Showing posts with label offensive. Show all posts
Showing posts with label offensive. Show all posts

Empire Notes

sudo apt install powershell-empire

as stated above:

in one terminal run `powershell-empire server`, then open a new terminal and run `powershell-empire client`.

I had to open 2 terminal windows. (Ctrl + Shift + T to do it within same terminal window.)

In the first I ran the server command, and in the 2nd the client portion of the script.

When the client loads it attempts to connect to the server on the localhost.

That being said, I am finding many of the commands in the book to be slightly different in this version of Empire.

Some VERY quick notes:::

Start the server first -- sudo powershell-empire server

Then start the client -- sudo powershell-empire client

uselistener http ← the newer version (4.x) will show the options after you complete typing uselistener

info

options ← this has switched to just ‘options’

Set ‘<XXXX>’ seems to work as normal.

A gotcha for me was I had to set the port. Just doing the book and it "failed to validate listener http options"

set Port 80

---->> I did not notice this until later, but in the server window, it was throwing an error saying: "Set the port dammit" (not in so many words ofc.) Next time I will check.

Same as before with the listener, once you set the stager, 'info' will display a few things, but you need 'options' to see all of the things.

It seems 'sysinfo' has been replaced with just 'info'. I like how PS gives you the memory usage and architecture of the process (x86)

A quick Addition:

I made a mistake on my listener, and the only way I could edit it was to disable it first. (Google was not my friend on this.)

listeners --> then "disable http" finally stopped the listener 

A Collection of Fun WMI Things

Playing with MOF files on Windows, for fun & profit
http://poppopret.blogspot.com/2011/09/playing-with-mof-files-on-windows-for.html
"""
What is really interesting with WMI is that it permits to execute some code when the notification of an event occurs. The event might be a program start, an user authentication, ... or any other Windows event. A MOF file needs to be registered into the CIM/WMI repository in order to be taken into account by WMI. When registering a MOF file, the CIM class(es) it describes are indeed added into the repository.
"""
MOF files are compiled into the WMI repository using mofcomp.exe. Moreover, a MOF file that is put in the %SystemRoot%\System32\wbem\mof\ directory is automatically compiled and registered into the WMI repository. It is defined in the registry key HKLM\SOFTWARE\Microsoft\WBEM\CIMOM\.
"""

https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor.pdf

https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf

https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html

https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf

https://files.sans.org/summit/Digital_Forensics_and_Incident_Response_Summit_2015/PDFs/TheresSomethingAboutWMIDevonKerr.pdf

https://www.youtube.com/watch?v=Ldzr0bfGtHc