Now let's get started by performing some reconnaissance on the local machine.
Taking a look at my agents,
I have the agent that has been established using my
OneDrive listener for C2 communication.
I'm going to go ahead and interact with this agent,
and the first thing that I'm going to do is issue the info command
to see basic information about this endpoint.
As I scroll through the results, I can see information such as the architecture,
the IP address as the hostname, the language,
and the listener that it's using.
I also have information about the username that is
currently logged into the machine.
Remember that Empire has a wealth of modules.
These modules enable you to perform various tasks from
reconnaissance all the way to exfiltration.
To make use of these modules, you need to use the command usemodule.
Now since we are focusing only on PowerShell in this course,
we're going to make use of just the PowerShell modules and
various categories within the PowerShell modules.
So the first module that I'm going to use is PowerView
and looking at the get_user command.
As soon as I select the module, I will get a write up about the module,
and this write up contains who the author is,
the description, the language, and more importantly,
if it requires elevated access.
Something else that is also equally important is if this command is OPSEC‑safe,
which it is.
If it was false,
it would mean that this command would be pretty noisy and
probably risk the chances of me being detected.
From an options perspective,
there are quite a number of options that I could tweak,
however, I'm going to leave these as the default.
The only thing that I would ensure that's defined is the agent
that I would like to run this module on,
which it currently is defined.
Now I'm going to go ahead and execute.
So what Empire is doing right now,
it's running this task via the OneDrive listener to the endpoint.
After a minute or so, I will receive the results.
So let's browse through these results and see what information we can discern.
So the first account that shows up is the local administrator account.
What's interesting about this account is that this is a domain
administrator because if you look at the memberof,
I can see that this account is a member of some high‑privileged groups.
I have information about the Key Distribution Center service account,
or the KRBTGT account, and now I start to see some of the user accounts.
So the first user account that shows up is a user by the name of Samira,
and this user is also a member of the Domain Admins group.
Next, I've got Ron, who is a member of the Helpdesk group.
And finally I've got information about a user by the name of Jeff.
Now this module is pretty awesome.
It gives you a lot of information.
It doesn't just give you information about the username,
but it gives you some other valuable information as well.
For example, I can see information about the logoncount,
which in the case of Jeff, has a number of 23,
which tells me that this machine that I've targeted
is probably his personal machine.
I then have a badpasswordtime,
and this indicates the last date and time that the user
tried to log in with a bad password.
The lastlogontimestamp gives me information about when this user last logged on.
I have the SID, or the security identifier of the user.
The same with the same account name.
Another interesting piece of information is about
the account and does it expire, which in this case,
this account does not expire.
And then I've got information about when was the password last changed?
All of this information is valuable for me as I start to learn
about the user's behavior which will ultimately allow me to
craft and tweak my attack a lot better.