Hacking with Empire – PowerShell Post-Exploitation Agent

Hello everyone and welcome to this beginner’s guide to Empire. According to their official website:

“Empire is a pure PowerShell post-exploitation agent” built on cryptologically-secure communications and a flexible architecture.

Empire – PowerShell post-exploitation agent

Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework.”

In this tutorial we will be covering everything you need to know about this software, straight from installation to getting a shell and even getting admin access without letting the antivirus know!

Before starting with the action you need to know these four things:

Listener: listener is a process which listens for a connection from the machine we are attacking. This helps Empire send the loot back to the attacker’s computer.

Stager: A stager is a snippet of code that allows our malicious code to be run via the agent on the compromised host.

Agent: An agent is a program that maintains a connection between your computer and the compromised host.

Module: These are what execute our malicious commands, which can harvest credentials and escalate our privileges as mentioned above.

Methodology:

1. Creating a listener.
2. Starting a listener.
3. Launching a PowerShell code using launcher.
4. Executing code on victim’s machine.
5. Interacting with agent.
6. Executing various modules.
7. Bypassing UAC to get admin access.

To get started, clone the following git repo using git clone:

Full Article Read Here