- Powershell is an excellent tool
for post exploitation, and lateral movement
through the network.
If you're able to run commands on the machine,
Powershell is your friend.
The previous lessons showed various ways
of getting on the machine
through capturing credentials,
web attacks, buffer overflows, and more.
You often find yourself with limited access
to a machine, and the need to elevate privileges,
or search for sensitive information on the network.
We're gonna spend some time talking about Empire.
Empire is a Powershell and Python exploitation framework.
You can use it to run an incredible amount
of exploitation modules on Windows machines,
and other machines running Powershell or Python,
and it really is an amazing tool to use
for any of your post exploitation activities.
Let's take a quick look at some
of the breakdown of the different details within Empire,
before we jump into a demo.
First you have listeners.
An Empire listener is basically a service
that's listening on your computer
for victims to connect to it.
So once you're able to run the Powershell command
on your victim machines, they'll connect
back to your listener, and you're gonna be able
to take full control over their systems.
Next are stagers.
Stagers are various macros, and DLLs,
and scripts that you can actually run
to make the initial connection to the victim.
So, a stager may be USB capabilities.
Some information on USB drives
to actually plug into a machine,
and autorun on the victim machine
to actually connect back to you.
Or, it might just be a command that you run
on the system, or maybe it's macros
that you can put within a Word document
to execute your Powershell commands,
so the victim connects back to your system.
And then there are the agents.
The agents are basically all of your victim machines
that you have full control over.
The modules are all of the different scripts
and commands that you run on the victim machine,
so they vary from taking screenshots
of the victim's Desktop, to turning on their webcam,
to capturing their passwords for memory,
and capturing their passwords on their computers,
to uploading and downloading files
from their computer.
So there's an incredible amount of modules within Empire.
There's over 200 modules that you can use
to run various scripts on that computer,
and the networks that that computer is connected to.
And then there's the scripts section.
The scripts section is basically
for you to create your own scripts
to bring into the Empire framework.
Okay, let's take a look at Powershell Empire.
The fully functional Powershell exploitation framework.
So we can download that straight from GitHub.
Completely free.
You can see, it's Powershell and Python now.
We're gonna concentrate on the Powershell side.
And we're gonna run through the installation process.
So here's how you download the tool.
And, here's a quick description of what it is.
But, we just talked about the different parts of it,
so let's run right through the installation.
So, all we have to do is use the git clone command.
And we start downloading the whole framework.
And now we're gonna go into the directory.
And there is a setup file within this
that we can use to finish up the setup process.
So, install.sh is what we're gonna run.
We're gonna spend some time on Powershell Empire,
just because this is the way attacks are going,
using tools that are already
built into the operating system,
so they won't set off any alerts.
Now that we've run through the installation,
we're gonna back up a directory,
and run Powershell Empire.
Or as they call, just Empire now.
After the intro graphic, you could see
that it shows there are 267 different types
of attack modules that you can use
within this one framework.
Half of those are Powershell,
the other are Python.
If you just type the question mark,
there are a list of commands that you can do.
So anytime you get stuck,
and you wanna know what to do,
you can just type in the question mark,
and it'll tell you exactly what commands you can run.
It's basically like the Metasploit framework look and feel
to the command line interface.
We also talked about Recon-ng,
in the reconnaissance lesson,
where it has a similar look and feel
to the actual command line.
So you can see, we can go to the agents menu,
the listeners menu, which we discussed what they were.
And there is different modules that you can run as well.
The very first thing that we need to do,
is setup a listener.
So, we can see, we type in listeners,
and it brings us to the listeners menu.
It also mentions there are no listeners currently active.
So we're gonna create our listener
for our victim machines to connect back to,
so we can control those various options.
We're gonna kick off the uselistener command.
And you see there's various types
of listeners we can create.
We're gonna create the HTTP listener.
So it's basically gonna do this over the web.
If you type in info at any section,
it'll give more details about what you can do here.
So, on HTTP listener, we typed info,
and here are the different command options we can set.
So we set a name for the listener, called testListener.
The Port is really important here,
because if you're already running a web server
on your computer, probably over port 80 or 443,
we're gonna wanna set a different port value for here,
so the two tools do not override each other.
So, here we're setting it to port 8080, instead of 80,
since we do have a web server running.
Any option that you wanna change,
you use a set command.
So, we're gonna set the name to listenertest,
and that changes the name.
You can see here, listenertest is now the name.
We can switch the name right back to testlistener.
This is just for our own purposes,
for keeping track of the different listeners
we have on the system.
You can see the full value of the URL
that we're serving up, is the http://, our IP address,
:8080, which is the port.
There's also the KillDate.
This one's interesting here, because,
basically we're setting up a listener on the network
to listen to any of our zombie machines
that we take over, to connect back to us,
but the KillDate basically says
we can set a date where, on this date,
we're gonna basically release all the victim machines,
and stop our listeners.
The WorkingHours are the same.
If you want to try to avoid any administrators
from finding out that you're taking over their machines,
you can set working hours for your exploits.
So, you can say it only runs during the day,
or maybe you only want it running at night,
depending on what type of work you're doing.
The CertPath that you have there,
is if you wanna have an HTTPS listener,
you will have to set a certificate path.
And the Launcher, you can see it's gonna
use some type of Powershell command.
So if we hit the question mark,
we can see, here's the options
that we can run.
We're gonna type execute, so we can kick off our listener.
And so now we see, Listener successfully started.
If we type in listeners command now,
we can see that we have our testlistener,
which is an HTTP listener.
You can see the exact location of it.
We don't have a KillDate set.
So it'll listen as long as we have it active,
until we kill it manually.
So if we type in the question mark here,
it gives us various options.
We want to create a launcher for this listener.
Basically what we need to do now,
is, when we create the launcher,
it's gonna create a Powershell command
that we need to run on the victim machine,
in order for it to connect back to our Empire setup here.
And, so we'll take full control over the machine.
So we type in launcher, and then,
one nice thing about Empire is it has tab autocomplete,
so you can type launcher, then you hit tab,
and it brought up either powershell or python as options.
We're of course using Powershell,
so we're gonna pick powershell.
And then tab autocomplete.
It picks the listener.
And up pops the Powershell command
that we're gonna run on the other host.
So if you run that command on the host,
that machine's gonna connect back
to our Powershell Empire framework.
So you may ask, how would we get another machine
to run that command?
Well there is various ways.
We can send them a phishing email,
and try to get them to click on a link.
We can give them a USB drive, or a malicious CD.
Or we can create a malicious Word document
to send to them.
Once they open up the Word document,
it'll launch this Powershell command, within macros,
if they enable macros.
But for demo purposes, we're just gonna serve up
a website that has the command,
and allow them to manually run the command on the system,
just so you can see how a victim machine
will connect back, and we can take full control
over their machine.
So we're gonna serve up a web server over here
on our local machine.
And we're gonna create this file called empire.txt.
And we're just gonna put that Powershell command in there.
If we look and see the file contents here,
you can see it is our actual full command.
And now we're gonna start
the Apache service on our computer.
So now we have a web server running.
And you can see the empire.txt is there.
Now let's go to our victim Windows 7 machine.
We're gonna type in that website,
and you can see, here's the Powershell command.
Now during penetration tests,
I had the opportunity to run these commands
on machines through various ways.
We've talked about the phishing method.
There's also times where you might
be able to partially break into a machine,
and you can run commands on the machine,
but you cannot take full control completely yet.
But if you can run certain commands,
you can send it a Powershell command to run,
so it can actually connect back to you.
So, in here, just for demo purposes,
we are going to just manually run the Powershell command.
I'm just gonna open up a command line window.
Run the Powershell command.
You can see the Powershell command
is set to specifically remove the window,
so once it runs, it's not gonna
keep the window on the screen,
because that would be suspicious
to see a command window appear on the Desktop.
It's set to automatically remove that.
The actual Powershell command is Base64 encoded,
so you cannot see exactly what it's running.
And now, we go back to our Powershell Empire,
and we can see that listener and agent actually connected.
So, that Windows 7 machine,
we ran the Powershell command on it,
and it connected to our Empire system.
So now, even though the Windows 7 doesn't know,
we have taken full control over that computer.
So you can see if we type in back,
you can see we have one listener,
and one agent currently active.
One of the great things about this tool,
is that it's running completely in memory,
so it's not tripping any type of antivirus.
They don't even know that we have control
over their computer.
We're just completely running in the background.
So, we have full control over this machine,
and we wanna look and see what type of agents we have.
So if you just type in agents,
you can see that it has a Powershell agent.
It sets a random name for it,
and you can see the IP address, the machine name,
the username, it gets kind of cut off
because we don't have enough room on the screen.
And you can see exactly when it connected.
We probably want to rename this system,
because that name doesn't make any sense to us,
so we'll just call it our victim test machine.
And so now you can see,
we renamed the system to victimTest,
which makes a little bit more sense.
And, we have full control over this computer.
You could see that we're running on that machine,
on the Windows machine, using the Powershell process,
and the process ID is 3316.
So, if the individual looks and sees
what types of processes are running on their machine,
all they're gonna see is that Powershell's running.
They're gonna see the process ID.
They're not gonna know that
this is actually a malicious Powershell instance.
And the great thing about Powershell
is that it's built into Windows,
so it's not really that suspicious
that it would be running on the Windows machine.
So, if you use the interact command,
you can interact with an agent,
and run various commands on the agent.
So we're gonna interact with victimTest,
which is what we named it.
And there's various things that you can run
on the system.
Now that we have full control over the system,
we can do a variety of tasks.
So you can see, we can have
the victim machine download a file.
We can see what types of processes
are running on the machine,
or we can completely kill certain processes.
So, a malicious individual may try
killing some important processes.
Of course, you'd never do that
in any scenario where we're actually
trying to find the other vulnerabilities.
Mimikatz is one we're gonna concentrate on.
Mimikatz is basically where it takes the passwords
and pulls them from memory on Windows 7
and earlier versions of Microsoft Windows.
When somebody's logged into the machine,
it stores their passwords in memory,
so you can use it for logging
into various other systems on the network,
using that same password.
It won't keep prompting you for that same password.
So, now that we're on the machine,
we can just look in memory, and see
what passwords are sitting around.
You can see, we can also take screenshots.
So if we type in the sysinfo command,
it's telling us exactly information on this system.
So, and we also just type in the info command,
and it'll tell you all sorts of additional information
relating to our Powershell instance on this machine.
So, we can also run different types of shell commands,
so any command you can run on the command line,
on that Windows 7 machine,
we can run straight from our Powershell Empire screen.
So if we just type shell,
and then a shell command, it runs.
So we just typed in the hostname command.
It showed us the name of the machine.
We type ipconfig, to look at the network configuration,
and up pops the network configuration
from the Windows 7 machine.
How about we look at the local administrators group?
Sometimes it takes a second,
but you can see that it pops up
all the administrators that are on that machine.
Somebody named administrator, sectraining,
and there's a zorro user on the machine.