WEBVTT 00:00:02.640 --> 00:00:07.350 Hey, there. I'm Rishalin Pillay, and welcome to this Red Team Tools course. 00:00:08.140 --> 00:00:08.970 In this course, 00:00:08.980 --> 00:00:13.060 I will be showing you some command and control techniques using Empire. 00:00:14.040 --> 00:00:16.090 You may have heard about PowerShell Empire, 00:00:16.180 --> 00:00:20.000 the post‑exploitation framework based purely on PowerShell. 00:00:20.350 --> 00:00:23.560 It enabled the capability for PowerShell agents to run 00:00:23.560 --> 00:00:26.450 without the need of running powershell.exe. 00:00:26.920 --> 00:00:30.320 It also provided a wide range of rapid deployable 00:00:30.320 --> 00:00:35.670 modules, which ranged from keyloggers, the famous Mimikatz suite of capabilities, 00:00:36.240 --> 00:00:38.550 evasion techniques, and a lot more. 00:00:39.040 --> 00:00:41.030 PowerShell has been around for many years. 00:00:41.340 --> 00:00:44.810 It was installed by default on Windows 7 and has since become 00:00:44.810 --> 00:00:47.380 the Holy Grail for Windows administrators. 00:00:47.520 --> 00:00:53.310 It is an extremely viable platform for administrators and for attackers. 00:00:53.550 --> 00:00:56.410 We can spend hours talking about the capabilities of 00:00:56.410 --> 00:00:58.990 PowerShell, but this is not the aim of the course. 00:00:59.340 --> 00:01:04.310 The key takeaway is that PowerShell, being available since Windows 7, has 00:01:04.310 --> 00:01:08.440 capabilities that are desirable to attackers due to the powerful 00:01:08.440 --> 00:01:12.570 capabilities it has. In this slide and the previous one, 00:01:12.720 --> 00:01:15.030 you may have noticed two different logos. 00:01:15.320 --> 00:01:18.660 The first one belongs to the original PowerShell Empire. 00:01:19.100 --> 00:01:23.110 This was created by various people in the offensive security community. 00:01:23.250 --> 00:01:27.320 It encompassed several other projects for its underlying functionality, 00:01:27.560 --> 00:01:32.060 and the people who contributed are listed on the Empire project's GitHub page. 00:01:32.440 --> 00:01:35.360 The aim of the project was to demonstrate the 00:01:35.360 --> 00:01:38.930 post‑exploitation capabilities of PowerShell and bring 00:01:38.930 --> 00:01:41.860 awareness to PowerShell attacks that are used. 00:01:42.000 --> 00:01:46.710 Development of PowerShell Empire stopped around 2019 when developers 00:01:46.710 --> 00:01:50.470 felt that the security optics has been improved around PowerShell 00:01:50.470 --> 00:01:53.660 attacks by Microsoft and the EDR industry. 00:01:53.790 --> 00:01:58.060 The second logo belongs to the newer release called Empire 3. 00:01:58.340 --> 00:02:01.070 First, it's maintained by BC‑Security. 00:02:01.240 --> 00:02:03.340 There are some significant improvements, 00:02:03.480 --> 00:02:07.890 such as the support for Python 3 as opposed to version 2.7, 00:02:07.900 --> 00:02:09.919 which was used in PS Empire. 00:02:10.050 --> 00:02:12.440 New PowerShell modules have been incorporated, 00:02:12.450 --> 00:02:15.290 which focus on Kerberos service ticket attacks, 00:02:15.320 --> 00:02:18.460 SMB, grid hijacking, and a lot more. 00:02:18.840 --> 00:02:22.190 They have also included some evasion techniques to bypass 00:02:22.190 --> 00:02:24.810 Microsoft's anti‑malware scan interface. 00:02:25.240 --> 00:02:26.000 In this course, 00:02:26.010 --> 00:02:30.820 we will be using Empire 3. A big shout out to all of the contributors 00:02:30.830 --> 00:02:34.360 who helped to develop and maintain these great tools. 00:02:35.640 --> 00:02:39.630 Another tool that we will be covering within this course is called Starkiller. 00:02:40.710 --> 00:02:43.900 This has been created by BC‑Security. And, 00:02:43.900 --> 00:02:48.260 in essence, it provides a graphical interface for the Empire Server. 00:02:49.040 --> 00:02:49.950 Within Starkiller, 00:02:50.270 --> 00:02:53.680 you are able to perform pretty much every single task that's 00:02:53.680 --> 00:02:57.350 available within the command line version of Empire.