Invoke-PortFwd - Empire Module


This page contains detailed information about how to use the powershell/lateral_movement/invoke_portfwd Empire module. For list of all Empire modules, visit the Empire Module Library.

Module Overview

Name: Invoke-PortFwd
Module: powershell/lateral_movement/invoke_portfwd
Source code [1]: empire/server/modules/powershell/lateral_movement/invoke_portfwd.yaml
Source code [2]: empire/server/data/module_source/lateral_movement/Invoke-PortFwd.ps1
MITRE ATT&CK: T1363
Language: PowerShell
Needs admin: No
OPSEC safe: No
Background: Yes

The invoke_portfwd module forwards a port with no admin rights required.

This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.

Note that the invoke_portfwd module does not need administrative privileges to work properly which means that a normal user can run this module.

Required Module Options

This is a list of options that are required by the invoke_portfwd module:

Agent
Agent to grab a screenshot from.

Lhost
Local IP address.

Lport
Local port to listen on.

Rhost
Remote IP address.

Rport
Remote port to forward to.

Invoke_portfwd Example Usage

Here's an example of how to use the invoke_portfwd module in the Empire client console:

[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule powershell/lateral_movement/invoke_portfwd

 Author       @decoder-it                                        
 Background   True                                               
 Comments     Inspired by @IppSec (https://youtu.be/6l4ZIKwzW8U) 
              https://github.com/decoder-it/psportfwd            
 Description  Forward a port with no admin rights required.      
 Language     powershell                                         
 Name         powershell/lateral_movement/invoke_portfwd         
 NeedsAdmin   False                                              
 OpsecSafe    False                                              
 Techniques   http://attack.mitre.org/techniques/T1363           


,Record Options-,----------,----------------------------------,
| Name  | Value | Required | Description                      |
|-------|-------|----------|----------------------------------|
| Agent |       | True     | Agent to grab a screenshot from. |
|-------|-------|----------|----------------------------------|
| Lhost |       | True     | Local IP address.                |
|-------|-------|----------|----------------------------------|
| Lport |       | True     | Local port to listen on.         |
|-------|-------|----------|----------------------------------|
| Rhost |       | True     | Remote IP address.               |
|-------|-------|----------|----------------------------------|
| Rport |       | True     | Remote port to forward to.       |
'-------'-------'----------'----------------------------------'

(Empire: usemodule/powershell/lateral_movement/invoke_portfwd) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/powershell/lateral_movement/invoke_portfwd) > set Lhost value
[*] Set Lhost to value
(Empire: usemodule/powershell/lateral_movement/invoke_portfwd) > set Lport value
[*] Set Lport to value
(Empire: usemodule/powershell/lateral_movement/invoke_portfwd) > set Rhost 192.168.100.1
[*] Set Rhost to 192.168.100.1
(Empire: usemodule/powershell/lateral_movement/invoke_portfwd) > set Rport value
[*] Set Rport to value
(Empire: usemodule/powershell/lateral_movement/invoke_portfwd) > execute
[*] Tasked Y4LHEV83 to run Task 1
...

Now wait for the results to come.

Author

References

See Also

Check also the following modules related to this module:

Version

This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.