PowerShell Empire: post-exploitation C2 framework
PowerShell-native agents with encrypted comms and modules ranging from keylogging to Mimikatz.
bash·1 min read··INE Certification
Empire runs agents purely in PowerShell, with cryptographically-secured C2 comms and a large post-exploitation module library. Starkiller is the GUI front-end if you’d rather not drive it from the CLI.
Install & run
sudo apt update && sudo apt install -y powershell-empire
sudo powershell-empire server # start the C2 server
sudo powershell-empire client # separate terminal and connect as a client
# Starkiller GUI, once running
http://127.0.0.1:1337/index.html#/It’s officially packaged for Kali, and its module set overlaps a lot of what Metasploit’s post-exploitation modules do (keylogging, credential access via Mimikatz, lateral movement). The main reason to reach for Empire specifically is when you want communications that look like ordinary PowerShell/HTTPS traffic rather than a Metasploit-style handler.
Related
- Mimikatz & Kiwi — the credential-dumping module Empire also ships
- Windows post-exploitation — the Metasploit-side equivalent of Empire’s module library
- Metasploit Framework — the alternative C2 when PowerShell-looking traffic isn’t a requirement
- Windows persistence — keeping an Empire agent’s access across reboots