Penetration Testing with PowerShell Empire

Navigate the penetration testing landscape shaped by breaches and stronger perimeters. Use the empire framework to bypass security products, evade defenders, and scale network traffic for covert, high value tests.

Empire is a post exploitation framework that models advanced persistent threat behaviors, emphasizing stealth, flexibility, and secure communications. Its Python control server and PowerShell modules enable flexible, stealthy Windows control.

Explore the Mandiant attack lifecycle as a concise, stepwise framework guiding your model-building, from initial compromise and footholds to Empire modules for escalating privileges, gaining persistence, and moving laterally.

Set up a safe hacking lab with virtual machines using VMware Workstation to run Kali Linux and a Windows 7 VM, with free trials from Microsoft and optional VirtualBox alternative.

Learn how to temporarily disable antivirus and firewall protections to complete lab activities in a penetration testing environment, with guidance on using an administrative command prompt and vendor-specific steps.

Verify a functional hacking lab, ensure VM connectivity and ping between Windows and colleague VMs, review default credentials, and note Linux updates and firewall adjustments before moving on.

Explores the penetration testing landscape, modern tools, and PowerShell Empire capabilities, uses the Mandaean attack lifecycle to model attacker activities, and builds a safe VM Ware lab for practice.

Master the essential concepts to understand how Empire works and start using Empire quickly, focusing on the bare minimum information with later details reserved for future modules.

Begin with a lab to install empire on Kali Linux, cover empire terminology and command-and-control basics, then practice hands-on with Power Shell empire.

Learn Empire terminology for deployment and control: stagers establish connections to the control server, listeners receive those connections, and agents infect hosts, with modules running tasks on the infected system.

Explore how Empire command and control works: deploy a listener on the control server, stage code on the victim, and enable the server to execute modules and receive results.

Examine how Empire C2 uses asynchronous agents that poll the control server for taskings, enabling stealthy, encrypted traffic that blends with http/https and evades detection.

Conducts a hands-on Empire lab to quickly set up an HDTV listener and a multi launcher stager, establish command-and-control, and restore the Windows system afterward.

Configure an http listener in Empire to receive stager connections, start the listener, adjust required options, set a 5-second polling interval, and verify the listener is active.

Configure an empire stager, generate a multi launcher payload, and paste the script into a Windows VM to establish command control and activate the empire agent.

Rename the vm agent to a readable name, interact to issue shell commands like whoami or system info, then explore Empire modules, list options with tab, and run a module.

Terminate compromised agents and reset the Empire database using kill, kill all, and clear commands to restore systems to their pre-invasion state. Manage agents from the tally server's agents menu.

Master basic Empire commands, configure a listener and stager, and establish command and control between Windows and Cal Levy, then practice running modules and terminating agents.

Conclude module two by reviewing empire installation, listeners and stagers for command and control, and the basic skills to operate the empire framework.

Explore initial code execution and hands-on techniques, including physical access attacks, spear phishing with weaponized documents, malicious applications, and removable media payloads, all with explicit written permission.

Explore the initial compromise in the Empire framework, showing how attackers gain access via social engineering, spearfishing, removable media, and drops, and practice the steps in labs.

Explore physical access attacks and how attackers bypass devices, including boot loaders, live CDs, and USB tools, highlighting risks when devices are unlocked or unattended.

Explore physical access attack vectors, from unattended computers to USB drives, and learn techniques to deploy empire stager via compromised terminals, browsers, or removable media.

Demonstrates physical access attacks by hosting an empire stager launcher on a web server, then walk up to a target VM to download and execute the payload via a one-liner.

Learn how attackers weaponize Microsoft Office documents with macros to enable code execution, including creating a macro stager, embedding it in a docm, and deploying spearphishing campaigns.

Utilize removable media drops to provoke initial compromise through social engineering by placing disks labeled confidential or classified in common areas, prompting employees to bring them to security for inspection.

Demonstrates how removable media can be weaponized by masking extensions and embedding malicious macros to trick users into executing a staged payload.

Explore methods to achieve the initial compromise through social engineering, learn to craft legitimate pretexts, and understand how attackers advance access across networks.

Explore how to leverage an initial compromise to gain a reinforced foothold, escalate privileges, move laterally, and complete your pen test objectives.

Provide an overview of gaining footholds, establishing persistent access via registry and scheduled tasks, identifying security measures, and using Windows enumeration for privilege escalation and lateral movement.

Fortify your initial access after gaining a foothold, survive reboots and antivirus termination, and conduct internal reconnaissance to escalate to a privileged account.

learn how to achieve user land persistence to maintain access without elevated rights, enabling later escalation and lateral movement, through hands-on labs with Empire's registry and schedule tasks modules.

Examine the user land persistence registry model by inserting empire payload into Windows registry run key, with optional data streams or event logs, tested under a low privileged user.

Explore userland persistence with schtasks, creating a low-privilege scheduled task that runs after idle time or at a set time, with Empire cleanup restoring the pre-persistence state.

Explore the anti-virus product model in empire to identify defenses like Windows Defender, then tailor payloads to evade them for more effective penetration testing.

Learn foothold techniques to fortify access, establish persistence, and gain situational awareness for later privilege escalation and lateral movement. Explore how to maximize foothold results to escalate to administrator.

Explore techniques for escalating privileges within Windows systems using PowerShell Empire, including strategies to reach administrator or system accounts.

Explore privilege escalation fundamentals and the empire model power view to identify vulnerabilities, bypass UAC techniques, and elevate to the highest privileged Windows account, with brief coverage of persistence.

Identify privilege escalation vulnerabilities using empire's power module, scanning for vulnerable services, laden passwords, and UAC bypass opportunities, then assess admin elevation options based on the module's detailed output.

Explain how Windows user account control enforces process integrity levels and prompts elevation, and show how Empire's UAC bypass module enables testers to bypass UAC in client-side attacks.

Learn how the bypass UAC model uses process injection and a trusted publisher certificate to run privileged commands when UAC is off, demonstrated with Empire agents.

Demonstrate a UAC bypass using the crib ask model in PowerShell Empire to elevate to the system account via get system, by interacting with an agent and UAC prompts.

Master elevated persistence by applying Empire's persistence models to maintain administrator-level access, configuring the stager to run at boot or under other conditions, including elevated registry persistence.

Explore Windows privilege escalation in detail, covering PowerView, UAC bypass, and obtaining system privileges, while noting these techniques are foundational and warrant further study.

Explore module 6 techniques for lateral movement and data collection with Empire, expanding access to network devices and siphoning critical data using Empire's collection modules.

Explore collection and movement in high value penetration tests, including dumping techniques with Mimi Katz. Practice lateral movement with PSC exec, pass the hash, and power remote in labs.

Explore how Mimi Katz dumps credentials from memory, extracting plaintext passwords and hashes, decrypting secret keys, and enabling post-exploitation lateral movement with an administrative agent.

Explore lateral movement with empire by pivoting from a Windows 7 VM to a Windows 8 VM using the invoke WMI model and credential reuse.

Explore Empire's other lateral movement techniques such as pass the hash and exec modules; practicing them requires an Active Directory lab, which is beyond this course's scope.

Record keystrokes with a keystroke logging module, save results to a file, and highlight the potential collection of passwords and emails, all with simple syntax for pen testing.

Validate mastery by configuring Empire's invoke for lateral movement and exploring modules. Practice Empire's collection tools, such as screen shots and keylogging, to collect passwords and hashes.

Explore how attackers move laterally, extract passwords, and siphon data across networks using empire's collection modules to demonstrate impact as a professional tester.

Stay proficient with empire and penetration testing, and continuously learn new skills as hacking evolves. Model attackers' techniques to breach networks and push your organization toward a better security posture.