Erebus 1.1: The C Implant Grows Up

When we shipped Erebus open source, the story was the architecture: AI-native control loop, human-in-the-loop approvals, Go teamserver, operator CLI. The implant side was intentionally honest about priorities—C as the Windows-first peer, Go as the flexible control plane.

1.1 is the first release that treats the C implant as a dual-platform workhorse. The changelog is not marketing fluff. It is a pile of friction we hit on authorized HTB and lab work—silent TLS pins, same-second beacon replays, empty module failures, and Linux boxes that cannot route to the operator VPN—and the fixes that make the next eng less expensive.

What 1.0 felt like in the field

On paper, C2 is simple: build implant, callback, shell. In practice, authorized lab work exposed the same four failure modes over and over:

• Silent HTTPS — empty or wrong CA packaging so posts no-op with no useful operator signal.
• Beacon timing — sub-second sleep colliding with a same-second HMAC replay window (classic “it worked once, then 404”).
• Opaque auth drops — wire stays silent 404 by design (anti-fingerprint), but the server did not always tell you why (skew vs HMAC vs unknown implant).
• Linux after foothold — small peer needed, but no first-class drop story when the target cannot reach the HTB VPN interface.

Windows soft-compromise paths (WinRM, Kerberos roast formats, lateral helpers) also had to stop looking “done” when they still needed clear errors and host-testable pure logic.

What changed in 1.1

Linux C peer is real

1.1 ships a buildable Linux C implant: register, encrypted beacon, shell, files (with path jail), process list/kill, ifconfig and portscan, HTTPS with pinned teamserver CA. Size stays in the small-binary class operators actually want to stage after a foothold—not a multi-megabyte default.

What it is not: a full AD engine on Linux. Unsupported modules and tasks now fail with explicit strings (“not supported on linux c implant…”) so operators and AI agents do not spin on empty results. Reverse SOCKS over the beacon remains a Go-strength path; Linux C points you at tunnel / Ligolo / Go when you need localhost pivots.

Build and pin: fail closed

C HTTPS pins are base64 DER of the teamserver CA—not base64 of the PEM file. That mismatch burned eng time. The Makefile and builder path now convert CA_CERT_PATH the right way, and refuse empty identity or empty CA for HTTPS builds. Runtime refuses to loop forever without a pin when transport is HTTPS.

Millisecond beacons

C register and beacon HMAC timestamps moved from Unix seconds to milliseconds. The server already accepted both; the implant was the footgun. Interactive lab sleep at 500 ms no longer fights the replay cache on the same wall second.

Auth observability without fingerprinting

On the wire, bad auth still looks like a boring 404. In the teamserver log, drops now classify as unknown_implant, hmac, skew, or replay. That is the difference between “is the listener up?” and “fix the clock / secret / same-second beacon.”

Windows soft-compromise depth

1.1 expands the Windows C surface that matters for AD soft paths: Kerberos client code paths with real hashcat-oriented formats (no placeholder “success” hashes), NTLM hash parse helpers with host tests, WinRM password and PTH paths with clearer failure text, plus PsExec / WMI / DCOM lateral modules. Live parity against every external tool is still an eng gate—not a checkbox we pretend is closed without a lab box—but the code is no longer a stub that looks finished.

Lab drop UX

Firewalled Linux labs often block outbound to the operator VPN. 1.1 ships a reverse-tunnel helper and a host-side e2e smoke script so “build → pin → drop” is repeatable before you touch a target:

• scripts/htb_reverse_tunnel.sh — SSH -R so the implant can callback to https://127.0.0.1:8443 on the target.
• scripts/c_linux_e2e_smoke.sh — unit tests, DER build, empty-CA fail-closed, optional live probe.

Before vs after (operator view)

What we are still honest about

1.1 does not claim that every external tool is obsolete. Live WinRM PTH parity against the tool that already worked in a given eng remains a lab gate. Kerberoast/AS-REP still want GOAD or HTB AD confirmation before we call them “done forever.” Full reverse SOCKS over the C Linux beacon is not the 1.1 bet—Go (or tunnel + Ligolo) still owns that pivot class.

That honesty is intentional. Erebus is supposed to be an engagement-shaped framework, not a checklist that lies.

Get 1.1

Source is on GitHub. Build the Linux peer for post-foothold work, or the Windows PE for AD soft paths. Read the implant lab checklist in-repo for the operator path we actually use.

If you are building AI-assisted offensive workflows, 1.1 matters because the implant layer is where autonomy dies or earns trust. Clear errors, fail-closed pins, and a Linux peer you can actually stage are how the agent stays useful without becoming a black box.