In this phase, the one-liner command will start the staging process for Empire. The following is the staging process in Empire, which takes place when the stager is executed on the target server:
- When creating a one-liner launcher (stager), Empire embeds the staging key into the launcher itself:
- A stager executed on the target server requests Stage 0; that is, a patched stager.ps1, which can be found in Empire's data/agent/ directory.
- Before sending Stage 0 to the target server, Empire encrypts it. (Stage 0 will be case-randomized and then XOR encrypted with the AES staging key.)
- Launcher does the following things ...