Empire v3.6.0

Beginning with Empire 3.5.0, we recommend the use of Poetry or the Docker images to run Empire as we will be transitioning to these platforms.

Changelog

• Added new API endpoints for user and agent notes - #383 (@Cx01N)
• Added (readded) PowerView function add-netuser - #381 (@Cx01N)
• Added Invoke-SharpChisel module - #368 (@Invoke-Mimikatz)
• Added command option to psremoting and smbexec - #380 (@Invoke-Mimikatz)
• Added option to use multiple redirector listeners and chaining - #389 (@Cx01N)
• Added Invoke-Assembly module - #376 (@Invoke-Mimikatz)
• Updated API endpoints for dynamic plugin calls - #383 (@Cx01N)
• Updated plugin and module templates - #384 (@Cx01N)
• Fixed smbscanner to work on Windows 10 - #380 (@Invoke-Mimikatz)
• Fixed update agent comms (updatecomms) not properly changing - #382 (@Cx01N)
• Fixed download endpoint formatting and error handling - #383 (@Cx01N)
• Fixed issue with passing arguments to Get-DomainSID module - #374 (@mjokic)
• Fixed bat file length limit issue - #385 (@Hubbl3)

Empire v3.5.2

Beginning with Empire 3.5.0, we recommend the use of Poetry or the Docker images to run Empire as we will be transitioning to these platforms.

Changelog

• Fixed token manipulation (steal_token) functionality in Windows 10 - #355 (@Hubbl3)
• Fixed lateral movement module New-GPOImmediateTask - #362 (@Cx01N)
• Fixed Invoke-PSRemoting blocking current agent - #359 (@mjokic)

Empire v3.5.1

Beginning with Empire 3.5.0, we recommend the use of Poetry or the Docker images to run Empire as we will be transitioning to these platforms.

Changelog

• Fixed Invoke-Obfuscation in Kali/Dockers - #348 (@Cx01N)
• Refactored /api/map endpoint - #337 (@mattaereal)

Empire v3.5.0

Beginning with Empire 3.5.0, we recommend the use of Poetry or the Docker images to run Empire as we will be transitioning to these platforms.

Changelog

• Added real-time notifications to Starkiller - #335 (@vinnybod)
• Added Invoke-ZeroLogon - #333 (@Cx01N)
• Added Invoke-SocksProxy - #332 (@Cx01N, @Hubbl3)
• Added powercat module - #319 (@Cx01N)
• Added powermad modules - #329 (@snovvcrash)
• Added self cleanup functionality to plugins - #332 (@Hubbl3)
• Updated Mimikatz 2.2.0 20200918 ZeroLogon - #330 (@Cx01N)
• Fixed dropbox listener and staging issues - #327 (@Cx01N)
• Fixed docker missing pyparsing in requirements.txt - #324 (@Cx01N)
• Fixed modules with missing MITRE ATT&CK techniques - #321 (@Cx01N)
• Fixed issue with inputs not being assigned color in helpers.py - #332 (@Cx01N)

v3.4.0

Empire 3.4.0

• Added Malleable C2 HTTP Listener - #287 (@johneiser, @Cx01N, @Hubbl3)
• Added reflective load ability for files - #309 (@Hubbl3)
• Added Invoke-DomainPasswordSpray - #295 (@Cx01N)
• Added Invoke-WinPEAS - #293 (@Cx01N)
• Added Invoke-Watson - #294 (@Cx01N)
• Added plugins being loaded at startup - #301 (@Cx01N)
• Updated moduleName to display full directory - #299 (@Cx01N)
• Updated info in Invoke-SMBExec to indicate single target - #286 (@Cx01N)
• Updated Slack API notifications to webhooks - #303 (@Cx01N)
• Fixed spaces for IIS default page in HTTP listener - #302 (@adamczi)
• Fixed agent spawning issue with MS-16-032 - #292 (@Cx01N)
• Fixed min language version for modules (@Cx01N)
• Fixed CLI stager incorrectly shutting down - #198 (@Cx01N)
• Fixed error message from active agents during shutdown - #308 (@Cx01N)

v3.4.0-RC2

Empire 3.4.0-RC2

• Added Malleable C2 HTTP Listener - #287 (@johneiser, @Cx01N, @Hubbl3)
• Added Invoke-DomainPasswordSpray - #295 (@Cx01N)
• Added Invoke-WinPEAS - #293 (@Cx01N)
• Added Invoke-Watson - #294 (@Cx01N)
• Added plugins being loaded at startup - #301 (@Cx01N)
• Fixed agent spawning issue with MS-16-032 - #292 (@Cx01N)
• Fixed min language version for modules (@Cx01N)
• Fixed CLI stager incorrectly shutting down - #198 (@Cx01N)
• Updated moduleName to display full directory - #299 (@Cx01N)
• Updated info in Invoke-SMBExec to indicate single target - #286 (@Cx01N)

v3.4.0-RC1

Empire 3.4.0-RC1

• Added Malleable C2 HTTP Listener - #287 (@johneiser, @Cx01N, @Hubbl3)
• Added Invoke-DomainPasswordSpray - #295 (@Cx01N)
• Added Invoke-WinPEAS - #293 (@Cx01N)
• Added Invoke-Watson - #294 (@Cx01N)
• Fixed agent spawning issue with MS-16-032 - #292 (@Cx01N)
• Fixed min language version for modules (@Cx01N)

Note: Confirmed working Malleable C2 Profiles can be found here.

v.3.3.4

Empire 3.3.4

• Fixed preobfuscate error: could not read module source path - #282 (@Cx01N)
• Fixed issues http_foreign listener issue - #283 (@Cx01N)

v3.3.3

Empire 3.3.3

• Added get_gpo_computer module - #271 (@byt3bl33d3r)
• Added port forwarding module - #265 (@snovvcrash)
• Updated HTTP/HTTP_com listeners to closer resemble IIS 7.5 - #277 (@adamczi)
• Updated lateral movements (invoke_smbexec/invoke_dcom/invoke_executemsbuild/invoke_wmi) to include option for custom commands - #247 (@Invoke-Mimikatz)
• Updated Mimikatz 2.2.0 20200809 AzureAd x-ms-RefreshTokenCredential & DPAPI everywhere - #279 (@Cx01N)
• Fixed issue with duplicate results in db - #266 (@byt3bl33d3r)
• Fixed empty token issue in API - #274 (@vinnybod)
• Fixed missing keyword argument in ETWBypass - #273 (@Cx01N)

v3.3.2

Empire 3.3.2

• Added Event Tracing for Windows (ETW) Bypass to stagers - #269 (@Hubbl3)
• Updated Mimikatz 20200805 CloudAP Key Derivation - #268 (@Cx01N)
• Updated Invoke-Kerberoast to John The Ripper format - #263 (@kazkansouh)
• Fixed indentation issues in schtasks - #267 (@adamczi)