search

BC-SECURITY / Empire

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
https://bc-security.gitbook.io/empire-wiki/
BSD 3-Clause "New" or "Revised" License
4.1k stars 566 forks source link

BCS Empire #28

Closed xploitx closed 4 years ago

xploitx commented 4 years ago

Hey, sorry if this is not the right place to ask, what makes this version different from the real empire? Anything other than mentioned in wiki?

Cx01N commented 4 years ago

Thank you for reaching out.

The Empire Wiki has not been updated in a while, but that is something that we will need to add to our To-Do list. However, you can find a list of updates in our change log. Our project has successfully ported Empire over to be both Python 2 and 3 compatibility with some new features and will be supported by Kali moving forward.

Please let us know if you have any other questions.

xploitx commented 4 years ago

How is the persistence working so far? I think the method used in the original Empire doesn't work in latest Win 10 Update, anyway I'm gonna try this, thanks for the heads up and I hop you people will maintain with much updates to make Empire great again.

Hubbl3 commented 4 years ago

If you are referring to AV evasion it now evades Defender out of the box with things like ps-inject and mimikatz running without causing alerts. If you mean something else could you provide an example module you are interested?

xploitx commented 4 years ago

Thank you for the reply, I would like to know if any of persistence works like charm? https://www.powershellempire.com/?page_id=139

Thank you.

Hubbl3 commented 4 years ago

Gotcha. We have not gotten around to testing those modules yet. We would love it if you were able to test some of them and let us know if you encounter any errors.

Most of the things that caused Empire to be detected by AV were related to some bugs in the launcher code. So as long as the module itself works (we have encountered several modules that were simply broken in 2.5 regardless of detection) then it will likely execute without issue now

xploitx commented 4 years ago

Awesome then, I will spare time to test and report bugs or any troubleshoot to make this great again, thanks for heads up!

I was able to execute launcher powershell <listener> once in a W10 machine and successfully bypassed UAC, but mimikatz staged task and was in pending jobs forever, tried couple of times and now none of my target machines(old and fresh W10 machine) are listening, it is executing the powershell but no feedback in Empire, I'm testing it in WAN, is this some catch from my side? Thank you.

Hubbl3 commented 4 years ago

I just tested the userland/registry persistence module and it is working without issue.

That is likely related to the open issue about long running modules locking up. We are working on solving that. Also make sure you are on the dev branch and not the master. Most of the upgrades have not yet been pulled into the master as we are still in beta testing.

xploitx commented 4 years ago

That's great, my bad I'm using 2.5 and that might be the issue I'm facing, gonna clone dev branch now, closing this topic as you guys explained things pretty well. I will test the userland/registry and revert back, thank you.