In this demonstration,
we will look at how we can obtain a persistent
foothold by using a registry implant.
In the demo, we will focus on the server,
and we will leverage the persistence module that does
not require a high‑integrity agent.
Empire gives you the ability to use the registry key module,
which ultimately creates a registry entry that establishes a
reverse session back to your attacking machine.
Let's go ahead and set this up.
I'm going to interact with the server agent,
and I'm going to use the module persistence and you'll notice
that we have two types of registry attacks.
The one can be executed when you have an elevated agent,
and the other one can be executed when you do not have an elevated agent.
Since the server agent is not an elevated agent,
let's go ahead and use the standard userland registry.
And let's take a look at the options that's available,
and you can see that we've got the standard options,
such as the agent name, the listener, which we need to define,
and then we can define a key name in the registry path.
It'll be a good idea to use a key name, which is fictitious.
This will help to evade detection from analysts who are not that savvy.
So I'm going to go ahead and modify some of the options.
The first one that I'll need to modify is to define the listener.
In my case, my listener name is http.
Next, for the interest of the demo, I'm going to define a keyname of EMPIRE.
Another setting that I'll modify is the location of the keyname.
Instead of using the default registry location,
I have modified this so that the key is created under the run location.
This ensures that as soon as the machine starts up,
a persistent agent will be established.
We'll go ahead and execute this module.
I get the warning that it's not OPSEC safe, and I'll accept
this warning, and a task will be created.
We are then presented with a message to tell us that the
registry key has been successfully created.
Let's verify that this registry key actually exists.
I'm going to go back out of the module, and I'm going to
issue a shell command to create the registry.
If we take a look at the output, you'll notice that we have to Empire keyname,
which is defining the registry.
Now I'll go ahead and reboot the server and see if we get a
persistent shell. As soon as the server starts up, we have a
new agent that is reported in.
If I list the agents,
you'll notice that the new agent from the server has been established as
a normal user and not with a high‑integrity level.
If we had to use the persistence elevated register
module, when the server booted up, we would have got a high‑integrity agent.