OWASP Sacramento Chapter Meeting Agenda
Learn about the upcoming OWASP Sacramento Chapter meeting agenda, including community topics, Empire Framework introduction and demo, and call for presentations in September and October. Find out how to participate and contribute to the OWASP community. Explore the post-exploitation framework, Empire, and its features for red teams, penetration testers, and more. Discover Empire components like listeners, stagers, agents, modules, plugins, and interfaces. Get involved in the OWASP Foundation and stay informed about virtual events and presentations.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
TM Meeting Starts at 6:05PM
OWASP Sacramento Ryan Kozak August 2021 OWASP FOUNDATION TM
Agenda 1) Community Topics Call for Presentations OWASP Slack 2) Empire Framework Introduction 3) Empire Demo owasp.org OWASP FOUNDATION
OWASP Community Call for Presentations: September and October (likely virtual events) If you d like to present (or know someone else who would) at the OWASP Sacramento Chapter s September or October meetings, please email us your topic. You don t need to be an expert! Joubin: joubin.jabbari@owasp.org Ryan: ryan.kozak@owasp.org owasp.org OWASP FOUNDATION
OWASP Community OWASP Slack https://bit.ly/3ckwNfI Or go to our Chapter page: OWASP Sacramento CA Local Chapter Meetup | OWASP Foundation owasp.org OWASP FOUNDATION
Empire owasp.org OWASP FOUNDATION
Disclaimers 1. I m not an expert on this tool. 1. Don t use this tool to do bad stuff. owasp.org OWASP FOUNDATION
Post-Exploitation Framework What is Empire? Empire 4 is a post-exploitation framework that includes a pure-PowerShell Windows agents, Python 3.x Linux/OS X agents, and C# agents. It is the merger of the previous PowerShell Empire and Python EmPyre projects. Original Developers: @harmj0y,@sixdub, and @enigma0x3 Currently Maintained by BC Security O owasp.org OWASP FOUNDATION
Post-Exploitation Framework Who is Empire for? Red Teams Penetration Testers Purple Teams The Curious... owasp.org OWASP FOUNDATION
Empire Components Listeners Similar to Metasploit s multi/handler, listens for incoming connections. Stagers Code executed on victim machine which connects back to a listener. Agents The final payload retrieved by the stager...running on a victim machine under control of the C2 server. Modules True power of Empire, easily run code for situational awareness, credentials and privilege escalation, lateral movement, trolling, etc. Plugins Custom scripts to add functionality. Interfaces Starkiller (uses API), REST API, and Command Line owasp.org OWASP FOUNDATION
Empire Installation docker pull bcsecurity/empire:latest sudo pip3 install poetry sudo apt install powershell-empire git clone --recursive https://github.com/BC- SECURITY/Empire.git docker create -v /empire -- name data bcsecurity/empire:latest cd Empire docker run -it -p 1337:1337 -p 5000:5000 --volumes-from data bcsecurity/empire:latest sudo ./setup/install.sh sudo poetry install owasp.org OWASP FOUNDATION
Demo Duration 30 min(ish) owasp.org OWASP FOUNDATION
Conclusion Empire is a great post exploitation framework and C2 server Built for attackers, defenders, researchers, and so on. Many options to create listeners (http, Dropbox, OneDrive, etc). Many options to create stagers (a whole lot). Modules are Powershell, Python 3.x, or C#. Modules for persistence, privilege escalation, credential harvesting, situational awareness, trolling, data collection, etc. owasp.org OWASP FOUNDATION
References https://github.com/BC-SECURITY/Empire https://github.com/BC-SECURITY/Starkiller owasp.org OWASP FOUNDATION
