In the previous set of videos, we have worked with Empire from the command line.
Now you may be wondering, could you work with Empire from a graphical interface?
Well, the answer is yes.
This can be done by making use of Starkiller.
Starkiller needs to be installed additionally,
since it is not installed by default.
The installation is pretty straightforward,
and all you need to do is issue the command sudo apt install starkiller,
and this will go ahead and actually install it.
In my case, I've already got it installed.
Now in order to start Starkiller,
you need to ensure that you've got the Empire server started up.
Once that's started up, all you need to do is issue the command sudo Starkiller,
and this will go ahead and start up Starkiller.
When Starkiller initially starts up, you will be presented with the login page.
By default, the Username is empireadmin with a password of password123,
all in lowercase.
This is also documented on BC Securities website.
Now don't worry about the password being insecure.
You can change this and create additional users if you wanted to.
Once I log in, this is what the interface of Starkiller looks like.
Immediately I am presented with the listeners.
Now we can see the listeners that we've already created, and from here,
I can also go ahead and create additional listeners.
The creation of additional listeners is really simple because all I need
to do is drop down the listener that I would like to create and then go
ahead and populate the different fields.
Let's work through the rest of the functions of Starkiller.
The next function that I have is the creation of stagers.
This can be done graphically as well by clicking on CREATE and
selecting the type of stager that I would like to create.
Once you select the stager,
the options that you have would be presented to you, and
from here you can tweak the options.
Agents will give you information about the agent itself.
This is the agent that we've established with our targeted machine, and from
here, I can go ahead and actually interact with the agent.
For example, I can issue a shell command such as whoami.
I can also execute different types of modules from this interface.
The results of the different actions will be
presented in the TASKS view. For example,
this is the whoami command that I've run, and I can see the result of
that command. Navigating to FILE BROWSER will give me a list of the
directory or file structure of my agent.
From here, I can interact with the directory and download or upload files.
The VIEW option gives me information about the agent. As I scroll down, I can
see information such as what language this agent is using,
the architecture,
the operating system, and so forth. Navigating to Modules
will enable me to see all of the different modules that
currently exist within Empire.
The nice thing with Starkiller is because of the way it
visually presents it to you, you can actually see which module
requires administrative privileges,
which module is OpSec‑safe, and which module is able to run in the background.
It also goes one step further and links the different modules to different
techniques in accordance with the MITRE tactics. From here,
I can also expand a specific module and see information
about the author, description, and any comments that may
exist for that specific module.
Now as we make use of Empire, we will perform some credential dumps.
Those credentials will actually get stored in Empire's database. From
Starkiller, you would be able to view the database, and of course you can
also view it from the CLI, but I like the way that Starkiller presents it.
Reporting would give you reports about your different agents. Here you can
see things like the different event types and any specific task that may have
run on the agent. Users, of course, gives you the option to create additional
users. From here, you can also tweak the current default user and change the
password if needed. If you wanted to interact with the different plugins,
this can also be done from Starkiller. Navigating to the plugin, you can
configure different types of options for a specific plugin.
Malleable C2 Profiles allow you to look at the different malleable profiles that
currently exist within Empire. From here, you can actually see the configuration
of the profile and you can modify it if needed.
You can also go ahead and create your own profile based on a Cobalt Strike
profile or any other profile that you want to use for C2 communication.
Bypasses allows you to see the different bypasses that currently exist within
Empire. Here you can also interact with them and create your own, and when
you look at the current bypass,
you can actually see the code that's being used within that bypass,
and from here you can also tweak it as needed.
The final setting is the Settings menu, and here there's not much
that you can really configure apart from updating the password and
maybe modifying things like the Dark Mode or enabling the Chat
Widget. In the next set of videos,
we will make use of Starkiller to actually perform some
tasks with our agent, so stay tuned.