WEBVTT 00:00:01.440 --> 00:00:01.990 Hey there. 00:00:02.000 --> 00:00:03.100 I'm Rishalin Pillay, 00:00:03.110 --> 00:00:08.050 and welcome to this Red Team tools course on Persistence with Empire. 00:00:08.050 --> 00:00:13.700 A lot of APT groups and attackers in general need to establish persistence. 00:00:14.240 --> 00:00:16.400 Persistence gives them the ability to maintain a 00:00:16.400 --> 00:00:18.650 foothold on the targeted machine. 00:00:19.140 --> 00:00:21.510 In this course, we will focus on persistence, 00:00:21.630 --> 00:00:22.770 leveraging Empire, 00:00:23.340 --> 00:00:25.910 and we will look at various persistence techniques 00:00:25.920 --> 00:00:28.170 that can be performed using Empire. 00:00:29.940 --> 00:00:32.009 You may have heard about PowerShell Empire, 00:00:32.119 --> 00:00:35.930 the post‑exploitation framework based purely on PowerShell. 00:00:36.280 --> 00:00:39.490 It enabled the capability for PowerShell agents to run 00:00:39.490 --> 00:00:42.570 without the need of running PowerShell.exe. 00:00:42.940 --> 00:00:46.960 It also provided a wide range of rapid deployable modules, 00:00:47.340 --> 00:00:51.570 which ranged from keyloggers, the famous Mimikatz suite of capabilities, 00:00:52.140 --> 00:00:54.790 evasion techniques, and a lot more. 00:00:54.790 --> 00:00:56.950 PowerShell has been around for many years. 00:00:57.270 --> 00:01:00.730 It was installed by default on Windows 7 and has since become 00:01:00.730 --> 00:01:03.290 the Holy Grail for Windows administrators. 00:01:03.450 --> 00:01:09.160 It is an extremely viable platform for administrators and for attackers. 00:01:09.540 --> 00:01:13.100 We can spend hours talking about the capabilities of PowerShell, 00:01:13.210 --> 00:01:14.920 but this is not the aim of the course. 00:01:15.240 --> 00:01:19.660 The key takeaway is that PowerShell, being available since Windows 7, 00:01:19.800 --> 00:01:23.810 has capabilities that are desirable to attackers due to 00:01:23.810 --> 00:01:26.070 the powerful capabilities it has. 00:01:26.070 --> 00:01:30.970 In this slide and the previous one, you may have noticed two different logos. 00:01:31.250 --> 00:01:34.570 The first one belongs to the original PowerShell Empire. 00:01:35.040 --> 00:01:39.050 This was created by various people in the offensive security community. 00:01:39.180 --> 00:01:43.250 It encompassed several other projects for its underlying functionality, 00:01:43.490 --> 00:01:48.090 and the people who contributed are listed on the Empire project's GitHub page. 00:01:48.340 --> 00:01:51.300 The aim of the project was to demonstrate the 00:01:51.300 --> 00:01:54.850 post‑exploitation capabilities of PowerShell and bring 00:01:54.850 --> 00:01:57.790 awareness to PowerShell attacks that are used. 00:01:57.910 --> 00:02:02.630 Development of PowerShell Empire stopped around 2019 when developers 00:02:02.630 --> 00:02:06.390 felt that the security optics has been improved around PowerShell 00:02:06.390 --> 00:02:09.580 attacks by Microsoft and the EDR industry. 00:02:09.710 --> 00:02:14.060 The second logo belongs to the newer release called Empire 3. 00:02:14.300 --> 00:02:17.050 This is maintained by BC SECURITY. 00:02:17.190 --> 00:02:19.260 There are some significant improvements, 00:02:19.400 --> 00:02:23.810 such as the support for Python 3 as opposed to version 2.7, 00:02:23.820 --> 00:02:25.840 which was used in PS Empire. 00:02:26.000 --> 00:02:28.350 New PowerShell modules have been incorporated, 00:02:28.440 --> 00:02:31.170 which focus on Kerberos services ticket attacks, 00:02:31.240 --> 00:02:34.360 SMB, red hijacking, and a lot more. 00:02:34.840 --> 00:02:38.100 They have also included some evasion techniques to bypass 00:02:38.100 --> 00:02:40.750 Microsoft's antimalware scan interface. 00:02:41.140 --> 00:02:43.450 In this course, we will be using Empire 3. 00:02:44.540 --> 00:02:47.610 A big shout out to all of the contributors who helped to 00:02:47.610 --> 00:02:50.270 develop and maintain these great tools. 00:02:51.540 --> 00:02:55.540 Another tool that we will be covering within this course is called Starkiller. 00:02:56.640 --> 00:02:59.830 This has been created by BC‑SECURITY, and, 00:02:59.830 --> 00:03:04.170 in essence, it provides a graphical interface for the Empire Server. 00:03:04.940 --> 00:03:05.920 Within Starkiller, 00:03:05.920 --> 00:03:09.600 you are able to perform pretty much every single task that's 00:03:09.600 --> 00:03:13.250 available within the command line version of Empire.