v6.5.0 into main by vinnybod · Pull Request #818 · BC-SECURITY/Empire

vinnybod · 2026-04-05T17:40:56Z

This PR was automatically generated by the release-public-start workflow.
This PR should be merged with a merge commit, not a squash commit.
Merging this PR will trigger a tag and release automatically.

The SSH agent setup step was conditional on the sponsors repo, but the Docker builds unconditionally require SSH_AUTH_SOCK to be set. Start the SSH agent on both repos - private keys are only loaded when the CI_SSH_KEY_BOT secret is available. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

)

…ect#1143) Pre-load all existing Module records into a dict before the module loading loop, replacing 435 individual SELECT queries with a single bulk query. Reduces startup time by ~4 seconds. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

…icit (EmpireProject#1155)

Notable upgrades: - cryptography 45.x -> 46.x (removed deprecated default_backend()) - bcrypt 4.x -> 5.x - fastapi 0.116 -> 0.129 (Starlette 0.52 adds allow_private_network to CORSMiddleware) - ruff 0.12 -> 0.15 (fix 63 new lint violations from stabilized rules) - pytest 8.x -> 9.x - pytest-cov 6.x -> 7.x - uvicorn 0.35 -> 0.41 - packaging 25.x -> 26.x - requests-file 2.x -> 3.x - aiofiles 24.x -> 25.x Breaking change fixes: - Remove deprecated default_backend() from encryption.py (cryptography) - Fix CORSMiddleware positional args for new allow_private_network param (Starlette) - Migrate (str, Enum) to StrEnum (ruff UP042) - Fix unused unpacked variables (ruff RUF059) - Fix single-item membership tests (ruff FURB171) - Fix ternary expressions (ruff FURB110) - Apply ruff 2026 formatter style guide Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

… listener utils (EmpireProject#1158)

…ependency upgrade (EmpireProject#1157) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…y-pick-ubuntu-docs

…mpireProject#1160)

…ors (#716) (EmpireProject#1161)

…oject#1162)

* Fix MITRE ATT&CK tagging in PowerShell modules Correct malformed technique IDs (T11082→T1082, T1555.03→T1555.003, T11638→T1040), replace deprecated techniques (T1076→T1021.001, T1933 removed, T1101.005→T1547.005), fix malformed tactic strings, add missing software fields (S0521 for BloodHound/SharpHound, S0002 for Mimikatz), add missing tactics to modules that had none, and resolve technique-to-tactic inconsistencies across 63 modules. Validated against MITRE ATT&CK Enterprise STIX data. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Fix MITRE ATT&CK tagging in Python modules Add missing tactics field to 80 Python modules (macOS collection, Linux persistence/privesc, DCOS, AD discovery) that had no tactic tags. Fix wrong software field (T1169→empty) on sudo_spawn and piggyback modules. Resolve technique-to-tactic inconsistencies. Tactics derived from MITRE ATT&CK Enterprise STIX technique→tactic mappings and module directory categorization. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Fix MITRE ATT&CK tagging in C# modules Correct malformed technique IDs (T1557.0001→T1557.001, T1558.0003→T1558.003, T1555.03→T1555.003, T11082→T1082), fix malformed tactic string on SharpSC, replace deprecated techniques (T1076→T1021.001, T1933 removed), add missing software field (S1071 for Rubeus), add missing tactics to Spawn module, and resolve technique-to-tactic inconsistencies across 15 modules. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Fix MITRE ATT&CK tagging in BOF modules Add missing tactics for technique-to-tactic consistency across 12 BOF modules. Ensures all listed techniques map to at least one tactic the module declares. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Update CHANGELOG and module development docs for MITRE ATT&CK audit Add changelog entry documenting the ATT&CK tagging audit and fixes across all 439 modules. Update the module development guide to include a MITRE ATT&CK Fields section with proper formatting guidance, and fix the YAML example to use real tactic/technique IDs instead of empty placeholders. Ultraworked with [Sisyphus] Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Fix MITRE ATT&CK technique assignments in PowerShell modules Remove incorrect T1482 (Domain Trust Discovery) from 19 modules that enumerate users, groups, computers, or network shares — not domain trusts. Remove incorrect T1615 (Group Policy Discovery) from 3 modules unrelated to GPO enumeration. Add missing T1049 (System Network Connections Discovery) to session enumeration modules. Fix T1514 removal in powershell_template and correct edge-case technique assignments for sessiongopher, honeyhash, and smbautobrute. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Fix MITRE ATT&CK technique assignments in Python modules Replace 27 deprecated technique IDs predating ATT&CK v10 with current equivalents: T1141→T1056.002, T1142→T1555.001, T1156→T1546.004, T1165→T1037.005, T1166→T1548.001, T1168→T1053.003, T1208→T1558.003, T1081→T1552.001, T1139→T1552.003, T1155→T1059.002, T1157→T1574.004. Remove Mobile ATT&CK IDs (T1414, T1426) and invalid IDs (T1256, T1156.001, T1081.001). Remove incorrect T1482 from 12 AD enumeration modules. Replace T1106 (Native API) with T1059.006 (Python) on 5 DCOS REST API modules. Remove T1514 from python_template. Fix edge cases in SuidGuidSearch, HijackScanner, etcd_crawler, mail, and prompt modules. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Fix MITRE ATT&CK technique assignments in C# modules Remove incorrect T1482 (Domain Trust Discovery) from Rubeus, Certify, and 5 SharpSploit enumeration modules that query users, groups, computers, or local groups — not domain trusts. Add missing T1049 (System Network Connections Discovery) to GetNetSession. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Fix MITRE ATT&CK technique assignments in BOF modules Remove incorrect T1482 (Domain Trust Discovery) from 3 ADCS enumeration modules that query certificate templates and CAs — not domain trusts. Replace with T1069.002 (Domain Groups) which better describes their certificate-related AD enumeration. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Update CHANGELOG for MITRE ATT&CK technique audit Add 5 entries documenting round 2 of the ATT&CK audit: deprecated ID replacements, T1482/T1615 over-tagging removal, T1106 DCOS correction, and missing technique additions. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Enrich MITRE ATT&CK technique tags across 53 modules Corrected 10 wrong technique assignments (e.g. LaunchAgent T1055→T1543.001, screensaver T1113→T1056.002, DownloadFile T1041→T1105), upgraded 6 parent techniques to specific sub-techniques, added T1105 to 12 lateral movement modules, and enriched 33 existing technique tags across PowerShell, Python, and C# modules. Net coverage: 181→190 unique techniques (+10 new IDs). Fixed 2 pre-existing duplicate technique entries in RevertToSelf and NetRipper. Ultraworked with [Sisyphus] Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> --------- Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

…y-pick-backgroundjob-bugfix Cherry-pick: Backgroundjob bugfix (#807)

@Cx01N

* Add Sprint 1 modules: PatchETW, PatchlessAMSI, CredentialPrompt, VSSExtract, RDPHijack, linux_keyring, aws_imds Add 7 new post-exploitation modules across C#, PowerShell, and Python: - C# PatchETW: in-process ETW patching via ntdll!EtwEventWrite - C# PatchlessAMSI: patchless AMSI bypass using hardware breakpoints and VEH - PowerShell Invoke-CredentialPrompt: credential harvesting via Windows CredUI - PowerShell Invoke-VSSExtract: NTDS.dit/SYSTEM hive extraction via VSS - PowerShell Invoke-RDPHijack: RDP session hijacking via tscon.exe - Python linux_keyring: Linux kernel keyring credential extraction - Python aws_imds: AWS IAM role credential theft via EC2 IMDS All modules authored by Anthony Rose (@Cx01N) with source citations. MITRE ATT&CK techniques mapped for each module. Ultraworked with [Sisyphus] Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Fix runtime errors in Sprint 1 modules - Remove redundant Invoke-CredentialPrompt (SharpLoginPrompt already exists) - Fix VSSExtract CleanupShadow: [String] to [Switch] for Empire PARAMS compatibility - Fix RDPHijack ListSessions: [String] to [Switch] for Empire PARAMS compatibility - Fix RDPHijack query user handling: remove unreliable $LASTEXITCODE check, pipe through Out-String - Fix linux_keyring: replace raise SystemExit(0) with function wrapper and return (was killing agent) - Remove CHANGELOG entry for removed CredentialPrompt module Empire module_service formats True/False option values as PowerShell switches, not string arguments. All boolean-like options must use [Switch] type. Ultraworked with [Sisyphus] Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> --------- Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

…es (EmpireProject#1170) * Add PIC shellcode compiler, refactor bof_packer to Packer class, and update BOF modules Add shellcode_compiler utility for compiling position-independent C stagers into raw x64 shellcode for BOF process injection. Refactor bof_packer from standalone functions to a Packer class with granular packing methods. Rewrite clipboard_window_inject to use PIC shellcode instead of PowerShell launcher, add clipboard_window_inject_list module, remove secinject module, and bump Empire Compiler to v0.4.4. Update test_bof_packer to cover the new Packer class API (32 tests), add test_shellcode_compiler for _string_to_wchar_initializer (13 tests), and bump stager template count in test_stager_api. * fixed test_stager_api

…ireProject#1171) Replace random URI generation in Stager._defaults() with a deterministic fallback so profiles without an http-stager block get a consistent URI across server restarts. Update launcher generation test to match.

…nts (EmpireProject#1176) * Add format_bof_output() and pass agent_language to custom-generate BOF modules Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Fix custom-generate BOF modules to use format_bof_output() for Go agent support Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * Add tests for BOF Go agent format and update changelog Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * updated generate for bofs with consistent functions --------- Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

…private v6.5.0 into private-main

Resolve merge conflicts: - CHANGELOG.md: keep full 6.5.0 release notes, incorporate main's backfilled Starkiller entries - docs/modules/module-development/README.md: keep MITRE ATT&CK Fields section from release - empire/server/config.yaml: use Starkiller v3.4.0 from release, keep public plugin registry from main Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-04-05T18:00:22Z

Coverage Report

File	Stmts	Miss	Cover	Missing
empire/server
server.py	100	71	29%	30–32, 36, 44–50, 63–80, 84, 88–101, 105–109, 113–118, 122–177
empire/server/api
app.py	117	26	78%	41–43, 47, 52–59, 65–74, 95–101, 162, 168, 171–182
jwt_auth.py	85	10	88%	56, 58, 60, 69, 107, 111–113, 116, 135, 146
middleware.py	12	2	83%	41–42
empire/server/api/v2
shared_dto.py	48	2	96%	91, 97
empire/server/api/v2/admin
admin_api.py	17	1	94%	40
empire/server/api/v2/agent
agent_api.py	54	1	98%	104
agent_file_api.py	40	1	98%	102
agent_task_api.py	169	16	91%	236, 332–333, 364, 373, 391, 407, 427, 445, 463, 483, 503, 519, 534, 550, 556
empire/server/api/v2/listener
listener_api.py	72	4	94%	109, 114, 128, 140
listener_dto.py	26	2	92%	332, 335
listener_template_api.py	22	1	95%	63
empire/server/api/v2/obfuscation
obfuscation_api.py	77	1	99%	177
empire/server/api/v2/plugin
plugin_api.py	79	2	97%	68, 128
plugin_registry_api.py	25	1	96%	30
plugin_task_api.py	54	2	96%	45, 199
empire/server/api/v2/profile
profile_api.py	50	2	96%	80, 96
empire/server/api/v2/stager
stager_dto.py	24	2	92%	248, 251
stager_template_api.py	22	1	95%	60
empire/server/api/v2/tag
tag_api.py	40	1	98%	88
empire/server/api/v2/user
user_api.py	72	3	96%	73, 154, 179
empire/server/api/v2/websocket
socketio.py	92	46	50%	34–39, 42–46, 50–62, 66–68, 80–85, 101–106, 123–128, 140–143, 155, 161, 166
empire/server/common
encryption.py	245	12	95%	32, 183–184, 197–199, 246–247, 353–355, 416–417
helpers.py	305	107	65%	229, 236–238, 385, 390, 394–408, 416, 428–554, 592, 605–606, 686–688, 718, 721–723, 726–728
packets.py	114	11	90%	221, 227–235, 350, 367–371, 391
socks.py	43	30	30%	12–13, 17–19, 25–31, 35–42, 46–57, 60
templating.py	28	7	75%	61–63, 72, 81–83
empire/server/common/malleable
implementation.py	231	29	87%	159, 161, 344, 348, 353, 472–491, 523, 553–555
profile.py	127	17	87%	103–104, 144–145, 154, 195, 206, 220, 226, 237, 250, 261, 293, 316–319
transaction.py	374	80	79%	167–186, 199, 214–218, 261, 270, 286–290, 294, 304, 353, 404, 430, 441–442, 448, 469–497, 606–612, 631, 644–646, 753–760, 773, 784, 879, 881, 892, 894, 896
transformation.py	373	59	84%	213, 224–225, 227, 235–236, 238, 284, 290, 294, 326–327, 330, 337, 371, 377, 386–387, 390, 396, 419, 425, 435, 441, 456, 467–468, 470, 478–479, 481, 683, 685, 687, 689, 699–700, 724–728, 732, 736, 760, 773, 793, 796, 811, 813–815, 817, 836, 856, 861, 878, 900, 905
utility.py	43	13	70%	29, 45–48, 60–66, 120, 128
empire/server/core
agent_communication_service.py	671	467	30%	58, 61, 67, 90–91, 160–161, 185, 189, 226, 367–368, 382–384, 391–392, 396–398, 419–845, 865–952, 959–961, 971, 999–1002, 1027–1073, 1114–1157, 1163–1172, 1176–1236, 1241–1251, 1256, 1259–1261, 1264–1265, 1270, 1274–1275, 1296–1524, 1529–1543, 1546
agent_service.py	121	9	93%	33, 88, 91, 173, 176, 179, 228, 260–261
agent_socks_service.py	46	21	54%	42, 45–65, 68–69, 73–76
agent_task_service.py	195	22	89%	70–73, 91, 97, 103, 111, 113, 115, 120, 125, 235, 244–245, 257, 259, 289–306
bypass_service.py	70	4	94%	38, 73–74, 80
credential_service.py	50	3	94%	37–38, 46
dotnet.py	50	7	86%	41, 52, 57–58, 99, 104–105
download_service.py	101	15	85%	49, 55, 61, 65, 71–74, 77, 97, 99, 101, 103, 108, 113
go.py	42	12	71%	26–57, 98
hooks.py	84	9	89%	22, 135–137, 146–148, 188, 191
hooks_internal.py	106	48	55%	40, 43, 53–57, 126–152, 162–193, 206–221, 231–251
ip_service.py	72	3	96%	57, 113–114
listener_service.py	167	21	87%	72, 113, 143–144, 153, 163, 173–175, 184–185, 204–207, 224, 230–231, 291–295
module_service.py	491	95	81%	16–17, 186, 193–208, 218–221, 237, 241, 246–253, 255–258, 261–269, 387–389, 410, 421, 522, 555, 578–613, 638, 663, 665, 740–741, 752–756, 767–769, 792–793, 863, 873, 880, 882, 886, 919, 922, 928, 946–957, 963–964, 974–976, 989, 1002, 1006–1008, 1024–1028, 1064, 1092
obfuscation_service.py	77	5	94%	94–97, 140–143
plugin_registry_service.py	98	9	91%	34, 69, 77–78, 83–85, 88–91
plugin_service.py	231	24	90%	77, 109, 175–180, 238–248, 286–301, 343, 347
plugin_task_service.py	63	13	79%	49–52, 68, 74, 77, 80, 88, 90, 92, 97, 102
plugins.py	84	7	92%	130–132, 135–137, 141
profile_service.py	55	1	98%	78
stager_generation_service.py	367	83	77%	12–13, 32, 59, 96–97, 114, 142–143, 176–178, 192–194, 250–252, 303, 309, 343–345, 365–367, 374, 386, 417, 428, 435–440, 447–487, 496–499, 501, 509–510, 549–550, 564, 571–572, 612–613, 619–620, 692–693, 725–735, 764, 787, 807
stager_service.py	94	5	95%	57, 92, 134, 139, 162
stager_template_service.py	52	1	98%	63
tag_service.py	72	17	76%	50, 52, 54, 56, 58, 60, 64–67, 70, 73, 81–84, 89, 92
user_service.py	41	1	98%	55
empire/server/core/config
config_manager.py	192	12	94%	218, 221, 268, 284, 297–298, 302–303, 320–321, 334–335
data_manager.py	72	17	76%	34, 38–39, 43–47, 112–126
empire/server/core/db
base.py	99	22	78%	29–31, 39–44, 62, 77–80, 89–98, 171, 178–184
defaults.py	55	2	96%	80, 83
models.py	352	11	97%	165, 326–330, 342, 345, 389, 413, 416, 483, 486
empire/server/listeners
http.py	539	295	45%	230–233, 263, 274, 282–293, 316–323, 356, 366–368, 396–399, 405–406, 415–429, 439, 444–449, 505–508, 523–524, 584–590, 595, 600, 627, 630, 634–637, 652–653, 684, 714, 717–724, 733–734, 773–776, 808–1271
http_foreign.py	163	72	56%	130, 137–147, 169–172, 185–189, 200, 212–214, 221–226, 232–235, 257, 266, 274, 278–281, 305–306, 318–334, 344, 349–354, 357–360, 375–376, 385–386, 394–430, 436, 442
http_hop.py	220	131	40%	95, 102, 124–125, 139–143, 153, 165–167, 174–179, 211, 220, 230, 238–241, 270–271, 280–293, 303, 308–311, 314–317, 332–459, 468–469, 477–521, 529–564, 570
http_malleable.py	646	463	28%	178, 223, 265–270, 296–297, 315–321, 374, 384–387, 394–405, 415, 424, 434–439, 446, 471–472, 476, 485–486, 497–513, 550–552, 559, 567, 572–577, 580–583, 598–736, 750–833, 842–1313, 1344–1776
port_forward_pivot.py	332	236	29%	75–76, 82, 104–105, 117–121, 132, 144–145, 152–163, 191–199, 215, 224, 234, 238–241, 271–275, 281–282, 294–310, 320–323, 328–331, 334–363, 378–476, 490–579, 588–624, 632–777, 784–874
smb.py	193	167	13%	66–67, 73, 92–217, 232–286, 300–348, 357–386, 394–450, 457
empire/server/modules/bof/credentials
tgtdelegation.py	9	3	67%	17–26
empire/server/modules/bof/management
clipboard_window_inject.py	20	12	40%	19–34
spawn.py	20	12	40%	19–34
empire/server/modules/bof/situational_awareness
netGroupList.py	7	2	71%	15–22
netGroupListMembers.py	7	2	71%	15–22
netLocalGroupList.py	7	2	71%	15–22
netLocalGroupListMembers.py	7	2	71%	15–22
netloggedon.py	7	2	71%	15–21
netshares.py	7	2	71%	15–21
windowlist.py	7	2	71%	15–20
wmi_query.py	8	3	62%	15–26
empire/server/modules/csharp/code_execution
RunCoff.py	16	8	50%	18–35
empire/server/modules/csharp/management
ProcessInjection.py	50	40	20%	5–6, 24–108
Spawn.py	37	27	27%	23–101
ThreadlessInject.py	43	33	23%	7–8, 27–89
empire/server/modules/powershell/code_execution
invoke_ntsd.py	52	43	17%	19–88
invoke_reflectivepeinjection.py	34	22	35%	23–59
invoke_script.py	16	8	50%	18–28
invoke_shellcode.py	22	3	86%	31–32, 38
invoke_shellcodemsil.py	14	6	57%	18–31
empire/server/modules/powershell/credentials
credential_injection.py	35	25	29%	20–70
tokens.py	29	21	28%	18–65
empire/server/modules/powershell/credentials/mimikatz
dcsync_hashdump.py	20	12	40%	18–35
golden_ticket.py	34	22	35%	25–60
lsadump.py	14	6	57%	18–27
mimitokens.py	34	25	26%	19–52
pth.py	34	22	35%	25–58
silver_ticket.py	39	28	28%	22–67
trust_keys.py	13	5	62%	18–24
empire/server/modules/powershell/exfiltration
PSRansom.py	21	13	38%	18–34
empire/server/modules/powershell/exploitation
exploit_eternalblue.py	16	8	50%	18–30
empire/server/modules/powershell/lateral_movement
inveigh_relay.py	32	23	28%	20–77
invoke_dcom.py	33	24	27%	20–74
invoke_executemsbuild.py	52	42	19%	21–102
invoke_psexec.py	46	37	20%	20–114
invoke_psremoting.py	41	34	17%	17–92
invoke_smbexec.py	37	28	24%	20–82
invoke_sqloscmd.py	44	34	23%	20–76
invoke_sshcommand.py	31	21	32%	20–58
invoke_wmi.py	46	39	15%	17–101
invoke_wmi_debugger.py	57	49	14%	17–159
jenkins_script_console.py	25	15	40%	21–52
new_gpo_immediate_task.py	33	23	30%	21–87
empire/server/modules/powershell/management
invoke_bypass.py	13	7	46%	15–23
logoff.py	10	5	50%	14–21
psinject.py	33	24	27%	20–66
reflective_inject.py	42	31	26%	22–78
runas.py	33	23	30%	20–65
shinject.py	29	19	34%	21–57
spawn.py	28	22	21%	15–73
spawnas.py	44	34	23%	21–64
switch_listener.py	14	8	43%	16–35
user_to_sid.py	7	2	71%	14–18
empire/server/modules/powershell/management/mailraider
disable_security.py	22	14	36%	18–52
get_emailitems.py	15	7	53%	18–32
empire/server/modules/powershell/persistence/elevated
registry.py	64	56	12%	19–157
schtasks.py	78	70	10%	19–197
wmi.py	87	79	9%	19–253
wmi_updater.py	73	65	11%	19–215
empire/server/modules/powershell/persistence/misc
add_sid_history.py	14	6	57%	19–26
debugger.py	35	29	17%	16–110
empire/server/modules/powershell/persistence/powerbreach
deaduser.py	36	28	22%	18–133
eventlog.py	33	25	24%	18–110
resolver.py	36	28	22%	18–119
empire/server/modules/powershell/persistence/userland
backdoor_lnk.py	48	37	23%	23–110
registry.py	74	66	11%	19–197
schtasks.py	75	67	11%	19–190
empire/server/modules/powershell/privesc
ask.py	20	14	30%	16–61
bypassuac.py	22	13	41%	20–48
bypassuac_env.py	23	14	39%	20–48
bypassuac_eventvwr.py	23	14	39%	20–49
bypassuac_fodhelper.py	37	28	24%	19–83
bypassuac_sdctlbypass.py	23	14	39%	20–49
bypassuac_tokenmanipulation.py	27	17	37%	22–50
bypassuac_wscript.py	22	13	41%	20–48
ms16-032.py	17	9	47%	19–39
ms16-135.py	17	9	47%	19–39
empire/server/modules/powershell/privesc/powerup
service_exe_stager.py	30	21	30%	19–55
service_stager.py	25	16	36%	20–46
write_dllhijacker.py	26	17	35%	20–61
empire/server/modules/powershell/situational_awareness/host
SharpChromium.py	26	16	38%	22–48
WireTap.py	18	10	44%	18–34
computerdetails.py	45	37	18%	18–72
fetch_brute_local.py	24	16	33%	18–35
find_fruit.py	21	13	38%	18–50
get_sql_column_sample_data.py	36	30	17%	15–67
minidump.py	19	11	42%	18–34
packet_capture.py	17	12	29%	14–31
screenshot.py	21	13	38%	18–36
empire/server/modules/powershell/situational_awareness/network
get_sql_server_info.py	29	24	17%	14–58
get_sql_server_login_default_pw.py	22	17	23%	14–44
empire/server/modules/powershell/situational_awareness/network/powerview
get_gpo_computer.py	37	30	19%	18–94
get_subnet_ranges.py	34	27	21%	17–77
empire/server/modules/python/code_execution
invoke_script.py	17	10	41%	17–30
empire/server/modules/python/collection/osx
imessage_dump.py	15	10	33%	14–176
native_screenshot_mss.py	10	4	60%	16–19
prompt.py	14	9	36%	14–43
search_email.py	12	1	92%	19
sniffer.py	23	18	22%	14–151
empire/server/modules/python/lateral_movement/multi
ssh_launcher.py	17	11	35%	15–32
empire/server/modules/python/management/multi
spawn.py	13	7	46%	16–28
empire/server/modules/python/management/osx
shellcodeinject64.py	17	9	47%	18–136
empire/server/modules/python/persistence/multi
desktopfile.py	13	8	38%	14–29
empire/server/modules/python/persistence/osx
CreateHijacker.py	19	13	32%	22–43
LaunchAgent.py	20	14	30%	16–52
LaunchAgentUserLandPersistence.py	15	10	33%	14–46
loginhook.py	12	7	42%	14–20
mail.py	29	21	28%	18–131
empire/server/modules/python/privesc/multi
CVE-2021-3560.py	17	8	53%	21–37
CVE-2021-4034.py	22	12	45%	22–43
bashdoor.py	11	6	45%	15–27
sudo_spawn.py	18	12	33%	16–37
empire/server/modules/python/privesc/osx
dyld_print_to_file.py	17	10	41%	24–39
piggyback.py	17	11	35%	16–35
empire/server/modules/python/situational_awareness/host/osx
situational_awareness.py	14	9	36%	14–196
empire/server/plugins/basic_reporting
basic_reporting.py	68	1	99%	116
empire/server/plugins/example
example.py	35	35	0%	3–110
empire/server/stagers/linux
bash.py	22	14	36%	61–84
pyinstaller.py	48	5	90%	91–93, 103–104
empire/server/stagers/multi
generate_agent.py	37	10	73%	121–122, 124–125, 128–136
go_exe.py	11	4	64%	54–58
launcher.py	41	11	73%	122–130, 138, 147–155, 178–179
macro.py	51	41	20%	120–196
empire/server/stagers/osx
applescript.py	18	10	44%	62–81
application.py	24	16	33%	73–96
ducky.py	25	18	28%	60–88
dylib.py	26	17	35%	73–98
jar.py	17	10	41%	54–72
macho.py	17	10	41%	60–80
macro.py	39	31	21%	85–182
safari_launcher.py	22	15	32%	67–92
shellcode.py	23	16	30%	68–157
teensy.py	76	69	9%	61–143
empire/server/stagers/windows
bunny.py	48	39	19%	107–176
c_launcher.py	59	11	81%	59–60, 63–64, 97–98, 136–138, 142–143
cmd_exec.py	45	34	24%	104–161, 164–174
csharp_exe.py	45	14	69%	120, 125–130, 146, 148, 151–154, 159–165
dll.py	40	11	72%	107–108, 112, 115–118, 121–132, 156–157
ducky.py	42	34	19%	94–161
hta.py	37	29	22%	86–145
launcher_bat.py	42	11	74%	85–86, 99–118, 128–129
launcher_vbs.py	34	26	24%	82–138
launcher_xml.py	83	75	10%	82–191
macro.py	79	19	76%	159, 163, 166–177, 200–201, 227–239
shellcode.py	56	45	20%	5–6, 107–180
shellcode_launcher.py	17	8	53%	50–59
teensy.py	113	105	7%	82–218
war.py	44	34	23%	85–170
wmic.py	42	34	19%	93–156
empire/server/utils
data_util.py	52	13	75%	34–43, 47–56, 69–70, 72
file_util.py	24	3	88%	33, 55, 57
git_util.py	22	2	91%	37–38
math_util.py	5	1	80%	11
option_util.py	104	16	85%	26, 178–192, 203–209, 219
shellcode_compiler.py	75	56	25%	64–114, 123–187
string_util.py	15	1	93%	26
TOTAL	15542	6064	61%

Tests	Skipped	Failures	Errors	Time
743	2 💤	0 ❌	0 🔥	4m 12s ⏱️

vinnybod and others added 30 commits February 16, 2026 10:39

Added C stager (EmpireProject#1136)

1057619

Optimize test suite to reduce CI and local run times (EmpireProject#1141

4585cb4

)

Modernize Python patterns in core code (EmpireProject#1146)

897691a

Replace os.path with pathlib in core code (EmpireProject#1147)

c562f78

Replace os.path with pathlib in listener files (EmpireProject#1150)

10d8445

Pathlib migration follow-ups (EmpireProject#1156)

bc16e19

Optimize test fixtures: reduce boilerplate and make dependencies expl…

8c496d6

…icit (EmpireProject#1155)

Add unit tests for encryption, packets, helpers, transformations, and…

f4038af

… listener utils (EmpireProject#1158)

docs: Specify Ubuntu in the relevant installation documentation. (#811)

da559df

Add missing changelog entries for C stager (EmpireProject#1136) and d…

3a9f0c3

…ependency upgrade (EmpireProject#1157) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Apply suggestion from @vinnybod

d13ddd8

Move Ubuntu docs fix changelog entry to Unreleased section

26383a5

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Merge pull request EmpireProject#1159 from BC-SECURITY/vinnybod/cherr…

94c0e12

…y-pick-ubuntu-docs

Replace handle_error_message with raised exceptions in all modules (E…

22eb368

…mpireProject#1160)

Convert 51 modules to use @auto_get_source and @auto_finalize decorat…

029c34c

…ors (#716) (EmpireProject#1161)

Replace unmaintained terminaltables with prettytable (#809) (EmpirePr…

9e5b340

…oject#1162)

Backgroundjob bugfix (#807)

f696b59

Merge pull request EmpireProject#1169 from BC-SECURITY/vinnybod/cherr…

05d9b52

…y-pick-backgroundjob-bugfix Cherry-pick: Backgroundjob bugfix (#807)

Add Python 3.14 support (EmpireProject#1166)

ad81ef2

added spawn bof (EmpireProject#1175)

1930424

Fix SQLAlchemy connection pool exhaustion in agent check-ins (EmpireP…

7c49ba0

…roject#1178)

Fix PSRansom module name from Invoke-Script to PSRansom (EmpireProjec…

aff8def

…t#1179)

vinnybod and others added 7 commits March 4, 2026 18:30

Log version, commit SHA, and git tag at Empire startup (EmpireProject…

2c0948d

…#1181)

fix: wrap async hooks in fresh session to prevent DB pool exhaustion (E…

b43ae3f

…mpireProject#1183)

Prepare release 6.5.0 private

edc036d

fix: merge duplicate Fixed section in changelog

061bc7f

Merge pull request EmpireProject#1187 from BC-SECURITY/release/6.5.0-…

9fe0a5a

…private v6.5.0 into private-main

Update starkiller version to v3.4.0

a11b1bf

vinnybod merged commit 4b82a26 into main Apr 5, 2026
13 checks passed

vinnybod deleted the release/6.5.0 branch April 5, 2026 18:13

Navigation Menu

Uh oh!

Uh oh!

v6.5.0 into main - #818

v6.5.0 into main#818
vinnybod merged 37 commits into
mainfrom
release/6.5.0

vinnybod commented Apr 5, 2026

Uh oh!

github-actions Bot commented Apr 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

vinnybod commented Apr 5, 2026

Uh oh!

github-actions Bot commented Apr 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants