Let's make use of Empire to create our very first stager.
Empire provides you with various options that you can use to create a stager.
These range from OS‑specific stages all the way to multiple
stages which can be used on any operating system.
Since our target endpoint is running Windows,
I'm going to make use of a Windows‑specific stager.
Looking at the various options, there is quite a variety that I could use.
I'll make use of an easy one which makes use of WMI.
I'm now presented with the various options that I can
configure for this specific stager.
Within the information under the Comments,
it tells me exactly what command needs to be run on the
endpoint in order to make use of the stager.
So essentially,
I just need to host this file and from the endpoint
leverage the WMI command to launch the stager.
But before we do that, let's look through the options.
The first option that I'm going to make sure is in
use is the Base64 encoded option.
By default, this is set to True.
I then need to ensure that my listener is defined.
I've already configured an HTTP listener,
and I'm going to make use of that listener for this specific stager.
I can go one step further and further obfuscate the stager,
but I'm going to leave it as it is for now.
You can play around with the different obfuscation
options to further obfuscate the stager.
Finally, the output file, I could rename that,
but for the sake of this demonstration, I'm going to leave it as it is.
So issuing the command execute will go ahead and create the stage for me.
By default, Empire will save your stagers in this default directory.
All that I need to do now is launch a web server
that would point to this directory, and then from the endpoint,
make use of that WMI command to actually call and access the stager.
So I'm going to go ahead and start the web server,
and then I'm going to switch to my targeted machine and run the WMI command.
So I've now switched to the targeted machine.
Now remember that in a real environment or in a real‑world pen test,
you won't necessarily have remote desktop access to the targeted machine.
This command can be run within a Meterpreter session or a net get session.
So pretty much,
you can run this command in any other means possible
to get the stager established.
So I'll go ahead and hit Enter,
and we can see that this command went and actually fetched the stager file,
and it ran some tasks in the back end.
Now let's move back to Empire to see if we have a new agent established.
Within Empire.
I now get the message that tells me that I've got a
new agent that has checked in.
Taking a look at the agents,
I can see that the endpoint has established a session with the HTTP
listener based on the stager that I've just created.
From here, I can interact with the agent and perform additional tasks.
Now keep in mind that this was just one stager that we've looked at.
There are multiple different stagers,
and you can combine and tweak the stages as you need.