Empire Bootstrapping v2 – How to Pre-Automate All the Things!

Kent Ickler //

ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques.

A robot wearing boots… with straps….

Have you been tasked with automation in the Command and Control (C2) world? If so your goal is to shorten the overhead time on repetitive tasks related to procuring a valid control channel. This wasn’t my first rodeo in mundane automation and finding creative shorthand. Automating automated tools usually comes without too many headaches. It’s amazing how a little time in a script can potentially save staff HOURS and even WEEKS of work.  

I’m still surprised though, Powershell Empire does not directly accept command line arguments to launch a predefined listener (albeit it includes an API).  The challenge to automate attended Powershell Empire configuration was already presented by Carrie in this blog post.  The previous work used Screen to create a new shell session “window” and cast in the appropriate commands.  With a couple of small changes to Carrie’s work, a Powershell Empire bootstrap is created for unattended deployment and teardown.

Review of Screen:

Screen allows for multiple retained sessions within a Linux system. Casting the Powershell Empire directly into a new Screen without attaching the screen causes Empire to be actively loaded in the background of the current session. Screen’s feature allows passing commands into the new session from the existing session, allowing a shell script to mimic an attended session with input.

Unattended Powershell Empire bootstrap:

The following script casts a Powershell Empire instance into a new Screen session, sends the necessary commands to that Session to clear all existing listeners and the commands to create a new listener. The last command (commented out for unattended utility) attaches the user to the new Empire session. Attaching to the new session is optional, however, since Empire could now be interactively controlled via scripting from other sources/scripts. The syntax to send commands to the Empire instance are pretty apparent here and modifying to fit your needs for automation or unattended needs should be pretty easy.

#You’ll need sudo for Empire:

sudo -s

#Don’t forget your +x flag!

chmod +x Empire_Listener_443.sh

.\Empire_Listener_443.sh

Carrie had set most of this work in motion last year, with a couple of small updates it becomes unattended and automated.  Thanks Carrie!

Empire_Listener_443.sh

#Clear any Existing empire Screen sessions

screen -X -S Empire Quit

# Launch Empire and wait a few seconds while it starts and brings user to prompt.

cd /directory/to/Empire

screen -S Empire -d -m /directory/to/Empire/empire

sleep 5

#Send unattended commands to the Empire instance

screen -S Empire -X stuff ‘listeners\r’

screen -S Empire -X stuff ‘kill all\r’

screen -S Empire -X stuff ‘y\r’

screen -S Empire -X stuff ‘set Name OurListener\r’

screen -S Empire -X stuff ‘set Port 443\r’

screen -S Empire -X stuff ‘execute\r’

screen -S Empire -X stuff ‘back\r’

screen -S Empire -X stuff ‘listeners\r’

Echo “***Connect to this Empire session with ‘screen -S Empire -R’”

This leaves the Empire listener running in the background session and the appropriate command to connect to the listener control menu.

Attended Powershell Empire bootstrap

Now, to take it one more step, this short script can be turned into a bootstrap that will launch Empire and Attach you into a session with the command line argument(s) you provide.

#You’ll need sudo for Empire:

sudo -s

#Don’t forget your +x flag!

chmod +x EmpListener.sh

./EmpListener.sh [listener-name] [port number]

/.EmpListener.sh OurListener 443

EmpListener.SH:

#Clear any Existing empire screen sessions

screen -X -S Empire Quit

# Launch Empire and wait a few seconds while it starts and brings user to prompt.

cd /directory/to/Empire

screen -S Empire -d -m /directory/to/Empire/empire

sleep 5

#Send unattended commands to the Empire instance

screen -S Empire -X stuff ‘listeners\r’

screen -S Empire -X stuff ‘kill all\r’

screen -S Empire -X stuff ‘y\r’

screen -S Empire -X stuff ‘set Name ‘$1’\r’

screen -S Empire -X stuff ‘set Port ‘$2’\r’

screen -S Empire -X stuff ‘execute\r’

screen -S Empire -X stuff ‘back\r’

screen -S Empire -X stuff ‘listeners\r’

#Attach to the new screen session (optional)

screen -S Empire -R

Note that if you now attach to the newly created Screen session “EMPIRE” and exit out of the Powershell Empire instance, the Screen session is destroyed as the Empire instance is destroyed, leaving you back at your original shell.