating SA BOFs into starlark (d9a8cd0)

4.7.0 (2026-07-24)

Features

  • add linux syscall proxy for starlark (ec89e36)
  • add priv manipulation modules for Windows targets (70c6c2c)

Bug Fixes

  • ps should be rewritten for every platform in absence of gopsutils (e3740c8)
  • add recover for module runners to avoid crashing the whole agent process (e21e64a)
  • arch-aware syscalls for starlark (4d628dd)
  • do not print namespace in ps when running on Windows (544970b)
  • failed racing test (40b2f5f)
  • handle native exception to avoid crash (6f823f2)
  • improve error handling in coffloader (3562af5)
  • incomplete info in Linux process listing (47b4841)
  • remove sysinfo command in favor of BOF/starlark (c6659a2)
  • remove gopsutils (227b942)
  • replace go-sockaddr with my own fork (fbc06c5)
  • use native win32 api instead of exec (e4e132b)

4.6.1 (2026-07-22)

Bug Fixes

  • shellcode_stager is now stager with support of exe/so/raw formats (d540070)
  • automatically install donut (2709ab2)
  • handle memfs paths (e902e6f)
  • improve usability of payload generator (0b616f9)
  • p2p file transfer (638f1b4)
  • p2p file transfer should use p2p mesh transport (ed9c1ef)
  • remove compression from listener as malasada has built-in compression (2e0d0f0)
  • remove deprecated flag (be3447b)
  • revamp p2p mesh, make p2p ports dynamic, improve p2p file system (d5b6723)
  • specify DLL entry function for donut (0136e87)

4.6.0 (2026-07-21)

Features

  • add malasada to generate shellcode payload for Linux shared library agents (1d82cff)
  • remove elf module type in favor of BOFs (3bc9f27)

Bug Fixes

  • shellcode_stager can't print debug logs (8624470)
  • shellcode_stager downloader error (01c18f9)
  • clean up shellcode_stager bloat in favor of Linux shellcode agent (26e60dd)
  • link to glibc 2.17 in zig shared library builds (0e5cc31)
  • remove loader stage to serve reflective shellcode loader directly (5436ea4)
  • use of RWX memory in stager (6042fa7)

4.5.1 (2026-07-20)

Bug Fixes

  • goffloader leaves lingering BOF memory (966bc63)

4.5.0 (2026-07-17)

Features

Bug Fixes

  • --debug doesn't keep tmux session (1a9371a)
  • broken config.json in RemoteOPs (0ee2624)
  • check for module name conflicts (f23ddf7)
  • conflict key (4daea86)
  • ensure consistency in BOF arg packing (f9f642d)
  • module loading panic (4043bca)
  • module name conflict (2f71574)
  • optimize building workflow (db882d2)
  • permission error (055a6e9)
  • simplify module manifest template (9b595d7)
  • switch to a maintained goffloader branch (d6ffceb)
  • unify module args format and parsing (1d4368e)

4.4.0 (2026-07-14)

Features

  • implemented a Go proxy of WIN32 APIs for Starlark scripting (e96c112)
  • port some SA BOFs into starlark (4f2cf5a)
  • support modules with multiple files (bc67d47)

Bug Fixes

  • do not attempt C2 connection before preflight (46278b2)
  • high CPU usage on non-Linux platforms (d5c8691)
  • reduce frictions in deployment (6cae369)
  • repeated path name (f1ca240)

4.3.0 (2026-06-22)

Features

  • a practical demo module written in starlark (57ad526)
  • implement scripting engine to support python-like modules (8a5c440)

Bug Fixes

  • BOF modules fail to compile (351a304)
  • broken C2 shell (6da47fd)
  • correct EUID conditional syntax in install.sh (#573) (3d9ee7e)
  • global rate limit for pre-auth requests (51c31bc)
  • incorrect config unarchiving causing operator failure (c1601a8)
  • limit POST body size to 50MB (246743d)
  • limit retries on inter-agent file transfer (f9137e8)
  • preflight unreachable (43a0d38)
  • rate limiting breaks file transfer (6866c1b)
  • starlark_ps format bug (ad87df5)

4.2.5 (2026-05-31)

Bug Fixes

  • disable hardware query (889e72c)
  • improve compatibility with existing CS BOFs (3ef6b0e)

4.2.4 (2026-04-28)

Bug Fixes

  • users should be able to specify C2 server ports in command line (478882f)

4.2.3 (2026-04-26)

Bug Fixes

  • optimise installer for edge cases (2393940)

4.2.2 (2026-04-22)

Bug Fixes

  • enhance installation instructions for WireGuard setup and persist runtime directory (3895476)
  • enhance WireGuard connection logging and add persistent keepalive interval (008e5c0)
  • improve operator disconnection handling (458c05f)

4.2.1 (2026-04-20)

Bug Fixes

  • --stager flag doesn't work (fee3f6a)
  • listener should support memfs and utilise ReadFileAgent (0f5fdd5)
  • enhance memfs path handling and storage strategy in file transfer (4878ebc)
  • flag value auto-completion for module commands (ab143f2)
  • handle operator disconnection and log message on TCP closure (30fb3b1)
  • improve installer UX by giving users a tar archive and instructions to install (compiled) emp3r0r on operator nodes (3f164d8)
  • lack of lifecycle management in listener module (6d34b42)
  • update installation instructions for operator capabilities and wireguard setup (fcede6e)
  • update listener command options and improve stager handling (7c0c945)
  • update mmap function signature to return void pointer (0fe5128)

4.2.0 (2026-04-19)

Features

  • implement indirect syscalls via vDSO gadget resolution to evade eBPF-based monitoring (849e183)
  • implement XOR encryption for staged blobs (e355ae6)
  • refactor shellcode_stager to 3 stages, significantly reducing stage0 size (ce6999a)

Bug Fixes

  • allocate stack via alloca to stay within valid VMA (4e367a5)
  • improve memory reallocation logic in shellcode stager downloader (664ec86)
  • use syscall gadget instead of direct syscall (ab9d548)

4.1.0 (2026-04-18)

Features

  • default to http_poll transport for flexibility (da2a66f)
  • revamp module system to invoke modules as cobra commands, ensuring UX consistency (6093b1f)

Bug Fixes

  • enhance agent disconnection and UUID handling (de981be)
  • wrong handler for h2conn after changing default c2 transport (ddde5e4)

4.0.3 (2026-04-17)

Bug Fixes

  • enhance agent key retrieval with improved locking mechanism (49ba778)
  • improve agent key management with safe access and encapsulation (25780f4)

4.0.2 (2026-04-17)

Bug Fixes

4.0.1 (2026-04-17)

Bug Fixes

4.0.0 (2026-04-13)

⚠ BREAKING CHANGES

  • bump version to v4

Features

  • add MeshRoute to agent structure and update system details gathering (9a82e29)
  • add PersistentRouter support across configuration and command handling (f620fa2)
  • bump version to v4 (c5d19bb)
  • Enhance error logging and preflight feature (4481959)
  • enhance mesh relay functionality and update peer handling with address support (aa638f6)
  • implement Notify log method with configurable broadcast handler for operator console notifications (e1a19a9)
  • implement plain HTTP (beacon) C2 transport and improve agent enrollment synchronization (cd5d901)
  • Implement session management and duplicate prevention for agents (88e7b6b)
  • Implement session reconciliation and legacy session handling (8497f00)
  • implement UpdateAgentLastSeen function to persist agent's last_seen timestamp (b43279d)
  • Remove traditional port mapping relay functionality and associated commands (91f10b8)
  • replace h2conn with websocket for operator message tunnel connections (27156f4)
  • Revamp C2 protocol to be CBOR-based, protocol-agnostic, compatible with pluggable C2 transport. (7c5fe3f)

Bug Fixes

  • generate should never assume boolean flags as true when flags are omitted (91c0f9e)
  • get fails to parse token (fef3449)
  • agent's last_seen timestamp incorrect (6b58aa6)
  • agentdb should support parallel operations (247ebe2)
  • check container reports None for containers (817a337)
  • enhance container detection logic and improve tests for CheckContainer (d433d06)
  • http c2 checkin error (f2287c5)
  • http transport shown as unknown (c5c3720)
  • improve encryption performance (f0d68dc)
  • migrate operator-c2 connection to websocket (3de57a1)
  • optimize C2 transport performance with direct stream handling, buffered I/O, and improved polling efficiency (2bede39)
  • race condition in gossip implementation (65e30b6)
  • relaying stream based FTP to operator (8e6bd10)
  • shellcode stager fails to build on Kali (e43cc8c)

3.22.1 (2026-02-25)

Bug Fixes

  • Authenticate agents using header UUID and implement session hijacking prevention checks. (f1d4f1f)
  • generalize p2p transport and add mTLS transport as default (b666bca)

3.22.0 (2026-02-24)

Features

  • add Ping opcode and method for mesh gateway reachability checks. (d028e19)
  • Add mesh gateway liveness monitoring and automatic C2 client re-initialization when the gateway dies. (36b7925)
  • enhance mesh resilience and stealth by randomizing sleep intervals, improving TakeASnap robustness, and adding periodic gossip bootstrap retry. (cb2e9ca)
  • Implement C2-assisted mesh peer discovery and self-healing for agents. (7f96743)
  • implement mesh networking with token-based authentication and Trust On First Use (TOFU) agent key pinning, replacing proxychain broadcast. (10e2e01)

Bug Fixes

  • implement early rate limiting in the check-in handler to prevent DoS and remove debug key content logging. (8126fea)
  • introduce early rate-limiting for agent check-ins to prevent log flooding and remove debug logging. (9d5cba8)

3.21.4 (2026-02-16)

Bug Fixes

  • add decompression size limit to copyWithDecompressedLimit and corresponding tests (58acb2b)
  • sanitize agent metadata and logging outputs to prevent injection vulnerabilities (97c0a1d)
  • update dependencies (eba8d9d)

3.21.3 (2026-02-13)

Bug Fixes

  • add response size limit for job caching in handleMessageTunnel (3f70f4c)
  • harden agent check-in handling (c9c2719)
  • quote path names in FS commands (f03011f)

3.21.2 (2026-02-13)

Bug Fixes

  • enhance malleable C2 configuration handling (353e758)
  • enhance TOFU logic (be88616)
  • implement agent authentication at HTTP level to ensure all requests are authorized (f4541d0)
  • lingering portfwd sessions after agent disconnection (09c83b8)
  • racing in checkin (23f9798)
  • replace map-based concurrency with sync.Map for improved thread safety and performance. (ea4d074)
  • some API paths are not malleable (98654f8)

3.21.1 (2026-02-12)

Bug Fixes

  • introduce shortID as agent identifier and remove unsafe use of untrusted agent metadata in tmux UI code (3d2e553)
  • sanitize agent data and quote command arguments to prevent injection. (0cd64e4)

3.21.0 (2026-02-11)

Features

  • implement agent key rotation, persistent agent database, and ephemeral agent keys for enhanced security. (884ba38)
  • implement Perfect Forward Secrecy (PFS) for C2 communication and refine proxy chain configuration logic. (471b41d)
  • implement seed injection via FD3 for persistent agent identity and refactor stager's main loop and ELF loading. (77552f3)

Bug Fixes

  • agent should sleep instead of exiting when --stager is not given (c76b35b)
  • data race (56704f3)
  • handshake not handled properly (b43f3d7)

3.20.2 (2026-02-09)

Bug Fixes

  • 0 in agent tag, invalid shortID (3242f22)
  • agents should be kicked offline when there's no active operator (c69c1b6)
  • do not require "active agent" for local modules (633981e)
  • preflight fails after resuming from suspension (ccb846a)
  • Refactor shellcode stager to restart agents by exiting and re-forking with configurable sleep intervals. (afc63d8)

3.20.1 (2026-02-08)

Bug Fixes

  • suppress non-fileless OPSEC warning for local modules. (4b07229)
  • version number unknown when installed with install.sh (7e9e3c3)

3.20.0 (2026-02-08)

Features

  • Add OPSEC warnings for various agent operations and module characteristics. (98ee175)
  • Remove C2 self-update functionality, stop uploading release assets in CI, and update the install script to build from source. (6581c67)

3.19.4 (2026-02-08)

Bug Fixes

  • data race in proxy server (7dcdc4a)
  • implement panic recovery with stack trace logging across agent modules. (d1b079f)
  • Improve SOCKS5 proxy lifecycle management with nil checks, re-initialization logic, and a dedicated test. (a363d98)
  • prevent concurrent operator connections as it's not supported (503eb62)

3.19.3 (2026-02-06)

Bug Fixes

  • improve agent robustness (481e847)

3.19.2 (2026-02-06)

Bug Fixes

3.19.1 (2026-02-06)

Bug Fixes

  • stat result display (b892854)
  • add newline after Latency output (c89e1b0)
  • data race in unused code (a4653bd)
  • enhance sysinfo, ls, ps, and stat commands to send and receive CBOR-encoded binary data. (7cfc3f7)
  • malformed response from !stat (cb82383)
  • remote path auto-completion (69ad74f)
  • remove screenshot (d97b6f1)
  • remove excessive logging (8e8a506)
  • sanitize agent responses further (25fee57)

3.19.0 (2026-02-06)

Features

  • add agent last seen and RTT tracking to tmux status bar (9666349)
  • enhance tmux UI with dynamic agent/C2 status, adaptive layout, and improved pane management. (7321b2f)
  • Implement intelligent operator routing in the dispatcher, directing direct agent requests to the primary operator (529d385)
  • Switch operator-server communication and agent data serialization from JSON to CBOR, and refine agent last seen timestamp updates. (2057082)
  • unify tmux UI style (691c8a5)

Bug Fixes

  • add background to tmux status-right (3ee5fa0)
  • config tarball permission error (a45ee42)
  • Enable multi-operator proxying in C2 dispatcher and add a new complete workflow test. (73f9a0d)
  • improve config tarball filtering by excluding directories and reduce WgFileServer startup log spam. (78100b5)
  • respect command flags when using generate (5472211)

3.18.1 (2026-02-04)

Bug Fixes

  • accidental C2 contact in preflight check (1b448e5)

3.18.0 (2026-02-04)

Features

  • C2 protocol revamp: implement preflight checks and global encryption for C2 communications. (6adafa5)
  • enable preflight by default, improve agent generation, and enhance server context management for KCP. (f8b42f2)

Bug Fixes

  • enhance COFF loader with relocation overflow checks, SHF_ALLOC validation, and strip debug information from module compilation. (58fbfd5)
  • Improve operator stability by adding panic recovery to critical functions, removing a duplicate proxy flag, optimizing module copying, and increasing stager test retries. (4ff5d03)

3.17.1 (2026-02-03)

Bug Fixes

  • Migrate module invocation serialization to CBOR (d799247)

3.17.0 (2026-02-02)

Features

  • C2 protocol revamp: Implement agent identity with TOFU keys and platform-specific machine IDs (a54bb23)

Bug Fixes

  • strip ANSI escape codes from agent output before printing to avoid unexpected behavior (1528ca2)

3.16.2 (2026-01-30)

Bug Fixes

  • adjust build script for static-pie builds, improved memory sealing. (88aca84)

3.16.1 (2026-01-30)

Bug Fixes

  • introduce stager mode for agents, to properly enforcing sleep mask (3bf97dd)
  • modify util.TakeASnap to accept a forceSleep argument so it doesn't kill the agent after checking in (c13425b)
  • remove dead code and speed up agent (ed3b914)
  • reset agent check-in status on reconnect and adjust random sleep intervals. (96e16ce)

3.16.0 (2026-01-30)

Features

  • Add PIE (ET_DYN) ELF loading with relocation support and module stomping capabilities. (c011cf1)
  • configurable library stomping for intermediate stage loading. (8bf778d)
  • Enable PIE builds for Linux agents (c3c4f7f)
  • Enhance ELF loader to stomp system libraries for temporary execution and restore original mappings. (cd7fb66)
  • implement agent self-suspension and stager-managed shared memory execution with process resumption. (d76afe6)
  • Implement periodic XOR-based payload rotation to obfuscate the stager while idle. (105d95d)
  • minimize stager logic by removing unneeded code after downloading (f6b4f77)

Bug Fixes

  • generate fails to patch agent with correct config from emp3r0r.json (ec19251)
  • server routing (c138725)

3.15.1 (2026-01-27)

Bug Fixes

  • enhance agent identification and authentication by adding AgentUUIDSig to messages and verifying it on the C2. (5e67ee0)

3.15.0 (2026-01-27)

Features

  • sysinfo command (ec82079)
  • a "hello world" Linux BOF module for reference (fdead6e)
  • add helper functions to aid syscall-based Linux BOF development (b0388df)
  • Add syscall-based Linux BOF module to list file handles for a given process ID. (9a50b4a)
  • Implement malleable C2 with configurable paths, user-agents, data padding, and jitter, replacing the fixed transport string and simplify handshake. (5b2b091)

Bug Fixes

  • Add handshake prefix mismatch detection and warnings to agent and server, and include a corresponding test. (4e1929b)
  • checkin issue with random URL path (5a4bd4a)
  • command has to be sent twice (3960529)
  • data race (6ec3e19)
  • generate a unique UUID for each agent config to avoid duplicated checkin error (2555eda)
  • improve robustness of Linux BOF loader (e214611)
  • including operator wg key in example commands to improve UX (0ac63a6)
  • optimise handshake and checkin logic (fe85d8a)
  • sign agent UUIDs (c6f1dfa)
  • unify the use agent UUID for primary identification and message routing. (4a55d9f)

3.14.1 (2026-01-26)

Bug Fixes

  • build linux agents with CGO when possible (c0d9146)
  • enhance dynamic ELF loading with relocation support and refined memory mapping in shellcode stager (e89834d)
  • enhance ELF loader compatibility by improving auxv setup, relocation handling (73a264a)
  • ensure _start is placed in the .init section and included in the stager shellcode binary. (08967b7)
  • extend ELF loader auxiliary vector with AT_PLATFORM, AT_SECURE, and persistent AT_RANDOM. (3bf3e5d)

3.14.0 (2026-01-25)

Features

  • Implement in-memory ELF execution with PTY support and streamline agent operations by removing dedicated agent root, PID file, and socket-based liveness checks. (c528a94)

Bug Fixes

  • add retry logic to config download and WireGuard file server startup, alongside a new test for config download retries. (2776b2e)
  • auto-completion for memory backed file system (35455fd)
  • clean up bettercap, elvish, and go_lpe modules along with the go-winio dependency. (4f9fab5)
  • Implement agent-side file decryption command and refine mem:// path descriptions for clarity. (345ea1c)
  • introduce netutil.JoinURL for robust and consistent URL construction throughout the agent. (38404ae)
  • refactor memory-backed file system with mem:// prefix for agent file storage and operations. (72d5026)
  • simplify agent logging (80d2f3c)
  • simplify module handling by enforcing in-memory execution and removing on-disk support. (6494d33)
  • use the current process name for in-memory ELF execution. (e41d0aa)

3.13.2 (2026-01-20)

Bug Fixes

  • Improve path sanitization in SecureLocalPath to correctly handle Windows paths and apply robust path processing to file transfers. (3c0c0ca)

3.13.1 (2026-01-20)

Bug Fixes

  • sanitize path names in archive extraction and P2P file serving. (a793882)

3.13.0 (2026-01-20)

Features

  • add memory-backed file storage and configurable storage strategies for agent files, including C2 commands and tests. (34d8aeb)
  • implement in-memory file storage with unified encryption, dynamic sizing, and special handling for executables. (9e48a52)
  • implement transparent file encryption for agent-side file operations. (c258a4a)

Bug Fixes

  • implement agent UUID signature verification during check-in and message tunnel hello. (c8d0db2)
  • improve RandInt security by using crypto/rand.Int with math/big. (a60eed0)
  • introduce !sysinfo command for comprehensive system details and optimize agent startup with minimal info collection. (b0e0d6c)
  • relocate Shadowsocks server initialization to the proxychain module. only run it on demand. (bd99fc1)
  • remove injector, persistence, vaccine modules. BOF modules planned. (58d6a1e)
  • remove noisy agent upgrade command and its associated functionality. (d889590)
  • remove vaccine, injector, and persistence modules along with their associated files and configurations. (61d8b34)

3.12.0 (2026-01-18)

Features

  • add Linux BOF loader support with tests and argument handling (01e76ab)

3.11.1 (2026-01-12)

Bug Fixes

  • replace HandShakes map with sync.Map for concurrent access (5661133)

3.11.0 (2026-01-12)

Features

  • add process_list_handles COFF module for testing (538eca8)
  • add COFF module support (1524961)
  • refactor module configuration and invocation handling (55277dc)

Bug Fixes

  • enhance COFF value normalization to support additional integer types and improve test coverage (22ca47b)
  • handle panic in runCOFFModule to improve stability (0e6f368)
  • improve agent config extraction logic to handle raw bytes and legacy padded blobs (26ab5e6)
  • optimize hello message acknowledgment logic in MsgTunneler (c069335)
  • update COFF value normalization to include prefixes for types (576b625)
  • update Windows build support with conditional GUI flag so debug mode can work (58aa91c)

3.10.3 (2026-01-05)

Bug Fixes

3.10.2 (2026-01-04)

Bug Fixes

  • config: enhance CCAddress handling for Tor and KCP configurations, add comprehensive tests (723a2c2)
  • config: implement default values for missing critical fields and add tests for config flow (c8ebd85)
  • config: Refactor configuration management to use CBOR format (0814d66)
  • enhance JSON config handling with safe extraction methods and add tests (23a7ee1)
  • ftp: switch from JSON to CBOR for file stat handling and add corresponding test (1417c21)
  • operator: switch JSON decoder to CBOR in msgTunHandler and add CBOR decoding tests (8febb75)
  • switch to CBOR to avoid JSON key strings (79c6738)
  • tls: TLS configuration for C2 agent server and add tests (26e1f90)
  • update configuration keys in module to use new naming conventions (a5ef670)

3.10.1 (2026-01-04)

Bug Fixes

  • improve agent existence checks and message handling (2b5ca49)
  • remove identifiable strings from agent code base (e63b3de)
  • sanitise strings (4dde815)
  • unexport functions for garble (b311c96)

3.10.0 (2026-01-04)

Features

  • update build command to use garble (ff14c16)

3.9.6 (2026-01-04)

Bug Fixes

  • correct RandInt parameter validation and ensure proper range (7c4c0bf)

3.9.5 (2026-01-04)

Bug Fixes

  • improve last handshake management in handleMessageTunnel (a7bcb42)

3.9.4 (2026-01-03)

Bug Fixes

  • enhance Socks5Proxy implementation with listener management and synchronization (cb2047b)

3.9.3 (2026-01-03)

Bug Fixes

  • replace standard log package with custom logging package to eliminate logging strings in agent (cae377b)

3.9.2 (2026-01-03)

Bug Fixes

  • data race found in tests (9db1f78)

3.9.1 (2026-01-01)

Bug Fixes

  • enhance ELF loading security by implementing header stomping and W^X enforcement (7eeb293)
  • implement sleep mask in shellcode stager and enhance process management in payload execution (5fa1a83)
  • improve ELF loading security by refining header stomping to target magic bytes (af33292)
  • optimise shellcode size (048ec00)

3.9.0 (2025-12-31)

Features

  • enhance proxy broadcasting with time-based validation and dynamic payloads (4e97253)
  • implement mutex for managing reverse connections in SSH proxy (43bb247)

Bug Fixes

  • always start proxychain when C2 is accessible (799ec89)
  • enhance README with new features for APT-grade connectivity and automatic P2P mesh networking (8817614)
  • enhance tag validation in BroadcastServer to include future time slot (1176e51)
  • improve proxy handling in BroadcastServer to ensure Shadowsocks is restarted if not working (d69ec1f)
  • make sure shadowsocks is started before validating the broadcasted proxy (49ba075)
  • optimize connectivity check in BroadcastServer to reduce log spam when no reverse proxy is connected (59446ee)
  • proxychain is disabled even when --proxychain is specified (f46ce3c)
  • update subproject commit reference in emp3r0r.wiki (329de86)

3.8.1 (2025-12-14)

Bug Fixes

  • replace memset with _get_rand for secure memory wiping in elf_load (e8d1064)

3.8.0 (2025-12-14)

Features

Bug Fixes

  • disable damonisation to accomodate shellcode and libc stagers (21de9b3)
  • ensure build flags can be passed on to make (3de8a46)
  • update jump_start function to use correct register and improve memory management in malloc and free (2045f66)

3.7.4 (2025-12-14)

Bug Fixes

  • add ReadIdleTimeout and PingTimeout to HTTP/2 transport for improved connection handling (e5efd88)
  • remove read timeout from message tunnel handler, it shouldn't disconnect just because of inactivity (e39b35f)

3.7.3 (2025-12-13)

Bug Fixes

  • data loss during transmission in UDP stager (540a477)
  • wipe ELF header in memory if it's in the segment (b200021)

3.7.2 (2025-12-12)

Bug Fixes

  • add timeout to HTTP client and requests for improved reliability (dcfc8b7)
  • implement exponential backoff for agent list refresh and message tunnel connection (3de26b6)
  • increase message channel buffer and implement read timeout for message tunnel (bda78e5)

3.7.1 (2025-12-12)

Bug Fixes

  • remove unnecessary rwx when mapping stack (77126cb)

3.7.0 (2025-12-12)

Features

  • implement TCP and UDP listener support and enhance download functionality (c6ff3cc)
  • implement XOR encoding for configuration strings and enhance security (e78c2c6)

Bug Fixes

  • enhance stager configuration to support multiple listener types and update documentation (7ec4fe0)
  • replace /dev/urandom with getrandom() syscall for improved randomness retrieval (e2c9fa9)
  • streamline agent and stager code by removing unused persistence logic and enhancing debug error handling (ada195a)

3.6.0 (2025-12-12)

Features

  • build Linux stager as executable (2b8c404)
  • use linux stager as orchestrator and ensure emp3r0r agent payload stay encrypted in memory when idle (013d95c)

Bug Fixes

  • ensure conditional c2 check happens before anything else (347818e)
  • garbage charaters being printed in tmux (3ebdbb7)
  • improve conditionalC2FailNotify to ensure it only acts when started by a stager (7d43afc)
  • inconsistency in wg/mtls operator connections (dda9332)
  • update connection error handling to signal parent and exit instead of retrying (c812887)
  • update DownloadExtractConfig to use client-specific config path when not running as server (e2a9fc3)
  • update stager executable build to use musl-gcc with static linking (1a2cec6)

3.5.1 (2025-12-11)

Bug Fixes

  • downloader file name messed up (8ba18d6)
  • prompt doesn't work, and local modules don't need prompts (0406a3a)

3.5.0 (2025-12-11)

Features

  • add Fileless property to modules, warn users if there will be file dropping on the target (c552e4a)
  • remove AgentRoot auto-creation (eeddd07)
  • unify file operations in agent for future anti-detection features (ebdf490)

Bug Fixes

  • change file name suffix for better stealth (3231f3d)
  • copy new builder script when packaging (7df846b)
  • improve launcher UX (7dc08c4)
  • refactor emp3r0r script to separate builder and launcher (e681e0d)
  • refactor screenshot to make it a module (05c4bde)
  • some OPSEC improvements for the Linux stager (df5ef29)
  • update deps (0d6c93c)

3.4.2 (2025-06-19)

Bug Fixes

  • enhance logging messages for server startup with success indicators (f26796d)
  • ensure tmux title truncation to 10 characters (d5e819b)

3.4.1 (2025-06-18)

Bug Fixes

  • add target_path option to elf_patch command for custom library loading location (dc2b009)
  • copy timestamps from ELF file to SO file in ElfPatcher function (4b6fdb8)

3.4.0 (2025-06-17)

Features

  • add bind address option for port forwarding sessions, closes #476 (c4374aa)

3.3.2 (2025-06-16)

Bug Fixes

  • add !elf_patch command to patch ELF files and load shared libraries, replacing get_persistence (bf113f3)

3.3.1 (2025-06-14)

Bug Fixes

  • clarify error message for missing C2 server IP in WireGuard connection (0dcf091)
  • do not validate upload response (d06922a)
  • remove unused dependencies and simplify line wrapping functionality (71db5e3)
  • server: add command generation for client connections and improve usage instructions (c5437c2)
  • simplify table rendering and add reset layout command (ca5c066)
  • tmux: add pane layout reset functionality and improve pane size constraints (a9b8c23)
  • update carapace dependency and remove obsolete references (bfcf031)
  • update command formatting for client connection commands and improve readability (679b312)

3.3.0 (2025-06-13)

Features

  • generate: enhance payload type descriptions for CGO support #473 (fdb6d33)
  • kill: enhance process killing functionality with improved error handling and support for multiple PIDs #468 (ddf0560)
  • release: update permissions and enhance upload script with response handling (6feaaff)

Bug Fixes

  • 468 (36d0457)
  • moduleCmd: improve error handling for ActiveModule and command execution #474 (06c0c5e)

3.2.2 (2025-03-12)

Bug Fixes

3.2.1 (2025-03-06)

Bug Fixes

  • upgrade github.com/jm33-m0/arc to v2 (3a12a5d)

3.2.0 (2025-03-06)

Features

  • set up auto-completion during installation (8d3553a)
  • support multiple operators (99123f1)

Bug Fixes

  • copy_stub is slow, move it out of init (dc9bc84)
  • unable to get SUDO_USER when installing (743fffe)
  • uninstall shell completion files as well (2e1a7c1)
  • UX in starting server (3408aa7)
  • wg IPs not random (19684f7)

3.1.4 (2025-03-05)

Bug Fixes

  • optimize HTTP2 connections (91fcd5a)
  • simplify agent binary patching (8f3e9a1)

3.1.3 (2025-03-04)

Bug Fixes

  • existing config file causes operator to fail (4bea0ef)
  • run jobs in the background to prevent blocking (317be9c)
  • screenshot (45d7eaf)

3.1.2 (2025-03-04)

Bug Fixes

  • run_proxy cmd sender (1e854c0)
  • ssh shells and port mapping (4bcd79f)
  • modules should be able to run from operator (a837e4f)
  • operator needs to pull the latest certs from server every time it runs (b330ee6)
  • refactor cmd line usage (84ec8c3)
  • some noticeable latency in agent list refreshing (c5b4d71)

3.1.1 (2025-03-02)

Bug Fixes

3.1.0 (2025-03-02)

Features

  • operator can pull config tarball from server via wireguard (d872e59)
  • wireguard auto-config as operator transport (27c93ab)

Bug Fixes

  • get and put file transfer features (5bcb259)
  • set active agent (WIP) (01b9840)

3.0.0 (2025-02-28)

⚠ BREAKING CHANGES

  • separate core and server, adopting operator-server mode (WIP)

Features

  • assign cap_net_admin to emp3r0r-cc when installing (18db26c)
  • relay file transfer requests to operator (012884e)
  • relay message tunnel to operator (eb3ac70)
  • tar config dir for operator to use when server starts (4c38418)
  • wireguard operator (a2016cf)
  • wireguard operator management (8d09db0)
  • wireguard-go (ea73568)

Bug Fixes

  • put --dst auto-complete (f6e9f5a)
  • critical bug: emp3r0r.json gets overwritten every time cc starts (8259507)
  • do not log if run as agent (6325a67)
  • search c:\ when run as priviliged user (4cc1dc0)
  • simplify ssh c2 relay (f280459)
  • unify server response to unauthorized requests (1146adc)

Code Refactoring

  • separate core and server, adopting operator-server mode (WIP) (d4d52b1)