Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/bc-security/empire
Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
https://github.com/bc-security/empire
c2 empire hacktoberfest redteam-infrastructure
Last synced: 3 months ago
JSON representation
Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
- Host: GitHub
- URL: https://github.com/bc-security/empire
- Owner: BC-SECURITY
- License: bsd-3-clause
- Fork: true (EmpireProject/Empire)
- Created: 2019-08-01T04:22:31.000Z (over 5 years ago)
- Default Branch: main
- Last Pushed: 2024-09-22T20:27:55.000Z (3 months ago)
- Last Synced: 2024-09-30T11:23:42.699Z (3 months ago)
- Topics: c2, empire, hacktoberfest, redteam-infrastructure
- Language: PowerShell
- Homepage: https://bc-security.gitbook.io/empire-wiki/
- Size: 112 MB
- Stars: 4,206
- Watchers: 105
- Forks: 574
- Open Issues: 60
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: .github/CONTRIBUTING.md
- Funding: .github/FUNDING.yml
- License: LICENSE
Awesome Lists containing this project
README
[](https://github.com/sponsors/BC-SECURITY)
[](https://bc-security.gitbook.io/empire-wiki/)
[](https://discord.gg/P8PZPyf)
[](https://www.bc-security.org/blog)
[](https://twitter.com/BCSecurity)
[](https://twitter.com/EmpireC2Project)
[](https://www.youtube.com/channel/UCIV4xSntF1h1bvFt8SUfzZg)
[](https://www.linkedin.com/company/bc-security/)
# Empire
Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server. There is also a GUI available for remotely accessing the Empire server, [Starkiller](https://github.com/BC-SECURITY/Starkiller).
### Features
- Server/Client Architecture for Multiplayer Support
- Supports GUI & CLI Clients
- Fully encrypted communications
- HTTP/S, Malleable HTTP, OneDrive, Dropbox, and PHP Listeners
- Massive library (400+) of supported tools in PowerShell, C#, & Python
- Donut Integration for shellcode generation
- Modular plugin interface for custom server features
- Flexible module interface for adding new tools
- Integrated obfuscation using [ConfuserEx 2](https://github.com/mkaring/ConfuserEx) & [Invoke-Obfuscation](https://github.com/danielbohannon/Invoke-Obfuscation)
- In-memory .NET assembly execution
- Customizable Bypasses
- JA3/S and JARM Evasion
- MITRE ATT&CK Integration
- Integrated Roslyn compiler (Thanks to [Covenant](https://github.com/cobbr/Covenant))
- Docker, Kali, ParrotOS, Ubuntu 20.04/22.04, and Debian 10/11/12 Install Support
### Agents
- PowerShell
- Python 3
- C#
- IronPython 3
### Modules
- [Assembly Execution](https://github.com/BC-SECURITY/Empire/blob/master/empire/server/data/module_source/code_execution/Invoke-Assembly.ps1)
- [BOF Execution](https://github.com/airbus-cert/Invoke-Bof)
- [Mimikatz](https://github.com/gentilkiwi/mimikatz)
- [Seatbelt](https://github.com/GhostPack/Seatbelt)
- [Rubeus](https://github.com/GhostPack/Rubeus)
- [SharpSploit](https://github.com/cobbr/SharpSploit)
- [Certify](https://github.com/GhostPack/Certify)
- [ProcessInjection](https://github.com/3xpl01tc0d3r/ProcessInjection)
- And Many More
## Sponsors
[
](https://www.route4me.com//)
[
](https://www.instagram.com/purpl3_cult/)
## Release Notes
Please see our [Releases](https://github.com/BC-SECURITY/Empire/releases) or [Changelog](/CHANGELOG.md) page for detailed release notes.
### Quickstart
When cloning this repository, you will need to recurse submodules.
```sh
git clone --recursive https://github.com/BC-SECURITY/Empire.git
```
Check out the [Installation Page](https://bc-security.gitbook.io/empire-wiki/quickstart/installation) for install instructions.
Note: The `main` branch is a reflection of the latest changes and may not always be stable.
After cloning the repo, you can checkout the latest stable release by running the `setup/checkout-latest-tag.sh` script.
```bash
git clone --recursive https://github.com/BC-SECURITY/Empire.git
cd Empire
./setup/checkout-latest-tag.sh
./ps-empire install -y
```
If you are using the sponsors version of Empire, it will pull the sponsors version of Starkiller.
Because these are private repositories, you need to have ssh credentials configured for GitHub.
Instructions can be found [here](https://docs.github.com/en/github/authenticating-to-github/connecting-to-github-with-ssh).
#### Server
```bash
# Start Server
./ps-empire server
# Help
./ps-empire server -h
```
#### Client
```bash
# Start Client
./ps-empire client
# Help
./ps-empire client -h
```
Check out the [Empire Docs](https://bc-security.gitbook.io/empire-wiki/) for more instructions on installing and using with Empire.
For a complete list of changes, see the [changelog](./changelog).
## Starkiller
[Starkiller](https://github.com/BC-SECURITY/Starkiller) is a web application GUI for PowerShell Empire that interfaces remotely with Empire via its API.
Starkiller can be ran as a replacement for the Empire client or in a mixed environment with Starkiller and Empire clients.
As of 5.0, Starkiller is packaged in Empire as a git submodule and doesn't require any additional setup.
## Contribution Rules
See [Contributing](./.github/CONTRIBUTING.md)
## Contributors
A special thanks to the following contributors for their help with Empire:
[@harmj0y](https://twitter.com/harmj0y)
[@sixdub](https://twitter.com/sixdub)
[@enigma0x3](https://twitter.com/enigma0x3)
[@rvrsh3ll](https://twitter.com/424f424f)
[@killswitch_gui](https://twitter.com/killswitch_gui)
[@xorrior](https://twitter.com/xorrior)
[@Cx01N](https://twitter.com/Cx01N_)
[@Hubbl3](https://twitter.com/_Hubbl3)
[@Vinnybod](https://twitter.com/_vinnybod)
## Official Discord Channel
Join us in [our Discord](https://discord.gg/P8PZPyf) with any comments, questions, concerns, or problems!
