WEBVTT

00:00:00.910 --> 00:00:04.770
I would like to spend a couple of minutes discussing the workflow of Empire.

00:00:05.140 --> 00:00:07.830
We will jump to our Kali Linux machine, and we will

00:00:07.830 --> 00:00:14.070
discuss the role of listeners, stagers, agents, and modules.

00:00:14.640 --> 00:00:15.360
Let's dive in.

00:00:16.040 --> 00:00:18.150
The first thing that you will need to do when you

00:00:18.150 --> 00:00:20.660
start up Empire is create a listener.

00:00:21.040 --> 00:00:24.760
Listeners can be created using the uselistener command

00:00:25.140 --> 00:00:26.760
followed by the type of listener.

00:00:27.440 --> 00:00:30.770
Now there are a number of listeners that's available on Empire.

00:00:31.240 --> 00:00:34.930
The most common one that's being used is an HTTP listener.

00:00:35.090 --> 00:00:36.980
When you use an HTTP listener,

00:00:36.990 --> 00:00:40.940
you can configure it to work with HTTPS, but bear in mind that

00:00:40.940 --> 00:00:43.670
you need to configure the cert part variable with the

00:00:43.670 --> 00:00:45.760
certificate that you would like to use.

00:00:46.240 --> 00:00:50.790
The http_hop listener utilizes a PHP file, which

00:00:50.790 --> 00:00:53.360
redirects traffic to an existing listener.

00:00:54.140 --> 00:00:58.250
And we will look at a demonstration of the http_hop listener in this course.

00:00:58.940 --> 00:01:04.330
Foreign listeners are used when you have a second Empire C2 server that you

00:01:04.330 --> 00:01:09.710
would like to use to pass the sessions to. Each of these listeners have a number

00:01:09.710 --> 00:01:13.970
of configurable options that you can configure. The next thing that you would

00:01:13.970 --> 00:01:16.180
need to set up is called a stager.

00:01:16.270 --> 00:01:18.910
Stagers are essentially the exploit code,

00:01:19.010 --> 00:01:21.560
which establishes a session to your listener.

00:01:22.040 --> 00:01:26.910
Empire supports a wide range of stagers, and they are multi‑platform.

00:01:27.130 --> 00:01:31.990
The most commonly used stager is a launcher stager. Now within Empire,

00:01:32.000 --> 00:01:34.380
you've got various options of a launcher stager,

00:01:34.530 --> 00:01:39.030
and these can be a batch file, a link, VBS,

00:01:39.140 --> 00:01:40.750
XML, and more.

00:01:41.230 --> 00:01:45.670
It also supports listeners that work with both a bash bunny and a rubber ducky.

00:01:46.540 --> 00:01:50.260
Once you stager executes and successfully communicates with the listener,

00:01:50.840 --> 00:01:53.450
you would then have an agent that gets established.

00:01:53.940 --> 00:01:55.020
Once you have an agent,

00:01:55.030 --> 00:01:58.690
you can then interact with the agent and perform various tasks.

00:01:58.890 --> 00:02:02.300
This is where modules come in to play. You could use a module

00:02:02.310 --> 00:02:05.070
within an agent to perform various tasks.

00:02:05.540 --> 00:02:08.750
If you look within Empire, using the usemodule command,

00:02:09.240 --> 00:02:12.450
you'll notice that there are quite a few modules that can be used.

00:02:12.940 --> 00:02:13.780
For example,

00:02:13.790 --> 00:02:17.010
situational awareness gives you the ability to use various

00:02:17.010 --> 00:02:19.860
PowerShell applets to perform things like reconnaissance,

00:02:19.870 --> 00:02:23.480
host, discovery, network discovery, and discover things like

00:02:23.480 --> 00:02:26.260
AppLocker status and anti‑virus products installed.

00:02:26.840 --> 00:02:30.380
When we look at the privilege escalation modules, we have modules

00:02:30.380 --> 00:02:34.620
that allow us to bypass UAC and the powerup module,

00:02:34.630 --> 00:02:37.810
which looks for ways to obtain an elevated agent. When we look

00:02:37.810 --> 00:02:40.790
at persistence, this is where we have the ability to establish

00:02:40.790 --> 00:02:42.620
persistence on the target machine.

00:02:42.820 --> 00:02:45.400
We also have management modules, which give us the

00:02:45.400 --> 00:02:48.040
ability to inject into various processes,

00:02:48.050 --> 00:02:51.870
enable RDP, and downgrade an account. Lateral movement

00:02:51.870 --> 00:02:53.650
gives us the ability to move laterally.

00:02:54.040 --> 00:02:57.280
And then we've got exfiltration, various credential modules,

00:02:57.290 --> 00:03:01.270
which involve Mimikatz, collection modules, and code execution.

00:03:01.640 --> 00:03:07.160
Currently, on this fork of Empire, there are 304 modules that we can leverage.