Showing posts with label doc. Show all posts
Showing posts with label doc. Show all posts

Empire Notes

sudo apt install powershell-empire

as stated above:

in one terminal run `powershell-empire server`, then open a new terminal and run `powershell-empire client`.

I had to open 2 terminal windows. (Ctrl + Shift + T to do it within same terminal window.)

In the first I ran the server command, and in the 2nd the client portion of the script.

When the client loads it attempts to connect to the server on the localhost.

That being said, I am finding many of the commands in the book to be slightly different in this version of Empire.

Some VERY quick notes:::

Start the server first -- sudo powershell-empire server

Then start the client -- sudo powershell-empire client

uselistener http ← the newer version (4.x) will show the options after you complete typing uselistener

info

options ← this has switched to just ‘options’

Set ‘<XXXX>’ seems to work as normal.

A gotcha for me was I had to set the port. Just doing the book and it "failed to validate listener http options"

set Port 80

---->> I did not notice this until later, but in the server window, it was throwing an error saying: "Set the port dammit" (not in so many words ofc.) Next time I will check.

Same as before with the listener, once you set the stager, 'info' will display a few things, but you need 'options' to see all of the things.

It seems 'sysinfo' has been replaced with just 'info'. I like how PS gives you the memory usage and architecture of the process (x86)

A quick Addition:

I made a mistake on my listener, and the only way I could edit it was to disable it first. (Google was not my friend on this.)

listeners --> then "disable http" finally stopped the listener 

Splunk Notes

The bucket command will slice the Splunk timeline of events into discrete buckets of time determined by the user. The search syntax below will bucket a Splunk timeline into discrete five minute chunks, regardless of the length of the timeline:

bucket _time span=5min

The second method is provided by the Splunk search command "stats." The stats command does many things, but one of the things it does best is sorting data by other data. The following search syntax will show all DNS queries of every host in the Splunk timeline, regardless of the length of the timeline:
 

stats values(dns_query) by source_host