GO KALI FREE

Empire

Post Exploitation

Advancedhigh risk

Empire is an open-source post-exploitation and command-and-control (C2) framework originally created by @harmj0y and now maintained by BC-Security. It uses PowerShell and Python-based agents to model adversarial persistent access behaviors for authorized security testing, red team engagements, and defensive detection engineering. Empire provides encrypted communications, modular capabilities, and a flexible agent system for extended operations against Windows and Linux environments.

Installation

sudo apt install powershell-empire

Basic Syntax

powershell-empire

Quick Facts

Full Name
PowerShell Empire
License
BSD 3-Clause
Language
Python / PowerShell
Interface
CLI (client/server)
Category
C2 Framework
Architecture
Client-Server
First Release
2015
Maintainer
BC-Security
Agent Types
PowerShell (Windows), Python (Linux)
Encryption
AES-256

Tool Overview

Empire is a free, open-source post-exploitation and command-and-control (C2) framework originally created by @harmj0y (Will Schroeder) in 2015 and now actively maintained by BC-Security. It provides red teams and security researchers with a robust platform for simulating advanced persistent threat (APT) behaviors during authorized engagements.

The framework uses a client-server architecture where the server manages listeners, agents, and modules, while the client provides the interactive console. Empire's agents use PowerShell (for Windows) and Python (for Linux) to maintain encrypted C2 channels back to the server, enabling remote command execution, credential harvesting, lateral movement, and persistence.

With hundreds of built-in modules covering reconnaissance, privilege escalation, credential extraction (including Mimikatz integration), lateral movement, and exfiltration, Empire enables comprehensive post-exploitation assessment. Blue teams and SOC analysts also study Empire's techniques to build detection rules and improve defensive capabilities.

Empire is intended exclusively for authorized security testing, educational purposes, and defensive research. Always obtain proper written authorization before using this tool in any engagement.

Common Commands

powershell-empire serverStart the Empire team server (RESTful API backend) that agents connect back to
powershell-empire clientLaunch the Empire client console that connects to the server
powershell-empire server --config config.yamlStart the server with a custom configuration file
listenersList active listeners in the client console
uselistener httpSelect the HTTP listener module to configure
set Port 8080Set an option (here the listen port) on the selected listener
set Host http://10.10.10.10:8080Set the callback host/URL the agent will use
executeStart the currently configured listener
usestager multi/launcherSelect a stager to generate agent-delivery code
set Listener httpBind the selected stager to a named listener
generateGenerate the stager output (e.g. a PowerShell launcher one-liner)
agentsList all agents that have called back to the server
interact <NAME>Enter an interactive session with a specific agent
usemodule powershell/collection/keyloggerSelect a post-exploitation module to run on the active agent
shell whoamiRun a shell command on the interacted agent

Step-by-Step Guide

  1. 1Install Empire using your package manager or from the official GitHub repository
  2. 2Start the Empire server backend with sudo powershell-empire server
  3. 3Launch the client console with sudo powershell-empire client to connect to the server
  4. 4Configure a listener (such as HTTP) to establish a C2 ingress point for agent connections
  5. 5Generate a stager payload appropriate for your target environment
  6. 6Deploy the stager on the authorized target system within your lab or engagement scope
  7. 7Monitor for incoming agent connections using the agents command
  8. 8Task agents with modules for post-exploitation activities within your authorized scope

Warnings

Use Cases

C2 Infrastructure

Establish encrypted command and control channels for authorized post-exploitation operations.

Agent Management

Deploy and manage lightweight agents on Windows and Linux targets within authorized scope.

Module Execution

Execute hundreds of post-exploitation modules for reconnaissance, credential harvesting, and persistence.

Lateral Movement

Simulate adversary lateral movement across network segments during authorized engagements.

Credential Harvesting

Extract credentials using built-in Mimikatz integration and custom credential modules.

Detection Validation

Test an organization's ability to detect C2 communications and PowerShell-based attacks.

Key Features

Best Practices

Common Errors

Server fails to start with Python import errors
Install Python 3.6+: sudo apt install python3 python3-pip. Run the Empire setup script: cd Empire && sudo python3 setup/install.sh
No listeners available or listener creation fails
Ensure the server is running (sudo powershell-empire server). Check database configuration in the Empire config file.
Agent not checking in after stager execution
Verify listener is running with listeners command. Test connectivity from the target network. Check firewall rules for the listener port.
Module failed to execute on agent
Check agent OS and version with agents command. Verify module requirements. Use privesc modules before running privileged modules.
Database locked error when starting server
Kill any existing Empire processes: pkill -f empire. Remove the database lock file if necessary: rm ~/.empire/database.lock
ImportError: No module named 'empire'
Reinstall Empire from the official repository. Run: pip3 install -r requirements.txt from the Empire directory.
Connection refused on listener port
Check for port conflicts: sudo netstat -tlnp | grep <port>. Use a different port or stop conflicting services.
Stager generation fails with invalid options
Set all required parameters before generating. Use info command to view required options for the stager.

Learning Path

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5

Related Tools

Metasploit

Exploitation

Full exploitation framework for initial access and post-exploitation.

Cobalt Strike

Post Exploitation

Commercial C2 platform with advanced evasion and malleable profiles.

Mimikatz

Post Exploitation

Credential extraction tool integrated into Empire's module library.

CrackMapExec

Information Gathering

Active Directory enumeration and lateral movement tool.

BloodHound

Information Gathering

Active Directory attack path analysis and visualization.

Impacket

Exploitation

Network protocol library for lateral movement and credential attacks.

Responder

Sniffing & Spoofing

LLMNR/NBT-NS poisoning tool for capturing NTLM hashes.

Nmap

Information Gathering

Network scanner for reconnaissance before Empire deployment.

Wireshark

Sniffing & Spoofing

Packet analyzer for inspecting C2 traffic and validating encryption.

Sliver

Post Exploitation

Cross-platform C2 framework as an alternative to Empire.

Frequently Asked Questions

What is Empire?

Empire is an open-source post-exploitation and command-and-control (C2) framework that uses PowerShell and Python-based agents to establish encrypted communication channels with target systems. Originally created in 2015, it is now maintained by BC-Security and provides modular capabilities for reconnaissance, privilege escalation, lateral movement, and persistence during authorized security assessments.

Is Empire free?

Yes, Empire is completely free and open source under the BSD 3-Clause license. You can download it from the official GitHub repository at github.com/BC-SECURITY/Empire without any cost. The full framework including all modules, listeners, and stagers is freely available for educational and authorized testing purposes.

Who developed Empire?

Empire was originally developed by @harmj0y (Will Schroeder) and the Empire Project team in 2015. Since 2019, it has been actively maintained by BC-Security (bc-security.org), who continue to add new features, modules, and maintain compatibility with modern Windows environments.

Is Empire open source?

Yes, Empire is fully open source under the BSD 3-Clause license. The complete source code is available on GitHub, allowing security professionals to review, modify, and extend the framework. The open-source nature enables transparency and community-driven development.

Can beginners learn Empire?

Empire is classified as an advanced tool due to its C2 architecture, PowerShell knowledge requirements, and infrastructure setup. However, beginners can start by understanding the conceptual architecture — listeners, agents, modules, and stagers — before hands-on practice in isolated lab environments like HackTheBox or TryHackMe.

Empire vs Metasploit?

Empire focuses exclusively on post-exploitation and C2 operations with PowerShell/Python agents, while Metasploit covers the full exploitation lifecycle from initial access to post-exploitation. Empire excels at long-term C2 operations with lightweight agents; Metasploit is better for initial exploitation and payload delivery. Many red teams use both together.

Empire vs Covenant?

Both are open-source C2 frameworks. Empire uses PowerShell/Python agents with a CLI interface and extensive module library. Covenant uses .NET-based launchers with a web-based GUI. Empire has a larger community and more modules; Covenant offers easier management through its web interface. Empire is better for PowerShell-focused environments; Covenant provides more flexibility in launcher types.

Empire vs Sliver?

Empire uses PowerShell/Python agents for Windows/Linux post-exploitation. Sliver is a Go-based C2 framework with cross-platform implant support. Sliver offers better native evasion capabilities and supports more platforms natively. Empire has a larger module library and longer community history. Choose Empire for PowerShell-focused operations; Sliver for cross-platform stealth operations.

What is an Empire listener?

An Empire listener is a server-side component that waits for incoming connections from agents. Listeners define the communication protocol (HTTP, HTTPS, etc.), host address, port, and URI. When a stager executes on a target, it connects back to the listener to establish a C2 channel. Common listener types include HTTP, HTTPS, Meterpreter, and TCP.

What is an Empire agent?

An Empire agent is a lightweight process running on a compromised target that maintains an encrypted connection back to the Empire server. Agents execute modules, run shell commands, and perform post-exploitation tasks. Each agent has a unique ID, tracks the target hostname, username, and OS, and periodically checks in with the server for new tasks.

What are Empire modules?

Empire modules are pre-built scripts that execute specific post-exploitation tasks through active agents. Modules cover reconnaissance, credential harvesting, privilege escalation, lateral movement, persistence, and exfiltration. Common categories include situational_awareness, privesc, credentials, and persistence. Modules are loaded with usemodule and executed through agent sessions.

How does Empire communicate?

Empire uses encrypted HTTP/HTTPS communications between agents and the server. Agents periodically check in with the server (default 60-second interval) to receive tasks and upload results. The communication is encrypted using AES-256, and traffic can be configured to blend with legitimate web traffic using customizable HTTP profiles and URI paths.

Is Empire detected by antivirus?

Yes, Empire's default payloads and agents are heavily signatured by modern AV/EDR solutions. However, Empire supports payload obfuscation, custom stagers, and in-memory execution techniques to reduce detection. Security professionals use Empire in authorized engagements to test detection capabilities and validate security controls.

What operating systems does Empire support?

Empire supports PowerShell-based agents for Windows systems (Windows 7 and later) and Python-based agents for Linux systems. The Empire server itself runs on Linux (typically Kali Linux or Ubuntu). This cross-platform support allows testing against diverse environments during authorized engagements.

What is Empire used for in cybersecurity?

Empire is used in cybersecurity for authorized red team engagements, adversarial simulation exercises, and defensive detection engineering. Security professionals use it to test an organization's ability to detect C2 communications, PowerShell-based attacks, and post-exploitation activities. Blue teams study Empire's techniques to build detection rules and improve incident response capabilities.

How do I install Empire?

On Kali Linux, install Empire using: sudo apt install powershell-empire. For other Linux distributions, clone from GitHub: git clone https://github.com/BC-SECURITY/Empire.git, then run the setup script. Empire requires Python 3.6+ and several dependencies. After installation, start the server and client separately.

Does Empire support encrypted communications?

Yes, Empire uses AES-256 encryption for all agent-server communications. The encryption keys are negotiated during the initial staging process. HTTPS listeners add transport-layer encryption on top of the application-layer encryption, providing double protection for C2 traffic.

Can Empire perform lateral movement?

Yes, Empire includes modules for lateral movement techniques including PSRemoting, WMI execution, and SMB-based pivoting. These modules allow agents to move across network segments and compromise additional systems during authorized engagements, simulating real-world adversary behavior.

What is the Empire module library?

The Empire module library contains hundreds of post-exploitation modules organized by category: situational_awareness (reconnaissance), privesc (privilege escalation), credentials (credential harvesting), persistence (maintaining access), and exfiltration (data extraction). Modules are community-contributed and regularly updated by BC-Security.

Tags

#post-exploitation#c2-framework#powershell#agents#command-and-control#red-team#detection-engineering

Output Explanation

Empire's console displays a command prompt with the current context (listeners, agents, or modules). Listener output shows the host, port, and URI. Agent output displays agent ID, hostname, username, and last check-in time. Module output shows task results including credential dumps, system information, and execution status. The console uses color-coded indicators: green for active agents, yellow for delayed check-ins, and red for failed connections.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.