v6.1.3 into main by vinnybod · Pull Request #791 · BC-SECURITY/Empire

vinnybod · 2025-07-11T03:23:47Z

This PR was automatically generated by the release-public-start workflow.
This PR should be merged with a merge commit, not a squash commit.
Merging this PR will trigger a tag and release automatically.

…tener

Fixed PowerShell agent having base64 encoded Cookie name for HTTP

added & unified usage of -y in apt-get in install script to allow unattended installation

* Added annotations to module yamls * First batch of C# module descriptions updated * a few more * a few more * Fixed misspellings and formatting * fixed accidental formatting of code block in yamls * reverted the C# yamls formatting changes * additional fixes * Improved descriptions for clipboard_monitor and screenshot modules to be LLM-friendly * Update PersistAutorun.yaml * cleaned up formatting mistakes * updated SA bofs * updated more bof descriptions * Updated descriptions for ps lateral modules * Updated descriptions for management modules * updated module descriptions * complete powershell/collection * update powrshell situational awareness modules * updated powershell privesc * updated mimikatz modules * update powrshell exploitation modules * updated powershell management modules * update mailraider modules * updated powershell persistence modules * fixed formatting * reverted yaml changes * reverted lint and test yaml * added new line to lint-and-test * Updated module descriptions * fixed invoke-downloadfile.yaml * fixed formated string mistakes * run yamlfmt --------- Co-authored-by: hubbl3 <Jake,Krasnov@bc-security.org> Co-authored-by: Paul Olushile <paul.olushile@redseersecurity.com> Co-authored-by: Vince Rose <vrose04@gmail.com>

…72cd649f82dd9dd690e19b8014b356776fe389 Cherry-pick 3e72cd6 to private-main

…00d242564ca1f8a1123beb8fc3f57ed2013ec6 Cherry-pick 7600d24 to private-main

…private v6.1.3 into private-main

github-actions · 2025-07-11T03:34:45Z

Coverage Report

File	Stmts	Miss	Cover	Missing
empire/server
server.py	78	53	32%	29–31, 39–45, 52–65, 69–73, 77–82, 86–131
empire/server/api
app.py	112	25	78%	40–42, 46, 51–58, 64–73, 94–100, 162, 165–176
jwt_auth.py	71	10	86%	53, 55, 57, 66, 84, 86–87, 90, 101, 112
middleware.py	12	2	83%	39–40
empire/server/api/v2
shared_dto.py	66	4	94%	12, 78, 94, 100
empire/server/api/v2/admin
admin_api.py	15	1	93%	37
empire/server/api/v2/agent
agent_api.py	51	1	98%	97
agent_file_api.py	35	1	97%	86
agent_task_api.py	158	16	90%	218, 298–299, 330, 339, 357, 373, 393, 411, 429, 449, 469, 485, 500, 516, 522
empire/server/api/v2/download
download_api.py	38	1	97%	64
empire/server/api/v2/listener
listener_api.py	69	4	94%	101, 106, 120, 132
listener_dto.py	51	2	96%	340, 343
listener_template_api.py	20	1	95%	60
empire/server/api/v2/obfuscation
obfuscation_api.py	72	1	99%	161
empire/server/api/v2/plugin
plugin_api.py	78	2	97%	64, 127
plugin_dto.py	45	1	98%	14
plugin_registry_api.py	23	1	96%	23
plugin_task_api.py	44	3	93%	35, 39, 170
empire/server/api/v2/profile
profile_api.py	47	2	96%	74, 90
empire/server/api/v2/stager
stager_dto.py	44	2	95%	248, 251
stager_template_api.py	20	1	95%	57
empire/server/api/v2/tag
tag_api.py	37	1	97%	84
empire/server/api/v2/user
user_api.py	68	5	93%	65, 90–92, 148, 173
empire/server/api/v2/websocket
socketio.py	92	47	49%	34–39, 42–46, 50–62, 66–68, 80–85, 101–106, 123–128, 140–143, 155, 158, 161, 166
empire/server/common
encryption.py	167	93	44%	44, 48, 57–59, 77–81, 96–108, 112–117, 124–125, 134, 136, 152, 164–170, 177–191, 198–202, 209–210, 240, 264–285, 291–306, 312–323, 329, 335, 342, 353–355, 361–375, 381
helpers.py	317	157	50%	76–80, 87–88, 103, 186–187, 227, 234–236, 382–416, 426–552, 573, 580–590, 603–604, 618–626, 632–633, 635–636, 638–639, 662, 674–675, 697–699, 706, 729, 732–734, 737–739
packets.py	112	69	38%	154, 205–242, 250–288, 315–364, 416–419
socks.py	43	30	30%	12–13, 17–19, 25–31, 35–42, 46–57, 60
templating.py	28	7	75%	61–63, 72, 81–83
empire/server/common/malleable
implementation.py	236	26	89%	162, 164, 347, 351, 356, 476–495, 527
profile.py	127	17	87%	103–104, 144–145, 154, 195, 206, 220, 226, 237, 250, 261, 293, 316–319
transaction.py	374	80	79%	167–186, 199, 214–218, 261, 270, 286–290, 294, 304, 353, 404, 430, 441–442, 448, 469–497, 606–612, 631, 644–646, 753–760, 773, 784, 879, 881, 892, 894, 896
transformation.py	373	121	68%	184, 186, 188, 213, 224–225, 227, 235–236, 238, 284, 290, 294, 325–351, 356–396, 404–441, 456, 467–468, 470, 478–479, 481, 683, 685, 687, 689, 699–700, 724–728, 732, 736, 760, 773, 778, 790, 792–794, 796, 811, 813–815, 817, 835–840, 856, 861, 877–884, 900, 905
utility.py	43	13	70%	29, 45–48, 60–66, 120, 128
empire/server/core
agent_communication_service.py	642	466	27%	27, 57, 60, 66, 69–81, 122, 153–154, 168–201, 225, 366–367, 381–383, 390–391, 395–397, 415–754, 770–849, 856–858, 867, 886–889, 902–903, 918, 925–978, 1019–1062, 1068–1077, 1081–1138, 1143–1153, 1158, 1161–1163, 1166–1167, 1172, 1176–1177, 1198–1427, 1432–1446, 1449
agent_file_service.py	23	1	96%	9
agent_service.py	122	10	92%	17, 32, 88, 91, 173, 176, 179, 228, 260–261
agent_socks_service.py	48	22	54%	14, 42, 45–65, 68–69, 73–76
agent_task_service.py	197	23	88%	25, 70–73, 91, 97, 103, 111, 113, 115, 120, 125, 226, 235–236, 248, 250, 280–297
bypass_service.py	64	4	94%	14, 35, 57–58
credential_service.py	52	4	92%	10, 37–38, 46
dotnet.py	50	7	86%	41, 52, 57–58, 99, 104–105
download_service.py	103	16	84%	19, 49, 55, 61, 65, 71–74, 77, 97, 99, 101, 103, 108, 113
go.py	42	12	71%	26–57, 98
hooks.py	67	8	88%	77–79, 88–90, 124, 127
hooks_internal.py	115	66	43%	29, 32, 42–46, 115–145, 155–190, 203–222, 232–256
host_process_service.py	15	1	93%	9
host_service.py	14	1	93%	8
ip_service.py	74	6	92%	14, 57, 108–114
listener_service.py	189	33	83%	17–19, 71, 112, 140–141, 150, 160, 170–172, 195–198, 248–257, 278, 288–290, 293–297, 328–332
listener_template_service.py	51	1	98%	13
module_service.py	479	120	75%	16–17, 46–48, 182, 189–204, 214–217, 233, 237–265, 272–274, 379–381, 394–395, 402, 413, 472–513, 530–566, 591, 616, 618, 697–698, 709–713, 724–726, 744–745, 810, 820, 827, 829, 833, 861, 864, 870, 888–899, 905–906, 916–918, 931, 944, 948–950, 966–970, 1006, 1034
obfuscation_service.py	79	6	92%	15, 94–97, 140–143
plugin_registry_service.py	110	16	85%	16, 34, 69, 75–84, 89–91, 94–97
plugin_service.py	235	25	89%	37, 77, 109, 175–180, 236–246, 284–299, 341, 345
plugin_task_service.py	65	14	78%	15, 49–52, 68, 74, 77, 80, 88, 90, 92, 97, 102
plugins.py	94	10	89%	13–15, 134–136, 139–141, 145
profile_service.py	58	2	97%	12, 79
stager_generation_service.py	333	77	77%	12–13, 23, 51, 88–89, 106, 140–141, 180–182, 196–198, 241–243, 313–315, 326–367, 377–380, 382, 390–391, 430–431, 451–455, 464–465, 504–510, 519–520, 593–594, 603–605, 636–646, 674, 715, 736
stager_service.py	101	9	91%	14–17, 57, 92, 134, 139, 162
stager_template_service.py	55	2	96%	13, 64
tag_service.py	74	18	76%	13, 50, 52, 54, 56, 58, 60, 64–67, 70, 73, 81–84, 89, 92
user_service.py	44	4	91%	9–10, 20, 55
empire/server/core/config
config_manager.py	166	13	92%	184, 191, 199–202, 219–220, 238–242
data_manager.py	39	7	82%	33, 37–38, 42–46
empire/server/core/db
base.py	93	19	80%	28–30, 38–43, 61, 75–84, 159, 166–172
defaults.py	55	2	96%	81, 84
models.py	350	11	97%	165, 325–329, 341, 344, 388, 412, 415, 481, 484
empire/server/listeners
http.py	542	303	44%	227–230, 269, 280, 288–299, 310–313, 334–341, 376, 386–388, 416–419, 425–426, 435–449, 459, 464–469, 507–510, 525–526, 568–574, 582, 590, 592–593, 620, 624, 627–629, 635–638, 653–654, 686, 716, 719–726, 737–738, 771–774, 782–1229
http_foreign.py	168	70	58%	136, 143–148, 170–173, 192–196, 207, 219–221, 228–233, 239–242, 270, 279, 287, 291–294, 318–319, 331–347, 357, 362–367, 370–373, 388–389, 398–399, 407–447, 453, 459
http_hop.py	233	143	39%	94, 101, 123–124, 142–146, 156, 168–170, 177–182, 217, 226, 236, 244–247, 275–276, 285–298, 308, 313–316, 319–322, 337–460, 469–470, 478–518, 526–570, 576
http_malleable.py	627	470	25%	158–159, 186, 234, 241–246, 272–273, 291–297, 353, 363–366, 373–384, 394, 403, 413–418, 425, 453–454, 458, 467–468, 479–495, 532–534, 541, 549, 554–559, 562–565, 580–703, 717–799, 808–1296, 1304–1699
port_forward_pivot.py	366	263	28%	75–76, 82, 104–105, 124–128, 139, 151–152, 159–170, 181–184, 208–216, 232, 241, 251, 255–258, 288–292, 298–299, 311–327, 337–340, 345–348, 351–380, 395–506, 520–608, 617–657, 665–829, 836–926
smb.py	207	181	13%	67–68, 74, 93–220, 235–300, 314–363, 372–406, 414–470, 477
empire/server/modules/bof
clipboard_window_inject.py	23	16	30%	17–52
secinject.py	23	16	30%	17–52
tgtdelegation.py	9	3	67%	16–25
empire/server/modules/bof/situational_awareness
netGroupList.py	7	2	71%	14–21
netGroupListMembers.py	7	2	71%	14–21
netLocalGroupList.py	7	2	71%	14–21
netLocalGroupListMembers.py	7	2	71%	14–21
netloggedon.py	7	2	71%	14–20
netshares.py	7	2	71%	14–20
windowlist.py	7	2	71%	14–19
wmi_query.py	8	3	62%	14–25
empire/server/modules/csharp/code_execution
RunCoff.py	16	8	50%	18–35
empire/server/modules/csharp/management
ProcessInjection.py	50	40	20%	5–6, 24–108
ThreadlessInject.py	43	33	23%	7–8, 27–89
empire/server/modules/powershell/code_execution
invoke_ntsd.py	54	48	11%	15–97
invoke_reflectivepeinjection.py	32	24	25%	19–62
invoke_script.py	14	9	36%	14–30
invoke_shellcode.py	20	3	85%	34–35, 41
invoke_shellcodemsil.py	15	9	40%	16–38
empire/server/modules/powershell/collection
SharpChromium.py	26	16	38%	22–48
WireTap.py	18	10	44%	18–34
get_sql_column_sample_data.py	39	33	15%	15–70
minidump.py	19	11	42%	18–34
packet_capture.py	17	12	29%	14–31
screenshot.py	22	16	27%	16–43
empire/server/modules/powershell/credentials
credential_injection.py	35	25	29%	20–70
tokens.py	29	21	28%	18–65
empire/server/modules/powershell/credentials/mimikatz
dcsync_hashdump.py	21	15	29%	16–42
golden_ticket.py	34	25	26%	21–66
lsadump.py	15	9	40%	16–34
mimitokens.py	34	28	18%	16–58
pth.py	34	25	26%	21–64
silver_ticket.py	39	31	21%	18–73
trust_keys.py	14	8	43%	16–31
empire/server/modules/powershell/exfiltration
PSRansom.py	22	16	27%	17–42
empire/server/modules/powershell/exploitation
exploit_eternalblue.py	17	11	35%	16–37
empire/server/modules/powershell/lateral_movement
inveigh_relay.py	32	26	19%	16–81
invoke_dcom.py	33	27	18%	16–80
invoke_executemsbuild.py	52	45	13%	17–108
invoke_psexec.py	35	29	17%	16–82
invoke_psremoting.py	41	34	17%	17–92
invoke_smbexec.py	37	31	16%	16–88
invoke_sqloscmd.py	44	37	16%	16–80
invoke_sshcommand.py	31	24	23%	17–64
invoke_wmi.py	46	39	15%	17–101
invoke_wmi_debugger.py	57	49	14%	17–157
jenkins_script_console.py	25	18	28%	17–58
new_gpo_immediate_task.py	33	26	21%	17–93
empire/server/modules/powershell/management
invoke_bypass.py	13	7	46%	15–23
logoff.py	10	5	50%	14–21
psinject.py	33	27	18%	16–72
reflective_inject.py	42	34	19%	18–84
runas.py	33	26	21%	17–71
shinject.py	29	22	24%	17–63
spawn.py	26	20	23%	16–68
spawnas.py	44	37	16%	17–72
switch_listener.py	14	8	43%	16–35
user_to_sid.py	7	2	71%	14–18
empire/server/modules/powershell/management/mailraider
disable_security.py	23	17	26%	15–59
get_emailitems.py	16	10	38%	15–39
empire/server/modules/powershell/persistence/elevated
registry.py	64	56	12%	19–157
schtasks.py	78	70	10%	19–197
wmi.py	87	79	9%	19–251
wmi_updater.py	73	65	11%	19–213
empire/server/modules/powershell/persistence/misc
add_sid_history.py	15	9	40%	16–33
debugger.py	35	29	17%	16–108
empire/server/modules/powershell/persistence/powerbreach
deaduser.py	37	29	22%	18–138
eventlog.py	34	26	24%	18–115
resolver.py	37	29	22%	18–124
empire/server/modules/powershell/persistence/userland
backdoor_lnk.py	48	40	17%	19–112
registry.py	74	66	11%	19–197
schtasks.py	75	67	11%	19–190
empire/server/modules/powershell/privesc
ask.py	20	14	30%	16–61
bypassuac.py	22	16	27%	16–54
bypassuac_env.py	23	17	26%	16–54
bypassuac_eventvwr.py	23	17	26%	16–55
bypassuac_fodhelper.py	23	17	26%	16–55
bypassuac_sdctlbypass.py	23	17	26%	16–55
bypassuac_tokenmanipulation.py	28	20	29%	19–57
bypassuac_wscript.py	22	16	27%	16–54
ms16-032.py	18	12	33%	16–46
ms16-135.py	18	12	33%	16–46
empire/server/modules/powershell/privesc/powerup
service_exe_stager.py	30	24	20%	16–61
service_stager.py	25	19	24%	16–52
write_dllhijacker.py	26	20	23%	16–67
empire/server/modules/powershell/recon
fetch_brute_local.py	25	19	24%	15–42
find_fruit.py	22	16	27%	16–57
get_sql_server_login_default_pw.py	22	17	23%	14–44
empire/server/modules/powershell/situational_awareness/host
computerdetails.py	46	40	13%	16–104
empire/server/modules/powershell/situational_awareness/network
get_sql_server_info.py	29	24	17%	14–58
empire/server/modules/powershell/situational_awareness/network/powerview
get_gpo_computer.py	38	31	18%	18–95
get_subnet_ranges.py	35	28	20%	17–78
empire/server/modules/python/code_execution
invoke_script.py	16	11	31%	14–31
empire/server/modules/python/collection/osx
imessage_dump.py	15	10	33%	14–176
native_screenshot_mss.py	11	5	55%	16–20
prompt.py	14	9	36%	14–43
search_email.py	12	1	92%	19
sniffer.py	23	18	22%	14–151
empire/server/modules/python/lateral_movement/multi
ssh_launcher.py	17	11	35%	15–32
empire/server/modules/python/management/multi
spawn.py	13	7	46%	16–28
empire/server/modules/python/management/osx
shellcodeinject64.py	17	9	47%	18–136
empire/server/modules/python/persistence/multi
desktopfile.py	13	8	38%	14–29
empire/server/modules/python/persistence/osx
CreateHijacker.py	19	13	32%	22–43
LaunchAgent.py	20	14	30%	16–52
LaunchAgentUserLandPersistence.py	15	10	33%	14–46
loginhook.py	12	7	42%	14–20
mail.py	29	21	28%	18–131
empire/server/modules/python/privesc/multi
CVE-2021-3560.py	16	9	44%	18–41
CVE-2021-4034.py	21	13	38%	19–47
bashdoor.py	11	6	45%	15–27
sudo_spawn.py	18	12	33%	16–37
empire/server/modules/python/privesc/osx
dyld_print_to_file.py	17	10	41%	24–39
piggyback.py	17	11	35%	16–35
empire/server/modules/python/situational_awareness/host/osx
situational_awareness.py	14	9	36%	14–196
empire/server/plugins/basic_reporting
basic_reporting.py	67	1	99%	114
empire/server/plugins/example
example.py	35	35	0%	3–110
empire/server/stagers/linux
bash.py	22	14	36%	61–84
pyinstaller.py	49	5	90%	92–94, 104–105
empire/server/stagers/multi
generate_agent.py	37	29	22%	90–138
go_exe.py	11	5	55%	51–57
launcher.py	39	10	74%	122–130, 138–146, 169–170
macro.py	51	41	20%	120–196
empire/server/stagers/osx
applescript.py	18	10	44%	62–81
application.py	24	16	33%	73–96
ducky.py	25	18	28%	60–88
dylib.py	26	17	35%	73–98
jar.py	17	10	41%	54–72
macho.py	17	10	41%	60–80
macro.py	39	31	21%	85–182
safari_launcher.py	22	15	32%	67–92
shellcode.py	23	16	30%	68–157
teensy.py	76	69	9%	61–143
empire/server/stagers/windows
bunny.py	48	39	19%	107–176
cmd_exec.py	45	34	24%	104–161, 164–174
csharp_exe.py	47	16	66%	120, 125–130, 146, 148, 151–155, 160–168
dll.py	40	11	72%	107–108, 112, 115–118, 121–132, 156–157
ducky.py	42	34	19%	94–161
hta.py	37	29	22%	86–145
launcher_bat.py	51	9	82%	90–91, 110, 125–135, 145–146
launcher_vbs.py	34	26	24%	82–138
launcher_xml.py	83	75	10%	82–191
macro.py	79	19	76%	159, 163, 166–177, 200–201, 227–239
shellcode.py	56	45	20%	5–6, 107–180
teensy.py	113	105	7%	82–218
war.py	44	34	23%	85–170
wmic.py	42	34	19%	93–156
empire/server/utils
bof_packer.py	49	11	78%	27–28, 51–53, 56, 62–63, 65, 69, 75
data_util.py	46	8	83%	34–43, 56–57, 59
file_util.py	22	2	91%	50, 52
git_util.py	22	2	91%	37–38
listener_util.py	28	4	86%	97–108
log_util.py	58	1	98%	44
math_util.py	5	3	40%	9–11
option_util.py	104	18	83%	26, 178–192, 201–209, 219
string_util.py	15	1	93%	26
TOTAL	15394	6501	58%

Tests	Skipped	Failures	Errors	Time
494	0 💤	0 ❌	0 🔥	4m 37s ⏱️

Cx01N and others added 10 commits May 27, 2025 14:30

Fixed PowerShell agent having base64 encoded Cookie name for HTTP lis…

1ff6361

…tener

Merge pull request EmpireProject#1054 from BC-SECURITY/cookie_fix

39de3ad

Fixed PowerShell agent having base64 encoded Cookie name for HTTP

Update install.sh (#788)

24aa66d

added & unified usage of -y in apt-get in install script to allow unattended installation

Merge pull request EmpireProject#1057 from BC-SECURITY/cherry-pick-3e…

a53d092

…72cd649f82dd9dd690e19b8014b356776fe389 Cherry-pick 3e72cd6 to private-main

Merge pull request EmpireProject#1056 from BC-SECURITY/cherry-pick-76…

a812cc0

…00d242564ca1f8a1123beb8fc3f57ed2013ec6 Cherry-pick 7600d24 to private-main

Prepare release 6.1.3 private

fa4580c

Merge pull request EmpireProject#1058 from BC-SECURITY/release/6.1.3-…

973ef9f

…private v6.1.3 into private-main

Update starkiller version to v3.0.1

5d2c66c

Merge branch 'main' into release/6.1.3

96e0a7b

vinnybod commented Jul 11, 2025

View reviewed changes

Comment thread CHANGELOG.md

Update CHANGELOG.md

643db0f

vinnybod merged commit fcb544e into main Jul 11, 2025
4 checks passed

vinnybod deleted the release/6.1.3 branch July 11, 2025 03:33

Navigation Menu

Uh oh!

Uh oh!

v6.1.3 into main - #791

v6.1.3 into main#791
vinnybod merged 11 commits into
mainfrom
release/6.1.3

vinnybod commented Jul 11, 2025

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

vinnybod commented Jul 11, 2025

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants