Hands-On Red Team Tactics

Empire post exploitation for Windows

Assuming that we have already got an agent connected to us, we will now perform post exploitation on Windows OS when the agent's security context is low. As demonstrated in the following screenshot, we have got an agent which has low privileges (high_integrity: 0):

We can elevate the privileges using the privilege escalation modules in Empire. For this scenario, we will be using the bypassuac_eventvwr module.

To execute this module, use the bypassuac command and the listener as the argument passed to bypassuac_eventvwr:

The same thing can be achieved using the following commands:

usemodule privesc/bypassuac_eventvwr ...