mishmashclone / bc-security-empire

https://github.com/BC-SECURITY/Empire

Keep up-to-date on our blog at https://www.bc-security.org/blog

Documentation

Empire

Empire 4 is a post-exploitation framework that includes a pure-PowerShell Windows agents, Python 3.x Linux/OS X agents, and C# agents. It is the merger of the previous PowerShell Empire and Python EmPyre projects. The framework offers cryptologically-secure communications and flexible architecture.

On the PowerShell side, Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework. PowerShell Empire premiered at BSidesLV in 2015 and Python EmPyre premiered at HackMiami 2016. BC Security presented updates to further evade Microsoft Antimalware Scan Interface (AMSI) and JA3/S signatures at DEF CON 27.

Empire relies heavily on the work from several other projects for its underlying functionality. We have tried to call out a few of those people we've interacted with heavily here and have included author/reference link information in the source of each Empire module as appropriate. If we have failed to properly cite existing or prior work, please let us know at [email protected].

Empire is currently being developed and maintained by @Cx01N, @Hubbl3, & @Vinnybod. While the original Empire project is no longer maintained, this fork is maintained by @bcsecurity1. Please reach out to us on our Discord if you have any questions or want to talk about offensive security.

Thank you to the original team of developers: @harmj0y, @sixdub, @enigma0x3, @rvrsh3ll, @killswitch_gui, & @xorrior

Sponsors

Release Notes

Please see our Releases or Changelog page for detailed release notes.

Quickstart

Empire 4 introduces a new server and client architecture which requires running each in separate terminals. Check out the Installation Page for install instructions.

Server

# Start Server
./ps-empire server

# Help
./ps-empire server -h

Client

# Start Client
./ps-empire client

# Help
./ps-empire client -h

Check out the Empire Docs for more instructions on installing and using with Empire. For a complete list of the 4.0 changes, see the changelog.

Join us in our Discord to with any comments, questions, concerns, or problems!

Starkiller

Starkiller is a GUI for PowerShell Empire that interfaces remotely with Empire via its API. Starkiller can be ran as a replacement for the Empire client or in a mixed environment with Starkiller and Empire clients.

Contribution Rules

Contributions are more than welcome! The more people who contribute to the project the better Empire will be for everyone. Below are a few guidelines for submitting contributions.

• Submit pull requests to the dev branch. After testing, changes will be merged to master.
• Depending on what you're working on, base your module on powershell_template.py or python_template.py. Note that for some modules you may need to massage the output to get it into a nicely displayable text format with Out-String.
• Cite previous work in the 'Comments' module section.
• If your script.ps1 logic is large, may be reused by multiple modules, or is updated often, consider implementing the logic in the appropriate data/module_source/* directory and pulling the script contents into the module on tasking.
• Use approved PowerShell verbs for any functions.
• TEST YOUR MODULE! Be sure to run it from an Empire agent and test Python 3.x functionality before submitting a pull to ensure everything is working correctly.
• For additional guidelines for your PowerShell code itself, check out the PowerSploit style guide.

Official Discord Channel

bc-security-empire's Issues

[BUG] TypeError: function() argument 'code' must be code, not str

Empire Version

Package: powershell-empire (4.2.0-0kali2)

OS Information

• VirtualBox: 6.1.30 r148432 (Qt5.6.2)
• OS: Linux kali 5.14.0-kali4-amd64 #1 SMP Debian 5.14.16-1kali1 (2021-11-05) x86_64 GNU/Linux
• Python: 3.9.9

Describe the bug

Empire fails to start server or client on an updated Kali VirtualBox VM installation, and instead throws a Python error.

To Reproduce

1. Install fresh Kali from kali-linux-2021.4a-virtualbox-amd64.ova.torrent
2. Run Empire server successfully
   • sudo powershell-empire server
3. Update Kali:
   • sudo apt update
   • sudo apt upgrade -y
4. Run Empire help command successfully:
   • sudo powershell-empire -h
5. Try to run Empire server again
   • sudo powershell-empire server

Expected behavior

Server launches.

Screenshots

Traceback (most recent call last):
  File "/usr/share/powershell-empire/empire.py", line 11, in <module>
    import empire.server.server as server
  File "/usr/share/powershell-empire/empire/server/server.py", line 24, in <module>
    import socketio
  File "/usr/lib/python3/dist-packages/socketio/__init__.py", line 3, in <module>
    from .client import Client
  File "/usr/lib/python3/dist-packages/socketio/client.py", line 7, in <module>
    import engineio
  File "/usr/lib/python3/dist-packages/engineio/__init__.py", line 8, in <module>
    from .asyncio_client import AsyncClient
  File "/usr/lib/python3/dist-packages/engineio/asyncio_client.py", line 7, in <module>
    import aiohttp
  File "/usr/lib/python3/dist-packages/aiohttp/__init__.py", line 6, in <module>
    from .client import (
  File "/usr/lib/python3/dist-packages/aiohttp/client.py", line 35, in <module>
    from . import hdrs, http, payload
  File "/usr/lib/python3/dist-packages/aiohttp/http.py", line 7, in <module>
    from .http_parser import (
  File "/usr/lib/python3/dist-packages/aiohttp/http_parser.py", line 15, in <module>
    from .helpers import NO_EXTENSIONS, BaseTimerContext
  File "/usr/lib/python3/dist-packages/aiohttp/helpers.py", line 667, in <module>
    class CeilTimeout(async_timeout.timeout):
TypeError: function() argument 'code' must be code, not str

Additional context

Tried apt purge followed by apt install, but got the same error.