I would like to spend a couple of minutes discussing the workflow of Empire.
We will jump to our Kali Linux machine, and we will
discuss the role of listeners, stagers, agents, and modules.
Let's dive in.
The first thing that you will need to do when you
start up Empire is create a listener.
Listeners can be created using the uselistener command
followed by the type of listener.
Now there are a number of listeners that's available on Empire.
The most common one that's being used is an HTTP listener.
When you use an HTTP listener,
you can configure it to work with HTTPS, but bear in mind that
you need to configure the cert part variable with the
certificate that you would like to use.
The http_hop listener utilizes a PHP file, which
redirects traffic to an existing listener.
And we will look at a demonstration of the http_hop listener in this course.
Foreign listeners are used when you have a second Empire C2 server that you
would like to use to pass the sessions to. Each of these listeners have a number
of configurable options that you can configure. The next thing that you would
need to set up is called a stager.
Stagers are essentially the exploit code,
which establishes a session to your listener.
Empire supports a wide range of stagers, and they are multi‑platform.
The most commonly used stager is a launcher stager. Now within Empire,
you've got various options of a launcher stager,
and these can be a batch file, a link, VBS,
XML, and more.
It also supports listeners that work with both a bash bunny and a rubber ducky.
Once you stager executes and successfully communicates with the listener,
you would then have an agent that gets established.
Once you have an agent,
you can then interact with the agent and perform various tasks.
This is where modules come in to play. You could use a module
within an agent to perform various tasks.
If you look within Empire, using the usemodule command,
you'll notice that there are quite a few modules that can be used.
For example,
situational awareness gives you the ability to use various
PowerShell applets to perform things like reconnaissance,
host, discovery, network discovery, and discover things like
AppLocker status and anti‑virus products installed.
When we look at the privilege escalation modules, we have modules
that allow us to bypass UAC and the powerup module,
which looks for ways to obtain an elevated agent. When we look
at persistence, this is where we have the ability to establish
persistence on the target machine.
We also have management modules, which give us the
ability to inject into various processes,
enable RDP, and downgrade an account. Lateral movement
gives us the ability to move laterally.
And then we've got exfiltration, various credential modules,
which involve Mimikatz, collection modules, and code execution.
Currently, on this fork of Empire, there are 304 modules that we can leverage.