v6.1.3

[6.1.3] - 2025-07-11

• Updated Starkiller to v3.0.1
• Fixed PowerShell agent having base64 encoded Cookie name for HTTP listener

v6.1.2

[6.1.2] - 2025-05-21

Added

• Added support for Ubuntu 24.04 in the install script

Fixed

• Fixed issue launching powershell on some distros by installing libicu

[6.1.1] - 2025-05-21

Fixed

• Fix issue caused by ordering of API routers

[6.1.0] - 2025-05-20

Changed

• Use pyyaml's C extension for loading/dumping module yamls to make startup and tests faster
• Simplified Dockerfile by using TARGETARCH variable
• Cleanup API code
• Use a new version of donut that supports arm64
• Update all deps

Removed

• Remove unused files

v6.0.3

[6.0.3] - 2025-04-24

• Fixed SMB listener not sending start task
• Fixed ironpython shell commands running as cmd instead of powershell
• Added literal interpretation for shell commands to ironpython agent
• Fixed multi_launcher not being able to build smb agent
• Removed linux as go agent option as its not implemented yet

v6.0.2

[6.0.2] - 2025-04-07

• Fixed issue where C# modules on powershell agent would be improperly formatted
• Fixed SharpWMI argument errors when using escaped quotes
• Updated result parser on SharpWMI to not use StreamWriter due to messing up results

v6.0.1

[6.0.1] - 2025-04-03

Fixed

• Fixed issue generating Sharpire exes

v6.0.0

Common Issues

Issue

Current Python version (3.12.2) is not allowed by the project (>=3.13,<3.14).
Please change python executable via the "env use" command.

Solution:

sudo rm -rf .venv
poetry install

Issue

[*] Updating goenv
fatal: not a git repository (or any of the parent directories): git

Solution:

Open a new terminal, the install script should have set $GOENV_ROOT in your bashrc or zshrc file.

[6.0.0] - 2025-03-25

• Updated Starkiller to v3.0.0

Highlights

• Plugin Marketplace
• Go agents
• Empire Compiler for C#
• Command line client removed

Added

• Added support for plugin registries and installing plugins via the API
  • See the Plugin Marketplace in Starkiller 3.0!
• New allow/deny list implementation that properly supports IPv4, IPv6, Ranges, and CIDRs
• Added API endpoints for managing autorun commands on agent checkin
• Added api.ip and api.secure as server config options
• Added Go agents
  • Added Go to install script
  • Added new stager type multi_go_exe
  • Added Go is an option for multi_launcher
  • Added new compiler class GoCompiler
• Added -f flag for install script to force install as root
• Added dynamic options to modules
• Added module code_execution/invoke-script for remote ps1 script execution
• Added module python/code_execution/invoke-script for remote py script execution
• Added sharphound ingestor for CE and tagged bloodhound with legacy
• Added check that module can be ran on the agent based on language

Changed

• Changed minimum Python version to 3.13
• Updated module_service logic for tasking types
• Swapped C# module RunOF for COFFLoader
• Updated parsing for bof formatting to use bof_pack
• Moved bash and pyinstaller stagers to linux folder
• Change formatter to ruff to consolidate developer tooling
• Revised the staging process for agents. Session IDs are provided by the server and all packets are wrapped in routing packets.
  • Updated stageless agents to work with python, ironpython, and powershell with the new staging process.
• Updated tactics and techniques on all modules
• Added a yaml formatter and run pre-commit across all files
• Combined config with config_manager
• Converted many parts of codebase to be compliant with flake8-use-pathlib
• Csharp and bof tasks attach the executable as a 'download' with a tag 'task:input'
• Pass output path to dotnet compiler, only compile the requested version
• Limited staging key space to letters and numbers to avoid invalid combinations

Breaking

• Many improvements to plugins - see the plugin-development wiki page
• Moved Agents class to AgentCommunicationService
  • Refactored many of the functions and parameter names
• Moved Stagers class to StagerGenerationService
  • Refactored many of the funtions and parameter names
• Moved Plugin Task handling from PluginService to PluginTaskService
• Moved socks management to AgentSocksService
  • Renamed socks properties on AgentSocksService to use plural naming
• Removed update_lastseen parameter from handle_agent_request
• Renamed all config properties in client and server configs to use snake_case
• Starkiller is now accessed at {api_url}/ instead of {api_url}/index.html
• ip_whitelist and ip_blacklist are now ip_allow_list and ip_deny_list and are lists instead of comma separated strings
• Using a new and improved [Empire-Compiler] for C# compilation
  • Downloads pre-compiled Empire-Compiler to eliminate dotnet as an OS dependency
  • Updated shortened task results to show the C# command ran and full input to show directory of the file
  • Updated C# tasks into folders and split yaml configs to be one per module and match Empire yaml format
  • All C# module code has been moved as submodules of Empire-Compiler
  • Moved EmpireCompiler compression from application to the server
  • Moved EmpireCompiler from install script to startup with autoupdate functionality
  • Replaced csharpserver plugin with DotnetCompiler class in empire.server.common
• module_service.execute_module returns a pydantic model
• agent_task_service functions take a user model instead of user id
• All writeable data moved out of the install path into ~/.local/share/empire

Deprecated

Removed

• Removed autorun config options which haven't been used since Empire 3
• Removed install support for Debian 10
• Removed nim stager from Empire and install script
• Removed slack notifications from listeners
• Removed the following stagers
  • osx/pkg
  • windows/backdoorlnkmacro
  • windows/launcher_lnk
  • windows/launcher_sct
  • windows/ms16-051
  • windows/reverseshell
• Removed the following listeners
  • HTTP COM only supports powershell agent and uses an older COM object that isn't used often
  • OneDrive has new APIs and Microsoft hs made registration harder. May return in the future with revisions.
  • Dropbox has new APIs and may return in the future with revisions.
• Removed empire_config.directories.module_source and empire_config.directories.obfuscated_module_source
• Removed BLANK and RANDOM options for staging_keys (wasn't documented anyway)

Breaking

• Removed the command line client. Use Starkiller instead.
• Removed Listeners class
• Removed Credentials class
• Removed functions from Agents class that were marked as deprecated in 5.x
• Removed --restip and --restport options from the command line. Use the config file instead.
• Removed socketport config option on the client which was no longer being used
• Removed script and module upload to memory in favor of modules with same functionality
• Removed reverseshellserver plugin

Fixed

• Fixed Powershell agent overwritting results for C# taskings
• Simplify option_util.validate_options, fixes a bug where an optional file option was treated as required
• Fixed issue loading a plugin that has multiple files
• Fixed issue with permissions caused by git operations being done with de-elevated permissions
• Fixed go agent using a preshared session id

Security

v6.0.0-rc1

To install:

git clone --recursive --branch v6.0.0-rc1 [email protected]:BC-SECURITY/Empire.git
cd Empire
./ps-empire install -y
./ps-empire server

If you are updating from an existing install, you may need to rm -rf the existing .venv in the project directory.
You may also need to remote some submodules that are no longer in the repository rm -rf empire/server/csharp empire/server/plugins/ChiselServer-Plugin empire/server/plugins/Report-Generation-Plugin empire/server/plugins/SocksProxyServer-Plugin

---

[6.0.0-rc1] - 2025-03-09

• Updated Starkiller to v3.0.0-rc1

Highlights

• Plugin Marketplace
• Go agents
• Empire Compiler for C#
• Command line client removed

Added

• Added support for plugin registries and installing plugins via the API
  • See the Plugin Marketplace in Starkiller 3.0!
• New allow/deny list implementation that properly supports IPv4, IPv6, Ranges, and CIDRs
• Added API endpoints for managing autorun commands on agent checkin
• Added api.ip and api.secure as server config options
• Added Go agents
  • Added Go to install script
  • Added new stager type multi_go_exe
  • Added Go is an option for multi_launcher
  • Added new compiler class GoCompiler
• Added -f flag for install script to force install as root
• Added dynamic options to modules
• Added module code_execution/invoke-script for remote ps1 script execution
• Added module python/code_execution/invoke-script for remote py script execution
• Added sharphound ingestor for CE and tagged bloodhound with legacy

Changed

• Changed minimum Python version to 3.13
• Updated module_service logic for tasking types
• Swapped C# module RunOF for COFFLoader
• Updated parsing for bof formatting to use bof_pack
• Moved bash and pyinstaller stagers to linux folder
• Change formatter to ruff to consolidate developer tooling
• Revised the staging process for agents. Session IDs are provided by the server and all packets are wrapped in routing packets.
  • Updated stageless agents to work with python, ironpython, and powershell with the new staging process.
• Updated tactics and techniques on all modules
• Added a yaml formatter and run pre-commit across all files
• Combined config with config_manager
• Converted many parts of codebase to be compliant with flake8-use-pathlib
• Csharp and bof tasks attach the executable as a 'download' with a tag 'task:input'
• Pass output path to dotnet compiler, only compile the requested version

Breaking

• Many improvements to plugins - see the plugin-development wiki page
• Moved Agents class to AgentCommunicationService
  • Refactored many of the functions and parameter names
• Moved Stagers class to StagerGenerationService
  • Refactored many of the funtions and parameter names
• Moved Plugin Task handling from PluginService to PluginTaskService
• Moved socks management to AgentSocksService
  • Renamed socks properties on AgentSocksService to use plural naming
• Removed update_lastseen parameter from handle_agent_request
• Renamed all config properties in client and server configs to use snake_case
• Starkiller is now accessed at {api_url}/ instead of {api_url}/index.html
• ip_whitelist and ip_blacklist are now ip_allow_list and ip_deny_list and are lists instead of comma separated strings
• Using a new and improved [Empire-Compiler] for C# compilation
  • Downloads pre-compiled Empire-Compiler to eliminate dotnet as an OS dependency
  • Updated shortened task results to show the C# command ran and full input to show directory of the file
  • Updated C# tasks into folders and split yaml configs to be one per module and match Empire yaml format
  • All C# module code has been moved as submodules of Empire-Compiler
  • Moved EmpireCompiler compression from application to the server
  • Moved EmpireCompiler from install script to startup with autoupdate functionality
  • Replaced csharpserver plugin with DotnetCompiler class in empire.server.common
• module_service.execute_module returns a pydantic model
• agent_task_service functions take a user model instead of user id
• All writeable data moved out of the install path into ~/.local/share/empire

Deprecated

Removed

• Removed autorun config options which haven't been used since Empire 3
• Removed install support for Debian 10
• Removed nim stager from Empire and install script
• Removed slack notifications from listeners
• Removed the following stagers
  • osx/pkg
  • windows/backdoorlnkmacro
  • windows/launcher_lnk
  • windows/launcher_sct
  • windows/ms16-051
  • windows/reverseshell
• Removed the following listeners
  • HTTP COM only supports powershell agent and uses an older COM object that isn't used often
  • OneDrive has new APIs and Microsoft hs made registration harder. May return in the future with revisions.
  • Dropbox has new APIs and may return in the future with revisions.
• Removed empire_config.directories.module_source and empire_config.directories.obfuscated_module_source

Breaking

• Removed the command line client. Use Starkiller instead.
• Removed Listeners class
• Removed Credentials class
• Removed functions from Agents class that were marked as deprecated in 5.x
• Removed --restip and --restport options from the command line. Use the config file instead.
• Removed socketport config option on the client which was no longer being used
• Removed script and module upload to memory in favor of modules with same functionality
• Removed reverseshellserver plugin

Fixed

• Fixed Powershell agent overwritting results for C# taskings
• Simplify option_util.validate_options, fixes a bug where an optional file option was treated as required
• Fixed issue loading a plugin that has multiple files
• Fixed issue with permissions caused by git operations being done with de-elevated permissions

Security

v5.12.2

[5.12.2] - 2025-01-12

Fixed

• Fixed issue with C# exe and shellcode not compiling PowerShell stagers
• Fix delay/jitter adjustment in python agent (@janit0rjoe)

v5.12.1

[5.12.1] - 2025-01-08

Fixed

• Fixed issue with install script caused by Poetry 2.0

v5.12.0

[5.12.0] - 2024-12-14

• Reduce the check-in tests that were adding an unncessary amount of time to the CI
• Allow Python 3.13 to be used
• Fix python install
• Support Empire for system-wide deployment (@D3vil0p3r)
• Paths specified in config.yaml where user does not have write permission will be fallback to ~/.empire directory and config.yaml updated as well (@D3vil0p3r)
• Invoke-Obfuscation is no longer copied to /usr/local/share