Original subtitles

PowerShell Empire Empire is a powershell

and python post exploitation agent with

a heavy focus on client-side

exploitation and post exploitation of

Active Directory deployments

exploitation and post exploitation are

performed using PowerShell on Windows

and Python on Linux and Mac OS Empire

relies on standard pre-installed

libraries and features PowerShell

execution requires only PowerShell

version 2 and Linux and Mac modules

require Python to 6 or to 7 while Empire

seems to share many features with the

Metasploit framework they are quite

different in nature Metasploit has a

vast collection of exploits geared

towards gaining initial access on the

other hand Empire is designed as a post

exploitation tool targeted primarily at

Active Directory environments Empire

tends to leverage built-in features of

the target operating system and its

major applications

installation setup and usage Empire is

not included in the cow Linux

repositories so we'll need to install it

manually

first we need to clone the github

repository under the optech turi

you

we can then install Empire by running

the install script in the Empire setup

directory

you

empire allows for collaboration between

penetration testers across multiple

servers using shared private keys and by

extension shared passwords since we are

installing a single instance we'll press

enter at the password prompt to generate

a random password

with the framework installed we can

launch Empire with the aptly named

Python script Empire

PowerShell Empire syntax we can use help

to list various commands available with

an empire including listeners stagers

agents and modules

let's take a look at these four major

commands

listeners and stagers will begin our

tour of empire with a brief discussion

of listeners and stagers as with

Metasploit small tea handler listeners

accept inbound connections from various

empire agents stagers are small pieces

of code generated by Empire that are

executed on the victim and connect back

to a listener they set up a connection

between the victim and the attacker and

perform additional tasks to facilitate

the transfer of a staged payload to

begin an empire session will first enter

the listeners context

then we'll print available listeners

with use listener followed by a space

and a double tab to engage empires tab

completion feature

the HTTP listener is the most basic

listener which communicates through a

series of HTTP GET and post requests to

simulate legitimate HTTP traffic once

we've decided on a listener we can pass

its name to the use listener command to

select it

with our listener selected we can run

info to display information and syntax

there are many available options but

most are already set or are optional the

most important parameters are host and

port which are used to set the local IP

address or hostname and the port number

of the listener respectively

we can set the host value by running set

host followed by our local IP address

there are additional settings worth

noting

default delay sets the wait interval

callback time from the compromised host

to the listener this feature attempts to

simulate more legitimate HTTP traffic

the default jitter setting is a random

offset to default delay designed to make

the traffic seem less programmatically

generated setting kill date will self

terminate the listeners on all

compromised hosts on the specified date

this is especially useful when

performing clean up after a penetration

test once the options are set we can

start the listener with the execute

command

we can return to the main listener menu

with back

lastly we can list all available stagers

with use stager followed by a space and

two tabs

Empire supports stagers for Windows

Linux and OS X Windows stagers includes

support for standard DLLs HTML

applications Microsoft Office macros and

more exotic stagers such as the USB

rubber ducky to get an idea of how this

works let's try out the windows of bat

launcher stager

after selecting the stager we can review

the options with the info command

we can configure the listener parameter

with set listener followed by the name

of the listener we just created

finally we'll create the stager with the

execute command

to better understand the stager we just

created let's take a look at the

generated launcher dot bat file

the stager is a base64-encoded

PowerShell command string the

first-stage payload will connect to the

listener and fetch the rest of the

Empire agent code

the Empire agent now that we have our

listener running and our stager prepared

we'll need to deploy an agent on the

victim an agent is simply the final

payload retrieved by the stager and it

allows us to execute commands and

interact with the system the stager

deletes itself and exits once it

finishes execution once the agent is

operational on the target it'll set up

an aes encrypted communication channel

with the listener using the data portion

of the HTTP GET and post requests to

deploy our agent we need to copy the

launcher dot bat script to the Windows

10 workstation and execute it from a

command prompt we'll start by setting up

a Python web server listening on port

8000

then we'll connect to the Windows 10

client via remote desktop

we'll use a powershell one-liner to

download the bash file from our cali

machine

finally we can run the batch script

once we run the script our command

prompt closes which is expected behavior

let's switch back to Empire

back in Empire we see that we've

received the initial agent call next we

can use the agents command to display

all active agents

now we can use interact followed by the

agent name to interact with our agent

and execute commands

let's run sis info to retrieve

information about the compromised host

note that the command does not return

immediately this delay is caused by the

default delay parameter which is

currently set to the default value of

five seconds the help command shows all

available commands

these include commands such as

upload/download

and exit which are self-explanatory in

addition we can use shell to execute a

command and spawn to create an

additional agent on the same host as

with a meterpreter payload Empire allows

us to migrate our payload into a

different process we can do that by

first using PS to view all running

processes

you

once we choose our target process will

migrate the payload with PS inject

including the name of the listener and

the process ID as our command arguments

it's important to note that unlike the

migration feature of the meterpreter

payload once the process migration is

completed the original Empire agent

remains active and will have to manually

switch to the newly created one

you

PowerShell modules the power of empire

agents lie in the various modules

offered by the framework we can list all

available modules with use module

followed by a space and double tab

the modules are divided into multiple

categories but also include basic

features such as key logging screenshots

and file downloads

situational awareness let's take a look

at a few modules to see what they

consist of will target the dedicated

Active Directory lab environment in this

section to begin let's explore the

situational awareness category while

there are many methods and commands for

performing network enumeration the

primary focus of this category is on

local client and Active Directory

enumeration for example let's

investigate the get user module

will issue the info command to display

information about the module

first let's take a look at the header

section

the name module and language fields are

self-explanatory if the script requires

local administrator permissions the

needs admin field will be set to true if

we wish to avoid leaving behind

indicators of compromise such as

temporary disk files or new user

accounts we set the OPSEC safe field to

true this stealth driven approach has a

greater likelihood of evading endpoint

protection mechanisms the min language

version field describes the minimum

version of PowerShell required to

execute the script this is especially

relevant when working with Windows 7 or

Windows Server 2008 r2 targets as they

ship with PowerShell version 2

background tells us if the module

executes in the background without

visibility for the victim while the

output extension tells us the output

format if the module returns output to a

file several options follow the header

fields

in this particular module all of these

are optional except agent which is

already set

this module will work as is enumerate

all users in the target Active Directory

we could set any number of filtering

options but we'll simply run the module

with execute

in addition to the enumeration tools in

the Power View subcategory the

situational awareness category also

includes a wide variety of network and

port scanners

credentials and privilege escalation

privilege escalation modules are found

in the Prive ask category one of the

more interesting modules in this group

is power up all checks

it uses several techniques based on Miss

configurations such as unquoted service

paths improper permissions on service

executables and much more

this module can reveal some very useful

information

the bypass UAC Fahd helper module is

quite useful if we have access to a

local administrator account

depending on the local Windows version

this module can bypass UAC and launch a

high integrity PowerShell Empire agent

before running this module we need to

configure our listener

when we run execute Empire warns us that

the module is not OPSEC safe and asks us

to confirm the operation

once we have a high integrity session we

can perform actions that require local

administrator or system rights such as

executing Mimi cats to dump cached

credentials

the credentials category contains

multiple Mimi cats commands that have

been ported into Empire

the commands marked with an asterisk

require a high integrity Empire agent

Mimi Katz is implemented in Empire by

using an injection technique called

reflective DLL injection in which the

Mimi Katz library is loaded into the

agent directly from memory the primary

reason for this approach lies in the

fact that most endpoint protection

systems analyze all files located on

disk and loading a malicious executable

file directly from memory reduces the

risk of detection this method is custom

coded into the agent as Windows does not

expose any official api's that would

allow us to achieve the same objective

let's take a look at a high integrity

access module such as logon passwords

this output is identical to me me cats

but the collected credentials are also

written into the credential store

enumerated with the creds command

we can also manually enter credentials

into the credential store with creds ad

lateral movement once we gain valid user

credentials we can begin to use these

credentials to attempt to login to other

systems in a process known as lateral

movement in our labs the domain

controller is located on an internal

network meaning we cannot reach it from

our Kali VM to demonstrate the mechanics

of lateral movement with Empire we'll

obtain another shell on the Windows 10

client in the context of a different

user although this example is simplified

because of the single target VM the

mechanics of the process are the same

when moving to a different remote host

in a real-world situation there are

various vectors in the lateral movement

category that we can use to invoke an

empire agent on a remote host

as an example we'll try out the invoke

SMB exact module

this module requires several parameters

we'll set computer name to the host name

of the Windows 10 client and listener to

http

we'll also set the username domain and

hash parameters using the relevant data

from the Jeff admin user account found

in the previous section

let's execute this module and see what

happens

excellent the agent was successfully

deployed and we can now interact with it

you

switching between Empire and Metasploit

the Empire agent supports many features

however there are often times we need to

use features that are only found in

Metasploit since we can have both Empire

and Metasploit shells on the same

compromised host this is actually quite

easy

first we'll use MSF venom to create a

meterpreter reverse shell as an

executable

next we'll set up a Metasploit listener

using the multi handler module and the

same settings we used for our payload

will select the multi handler module

set the payload to a reverse HTTP

meterpreter

and set the values for L port and L host

with our settings configured will launch

the module

now we'll switch back to our PowerShell

empire shell and upload the executable

after uploading the executable will

issue the PWD command to reveal its

location and then execute it

with the executable running we'll switch

back to our meterpreter listener and

find the incoming shell

you

reversing this process to connect to an

empire agent from an existing

meterpreter session is also simple we

can create a launcher and use

meterpreter to upload and execute it

first we'll create the launcher using

Empire

we simply set the listener which in our

case is HTTP then upload and execute it

we'll first upload the file through the

meterpreter shell

then we'll run the shell command and

execute our batch script

now we should receive an empire agent

from the compromised host

using these techniques we can switch

between frameworks on the same

compromised host

wrapping up in this module we covered

the basic syntax and functionality of

PowerShell Empire such as listeners

stagers and agents

we also explored various modules to

perform enumeration obtain credentials

and perform lateral movement lastly we

looked at how PowerShell Empire and

Metasploit can be used together