Invoke-FileFinder - Empire Module

This page contains detailed information about how to use the powershell/collection/file_finder Empire module. For list of all Empire modules, visit the Empire Module Library.

Module Overview

---

Name: Invoke-FileFinder
Module: powershell/collection/file_finder
Source code [1]: empire/server/modules/powershell/collection/file_finder.yaml
Source code [2]: empire/server/data/module_source/situational_awareness/network/powerview.ps1
MITRE ATT&CK: T1083
Language: PowerShell
Needs admin: No
OPSEC safe: Yes
Background: Yes

The file_finder module finds sensitive files on the domain.

This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.

Note that the file_finder module does not need administrative privileges to work properly which means that a normal user can run this module.

Required Module Options

---

This is a list of options that are required by the file_finder module:

Agent
Agent to run module on.

Additional Module Options

---

This is a list of additional options that are supported by the file_finder module:

CheckWriteAccess
Switch. Only returns files the current user has write access to.

ComputerFilter
Host filter name to query AD for, wildcards accepted.

ComputerName
Hosts to enumerate.

CreationTime
Only return files with a CreationDate greater than this date value.

Delay
Delay between enumerating hosts, defaults to 0.

Domain
Domain to query for machines.

ExcludeHidden
Switch. Exclude hidden files and folders from the search results.

FreshEXES
Switch. Find .EXEs accessed in the last week.

LastAccessTime
Only return files with a LastAccessTime greater than this date value.

NoPing
Switch. Don't ping each host to ensure it's up before enumerating.

OfficeDocs
Switch. Return only office documents.

OutputFunction
PowerShell's output function to use ("Out-String", "ConvertTo-Json", "ConvertTo-Csv", "ConvertTo-Html", "ConvertTo-Xml").
Default value: Out-String.
Suggested values: Out-String, ConvertTo-Json, ConvertTo-Csv, ConvertTo-Html, ConvertTo-Xml.

SearchSYSVOL
Switch. Search for login scripts on the SYSVOL of the primary DCs for each specified domain.

ShareList
List of '\\HOST\shares' (on the target) to search through.

Terms
Comma-separated terms to search for (overrides defaults).

Threads
The maximum concurrent threads to execute.

File_finder Example Usage

---

Here's an example of how to use the file_finder module in the Empire client console:

[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule powershell/collection/file_finder

 Author       @harmj0y                                                       
 Background   True                                                           
 Comments     https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/ 
 Description  Finds sensitive files on the domain.                           
 Language     powershell                                                     
 Name         powershell/collection/file_finder                              
 NeedsAdmin   False                                                          
 OpsecSafe    True                                                           
 Techniques   http://attack.mitre.org/techniques/T1083                       


,Record Options----,------------,----------,-------------------------------------,
| Name             | Value      | Required | Description                         |
|------------------|------------|----------|-------------------------------------|
| Agent            |            | True     | Agent to run module on.             |
|------------------|------------|----------|-------------------------------------|
| CheckWriteAccess |            | False    | Switch. Only returns files the      |
|                  |            |          | current user has write access to.   |
|------------------|------------|----------|-------------------------------------|
| ComputerFilter   |            | False    | Host filter name to query AD for,   |
|                  |            |          | wildcards accepted.                 |
|------------------|------------|----------|-------------------------------------|
| ComputerName     |            | False    | Hosts to enumerate.                 |
|------------------|------------|----------|-------------------------------------|
| CreationTime     |            | False    | Only return files with a            |
|                  |            |          | CreationDate greater than this date |
|                  |            |          | value.                              |
|------------------|------------|----------|-------------------------------------|
| Delay            |            | False    | Delay between enumerating hosts,    |
|                  |            |          | defaults to 0.                      |
|------------------|------------|----------|-------------------------------------|
| Domain           |            | False    | Domain to query for machines.       |
|------------------|------------|----------|-------------------------------------|
| ExcludeHidden    |            | False    | Switch. Exclude hidden files and    |
|                  |            |          | folders from the search results.    |
|------------------|------------|----------|-------------------------------------|
| FreshEXES        |            | False    | Switch. Find .EXEs accessed in the  |
|                  |            |          | last week.                          |
|------------------|------------|----------|-------------------------------------|
| LastAccessTime   |            | False    | Only return files with a            |
|                  |            |          | LastAccessTime greater than this    |
|                  |            |          | date value.                         |
|------------------|------------|----------|-------------------------------------|
| NoPing           |            | False    | Switch. Don't ping each host to     |
|                  |            |          | ensure it's up before enumerating.  |
|------------------|------------|----------|-------------------------------------|
| OfficeDocs       |            | False    | Switch. Return only office          |
|                  |            |          | documents.                          |
|------------------|------------|----------|-------------------------------------|
| OutputFunction   | Out-String | False    | PowerShell's output function to use |
|                  |            |          | ("Out-String", "ConvertTo-Json",    |
|                  |            |          | "ConvertTo-Csv", "ConvertTo-Html",  |
|                  |            |          | "ConvertTo-Xml").                   |
|------------------|------------|----------|-------------------------------------|
| SearchSYSVOL     |            | False    | Switch. Search for login scripts on |
|                  |            |          | the SYSVOL of the primary DCs for   |
|                  |            |          | each specified domain.              |
|------------------|------------|----------|-------------------------------------|
| ShareList        |            | False    | List of '\\HOST\shares' (on the     |
|                  |            |          | target) to search through.          |
|------------------|------------|----------|-------------------------------------|
| Terms            |            | False    | Comma-separated terms to search for |
|                  |            |          | (overrides defaults).               |
|------------------|------------|----------|-------------------------------------|
| Threads          |            | False    | The maximum concurrent threads to   |
|                  |            |          | execute.                            |
'------------------'------------'----------'-------------------------------------'

(Empire: usemodule/powershell/collection/file_finder) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/powershell/collection/file_finder) > execute
[*] Tasked Y4LHEV83 to run Task 1
...

Now wait for the results to come.

Author

---

• @harmj0y

References

---

• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/modules/powershell/collection/file_finder.yaml
• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/data/module_source/situational_awareness/network/powerview.ps1
• https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/
• http://attack.mitre.org/techniques/T1083

See Also

---

Check also the following modules related to this module:

• powershell/collection/get_sql_query
• powershell/collection/SharpLoginPrompt
• powershell/collection/get_indexed_item
• powershell/collection/ninjacopy
• powershell/collection/clipboard_monitor
• powershell/collection/FoxDump
• powershell/collection/prompt
• powershell/collection/minidump
• powershell/collection/netripper
• powershell/collection/SauronEye
• powershell/collection/toasted
• powershell/collection/screenshot
• powershell/collection/find_interesting_file
• powershell/collection/inveigh
• powershell/collection/browser_data
• powershell/collection/WireTap
• powershell/collection/WebcamRecorder
• powershell/collection/ChromeDump
• powershell/collection/USBKeylogger
• powershell/collection/get_sql_column_sample_data
• powershell/collection/keylogger
• powershell/collection/get-winupdates
• powershell/collection/packet_capture
• powershell/collection/SharpChromium
• powershell/collection/vaults/remove_keepass_config_trigger
• powershell/collection/vaults/add_keepass_config_trigger
• powershell/collection/vaults/keethief
• powershell/collection/vaults/find_keepass_config
• powershell/collection/vaults/get_keepass_config_trigger
• powershell/situational_awareness/network/powerview/get_fileserver
• powershell/situational_awareness/network/powerview/share_finder
• python/situational_awareness/network/active_directory/get_fileservers
• python/privesc/osx/dyld_print_to_file
• python/persistence/multi/desktopfile

Version

---

This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.