Client
- servers - The servers block is meant to give the user the ability to set up frequently used Empire servers.If a server is listed in this block then when connecting to the server they need only type:
connect -c localhost
.This tells the client to use the connection info for the server named localhost from the yaml. In addition, if autoconnect is set totrue
, the client will automatically connect to that server when starting up.servers:localhost:host: https://localhostport: 1337socketport: 5000username: empireadminpassword: password123autoconnect: true - suppress-self-cert-warning - Suppress the HTTP warnings when connecting to an Empire instance that uses a self-signed cert.
- auto-copy-stagers - Automatically copy generated stager text to the clipboard.
- directories - Control where Empire should read and write specific data.
directories:
downloads: empire/client/downloads/
generated-stagers: empire/client/generated-stagers/
- tables - Enable or disable borders around tables
tables:
borders: true
- shortcuts - Shortcuts defined here allow the user to define their own frequently used modules and assign a command to them.
This first example is the simplest example. It adds a
sherlock
command to the Interact menu for Powershell agents. It does not pass any specific parameters.shortcuts:
powershell:
sherlock:
module: powershell/privesc/sherlock
This next one is slightly more complex in that we are telling the shortcut to set the Sleep parameter to 1. Note that if there are any other parameters for this module that we don't define, it will use whatever the default value is.
shortcuts:
powershell:
keylog:
module: powershell/collection/keylogger
params:
- name: Sleep
value: 1
This third one gets a bit more complex. Instead of providing a
value
to the parameter, it is marked as dynamic
. This tells the CLI that it expects the user to send the parameters as part of their command. In other words, the user needs to type bypassuac http1
in order for this to execute. The parameters are passed in the order they are defined in config.yaml. There are some convenient autocompletes if the field is named Listener
or Agent
.shortcuts:
powershell:
bypassuac:
module: powershell/privesc/bypassuac_eventvwr
params:
- name: Listener
dynamic: true
The last one is much more simple. Instead of running a module, we run a shell command.
shortcuts:
powershell:
whoami:
shell: whoami
Last modified 8mo ago