Press "Enter" to skip to content

Month: December 2015

Empire 1.4

Published December 30, 2015 by harmj0y

It’s been another two months since the last major Empire point release, and development has continued to move along steadily. Empire has a TON of new modules from 10 different authors and a smattering of additional bug fixes/feature adds. We want to give a big thanks and shout out to all the contributors who are helping to expand Empire with new capabilities! New Modules situational_awareness/network/powerview/find_managed_security_groups integrates @ukstufus‘s pull to identify Active Directory groups which have the ‘managedBy’ attribute set. In some cases this can help to uncover misconfiguration in AD that may allow for elevation. There’s more information on this module in the…

Continue ReadingEmpire 1.4

Targeted Plaintext Downgrades with PowerView

Published December 16, 2015 by harmj0y

Following my pattern of weaponizing Sean Metcalf‘s work in PowerView, I’m here with another update. Sean recently released a post titled “Dump Clear-Text Passwords for All Admins in the Domain Using Mimikatz DCSync“. He describes a legacy feature for Active Directory user accounts called ‘reversible encryption’. According to Microsoft, “This policy is required when using Challenge-Handshake Authentication Protocol (CHAP) authentication through remote access or Internet Authentication Services (IAS). It is also required when using Digest Authentication in Internet Information Services (IIS)“. There’s a bit more a detailed explanation of its workings here and here. Sean describes a cool way to set this policy…

Continue ReadingTargeted Plaintext Downgrades with PowerView

Empire, Meterpreter, and Offensive Half-life

Published December 9, 2015 by harmj0y

A little over a week ago an interesting conversation started on security.stackexchange.com where someone asked about “Metasploit Meterpreter alternatives“. In the ensuing discussion two projects I co-founded and worked on heavily (Veil-Evasion and Empire) were mentioned, so I wanted to throw my .02 into the conversation. Empire was not designed as, not is intended to be, a ‘Meterpreter replacement’. The project’s goal was to weaponize the wealth of existing PowerShell tech out there to show that a pure-PowerShell based agent was possible, and to serve as a teaching tool for network defenders to demonstrate the capability of these types of attack toolsets. We use…

Continue ReadingEmpire, Meterpreter, and Offensive Half-life

Sheets on Sheets on Sheets

Published December 3, 2015 by harmj0y

After a few requests, I’ve built out a series of cheat sheets for a few of the tools I help actively develop- PowerView, PowerUp, and Empire. I hope to illustrate the full functionality available in each tool and provide a quick reference for new adopters (as well as seasoned operators). PDF versions of these will be kept in a master repository at https://github.com/HarmJ0y/CheatSheets/ under the Creative Commons v3 “Attribution” License. They are versioned in the footnotes and I will them appropriately as time goes on. Note: PowerView and PowerUp are in the process of being integrated into the PowerSploit repository. The bit.ly links in the current sheets…

Continue ReadingSheets on Sheets on Sheets