Ethical Hacking Institute Course in Pune-India
Extreme Hacking | Sadik Shaikh | Cyber Suraksha Abhiyan

PowershellEmpire is basically a post-exploitation framework that utilities the widely-deployed PowerShell tool for all your system-smashing needs. It’s feels quite Metasploit with it text-driven menus, module management and execution functions, but it’s purely for generating PowerShell agents and post-exploitation evilness. Of course, Powershell being native to Windows means that AV is not a concern (for now), and Empire has some quite nifty features .

Disclaimer – Our tutorials are designed to aid aspiring pen testers/security enthusiasts in learning new skills, we only recommend that you test this tutorial on a system that belongs to YOU. We do not accept responsibility for anyone who thinks it’s a good idea to try to use this to attempt to hack systems that do not belong to you

Install

Installation is trivial. Clone the repo to a location of your choosing and run the setup script to pull the dependencies and get it all configured:
py1
Agree to everything. A bunch of new packages will be downloaded and installed and you will be asked if you want to choose a specific key to secure the comms between agents and the Empire listeners. Hit enter to allow a random key to be generated (you can choose a different one later if you wish).

Now you’re ready to go. Fire up Empire by running ./empire from /opt/Empire:

py2

Fire up a listener

Think of a listener as a metasploit handler. This will catch your PowerShell session that you launch on the target system. This needs to be set up first as your stager (payload) will need to know which listener it should talk to. The default options should be just fine:
py3

Create and deploy your stager

Think of a stager as your payload. This is what you will be executing on your target system to establish a control channel between it and your Empire listener. There are several different types of stager that Empire can generate, but for the sake of brevity let’s create a simple bat file that will create our PowerShell agent to deploy:
py4
The important part is to tell your stager which listener to use – this can be done by setting the Listener value to match your prepped listener instance. Now get your stager onto your target box (remember, this isn’t an exploitation tool per se, it’s a post-exploitation management framework) and execute it to get your session established:
py5

Loot

Now you can interact with your active agent, running  the info command to get some basic system stats from your target:
py6
Running shell commands can be accomplished by using the command shell followed by the system command. Observe!
py6