Hi everybody, I'm Anthony. I go by Koin and I'm one of the developers of Starkiller and Empire.
I'm also here with Jake and Vince. Hey, I'm Jake. I go by Hubble. I'm also one of the developers for
Starkiller and Empire. And I'm Vince. I created Starkiller and I'm the lead developer.
So we're going to be talking about Starkiller today, which is our threat emulation platform
that we use for red teaming. What this allows us to do is to have an intuitive interface
that multiple users can log in from and interact with the team server, as well as it has some
hooks built into it to the MITRE ATT&CK framework that gives links to techniques
inside of all our modules. And what this setup allows us to do is to have our teams most accurately
emulate the threats for our assessments. Since we're trying to emulate that threat,
what we're really focusing on is trying to make sure that we're replicating their TTPs,
those tactics, techniques, and procedures. Since this is what the threat is going to use to obtain
their objectives, we're going to make sure that everything we do in our tests focus around what
the threat's going to be and be representative. That includes our infrastructure. We want to make
sure that our infrastructure mirrors exactly what an APT setup is going to look like. For example,
our stagers and payloads, as well as our implants will mirror the threats. Our setup will typically
include multiple operators across different locations, all connected to the team server.
They may be spread out as well to make sure that everything is segregated. So that way,
if one server goes down, we're not going to lose our entire operation and burn it. We want to make
sure that our infrastructure mirrors what the threat's going to do and are going to be able
to emulate what they're going to be running for their attacks. So what you kind of saw in the
that connects to our team server. So Starkiller provides a UI on top of the C2 server,
in this case, Empire. And it allows us to interact as a team. So we have multi-user support.
We have a live reporting interface. So anytime a team member runs a module or a command,
we're able to instantly see those commands through the interface. And it simplifies a lot
of the workflows that are a little bit more tedious through the CLI.
So as we mentioned, Starkiller is a GUI interface that interacts with the Empire C2 server. Empire
is built on PowerShell and Python, for those of you that aren't aware. With the addition of
Starkiller, it can now be ran as either a team server or an all-in-one C2, which means just a
person's running the C2 on the command line directly, like there's no other infrastructure
required to run that C2. It has a bunch of adaptive modules. We're up to about 300 now.
And then the original project ended support back in August of 2019, but we forked it and have been
maintaining and updating it ever since, which is why we built Starkiller on top of it. And we
really built Starkiller to address some of the shortfalls that Vincent mentioned, to allow for
threat emulation and just like a modern red team engagement when using Empire as your primary C2.
So ever since we forked Empire when it was originally, when support was originally ended,
we get asked a lot why we still think PowerShell is important, because there's a whole bunch of
mitigations in place, you know, like script block logging and AMSI and all those kinds of things
that do make PowerShell much more difficult when it is implemented properly. But even though
red teams have started moving on to C-Sharp and other .NET tradecraft and Microsoft has started
kind of focusing protections elsewhere, PowerShell is still a huge attack vector that's utilized
like every day by APTs. CrowdStrike came out with a report in 2019 that said as many as 90%
of breaches use PowerShell in some way. Now that doesn't mean that PowerShell is their primary
means of operations, or even that it's the majority of what's being done, but it's still
used in 90% of breaches according to CrowdStrike. So we still think it's really worthwhile for red
teams to emulate threats using PowerShell, because even though all those mitigations
do exist for it, we still see many, many organizations that are vulnerable to PowerShell
because they don't have those mitigations properly implemented. So what we have here is our team
server setup running Empire. We also have multiple Starkiller instances all connected
to that team server. That team server is then sitting in a secure location that could be either
in the cloud or like one of our offices. There is then a secure line directly into our server,
our cloud server. In this case, it's AWS. That cloud server is then going to reach out to all
of our redirectors. We have these multiple redirectors up in case one of them gets burned,
that way if it does happen, we don't lose our entire infrastructure. Why we do this is this
setup allows us to rebuild certain parts of our infrastructure very easily, so we don't lose
critical pieces. Yeah, and then just another advantage of setting up our infrastructure this
way is it allows us to really lock down our Empire server on top of using like reverse port forwarding
to connect to the AWS server so that the Empire server can't be accessed directly from external
our network. We can also lock down it down internally because we can basically lock
everything down except for the Starkiller ports. And that way, if our network is compromised,
it limits the ability for an attacker to access the Empire server, and more importantly, access
the customer data that we're going to be handling since many times that data is extremely sensitive.
So really, the main two goals for Starkiller for us is one, we want to make our workflows
for red teams to be more efficient. And we do that by eliminating some of the menu options that were
in Empire and making them more simplified. Previously in Empire, what you had to do was you
had to memorize or go through multiple menus to be able to set up your listeners, your stagers,
and your modules. Through Starkiller, what you have now is you have these menus that are
pre-populated. Sometimes they have drop-down menus. And this makes workflows much, much easier
for teams. The second thing is the team-oriented engagements. With Empire previously, you can only
have one person logged in at a time. They're using that command line interface. And if somebody else
wanted to do an engagement, you have to stand up a completely separate server. Now with Starkiller,
you can have multiple users all using the same team server. They can share credentials. They can
share their results from their modules. And they can generate a single report for their entire
engagement. Yeah, and then just to add a little more to that, we plan on future growth for this
capability as well. But it also provides more oversight for the team lead by giving them a
centralized location to see what their operators are doing, what things have been done, as well as
when things are ran on individual boxes and that kind of thing. It gives them a centralized location
to see all that data and keep an eye on the operation as it's progressing.
So setting up Starkiller is fairly simple. When you run Empire, you're going to pass the REST
parameter, which tells it to run the REST API. There's a default login and password, which you
can change. And then to actually run Starkiller, you can either download the installer for Windows,
off of the releases page on GitHub, or there's instructions in the readme to build it from the
source. All right, thanks, guys. We're going to demo the features of Starkiller now. So Vince
has an instance set up already, back into our personal range, where Empire is already
running on a team server. And then we have Starkiller connecting into that.
Okay, so this is the Starkiller login page. I'm going to log in using the default username and
password. And we're connecting to an Empire instance that we have, that we already have running.
When I go to the settings page, we can change our password, we can turn dark mode on and off,
we have access to our API token for connecting to the Empire API. This is useful if you want to
interact with the Empire API outside of Starkiller, or if you wanted to use some
other tool like Deathstar to interact with the Empire API. The next piece is the user
management page. So on this page, we get a list of all the users that have an account for Starkiller.
We can see when they when they last logged in, and we're able to enable and disable those users.
I'm going to go ahead and create a user account for myself
with the password of password. And we can see that I now have an account.
So the next thing is the modules list page. So this page gives you a list of all of the modules
that we have access to in our instance of Empire. And using the search box, we can search down by
the name of the module, we can search down by the MITRE attack techniques, and also
the descriptions of the modules. So here I'm going to filter down by a MITRE attack technique,
and I get the two modules that are in this technique. And if I click into it,
it'll bring us to the web page for that MITRE attack technique so that we can
get more information about it. And then here, if we expand an individual module,
we can get the author information, we can get the description about that module,
and then often the comments will have a link back to the source material for that module.
Okay, so this is the listeners list page. And here we can see all the listeners that have
already been created in Empire. So let's go ahead and create another one. We're going to choose a
type. And then once we choose that type, we get the form pre-filled out with all the defaults.
And we're going to go ahead and just update this so it doesn't overlap with the previously created.
And any optional fields are just in this expandable context here.
I'm going to submit, and that listener has been created.
The next page is the stagers page. Stagers are the initial payload that we send to the agent
to initiate the connection back to our C2 server. So you can see that we already have
a couple of stagers created here. I'm going to go ahead and generate a couple more.
So the first one that I'm going to create is a multi-launcher. And we're going to have it
connect to the listener that I just created. And we're going to keep the rest of the settings the
same. Up here, I can expand the information box, and that'll give us some more info about the
stager. Okay, so that one's been created. Now I'm going to create one more. This one is going to be
downloadable DLL. And again, I'm going to choose the listener that we just created.
I'm going to hit submit. Okay, so now that we've created those two stagers, we can see
some information about it, which listener it connects back to, the language, and when it was
created. And then over here, we have the ability to copy or download. So this first one that we
generated, multi-launcher, has a little paperclip icon. And when you click that, it copies it to the
clipboard, because this is like a one-liner that you can then paste into a command prompt or your
PowerShell window. And the second one here has a download icon, because it's a file. And you can
download this file and then get that to your target, however you need to get it to them.
Yeah, and something that's really nice about this over Empire is that our stagers remain persistent,
not only for when we change between menus, but also if you log out of StarKiller and then log
back in, your agents will still be there. Because in Empire, especially when we create one-liners,
as soon as we move to another menu, it's gone. And we have to regenerate it and then cut and
paste it and save it and all those things, whereas StarKiller just keeps it all in one
place for us and saves it between sessions and all that kind of stuff, which is just
significantly more convenient than operating directly in Empire.
Okay, so now that we've sent those stagers out, we've gotten some callbacks into our Empire
server. And so that brings us to the agents list. And here we can see all of the agents that have
back to us. We can see the last time they checked in. We can see the username of the account that
we're connected to. And if we click into it, that brings us to probably the screen that you'll spend
the most time in when you're using StarKiller, which is the agent interaction screen. And this
is where I'm going to hand it off to Quinn to talk about interacting with agents.
So we have here is our agent screen, as Vince talked about before. This allows us to do our
shell commands as well as execute modules. There's a couple of nice features here. All we can see at
the bottom is Hubble actually just ran something. This interface allows multiple users to interact
with the same agent. And every command that you run is going to be tagged with the username that
you have associated with yourself. So for example, I ran earlier, I set my beacon to be delay zero,
and I ran that command under my Empire admin account. While Hubble ran, who am I? And then
got his results back. I can also go in here and I can go to shell commands. I can type in ps,
just like I would in Empire, to get my process list. It's now going to run that. It puts it in
a queue. All commands are set into a queue, regardless of who sends it, and it'll execute
that queue throughout and then drop all the results in the screen. Your results aren't just
going to be in the screen. It's also saved in a database that then gets populated on a reports
page. So everything everybody does will be aggregated together into one master log. And you
can see here, the process list just came back. So you can come in, take a look. I can scroll through
and see all the different processes that are running, as well as I can also adjust the size
of this screen if I wanted to expand it a little bit as well. Next is the modules. So you have
access to all the modules that are inside of Empire. It's nice because you don't have to
navigate all the menus. You can actually come in here and just type in exactly what you want to run.
I can type in Mimikatz. In this case, we're actually going to run Sherlock. I come in, select
Sherlock, which is a nice little tool that'll allow me to look at some privilege escalation
opportunities. We still have access to those MITRE ATT&CK techniques from before, so I can click on
those, as well as a description and information about the module I want to run. So once I hit
submit, it's going to run that module. It's going to queue it up, and then we'll get the results,
and we can see that later in the reporting function. Next, we're going to go over into
an elevated process agent. That way, we can show off another feature. So now I can come in here.
Now that I'm in an elevated process, I can go in and run some techniques that maybe I don't have
access to under a normal user, such as Mimikatz. So I'm going to go in, pull up Mimikatz. I have
all the same interface stuff, as well. I'm going to hit submit there, as well. So now both of those
are queued up, and I can see those results later inside of my reporting function.
So now we're going to look at the credentials page. And you can see here, we already have a
couple entries from running Mimikatz. And so the nice thing about this credentials page is it's
central to everybody, all of the team members engaging on this Empire server. So whether I
run Mimikatz or Hubble is getting credentials, they're all going to be dumped to this page,
and we can all see all of the credentials. And these password hashes are going to be useful to
us when we want to try to do lateral movement. Now, the last piece that we want to show you
with Starkiller is this reporting interface. It's going to show you, in order of when it ran,
when a command was run on an agent, who ran it, and what the response was. So for example,
this is the last command that was run. We can see that it was run by Empire Admin, which is me,
and we can see the agent that it was run on, and we can see the full output of that command.
And now just a side note here, you'll notice this function name is just a random five-character
string. That's one of the features that are built into Empire for keyword randomization. So this
function name is just a random five-character string. That string is typically known as
Mimikatz, and so that randomization just allows us to prevent strings that are known flags from
showing up in memory when Empire is being ran. Okay, so now if we expand another one, we can see
the output of the ps command in its entirety. And this page is really useful to the operator of the
engagement, so that they can get a holistic view of all of the different things that are going on
during the engagement. So at the bottom of Starkiller, we have links to the Empire and
Starkiller repos. We'd love to get feature requests and bug tickets that we can fix,
and we look forward to your feedback.