NullException0

Introduction I’m always want to have my own lab that can mimic enterprise monitoring at home which include EDR (Endpoint Detection and Response), SIEM (Security Information and Event Management), case management and have a threat intel platform. It must be something that can be built from open source and free... Since there is significant upgrade on my personal workstation, I’m able to ramp up my virtualization capacity to support my endeavor. let’s gooooo! Network & Resources Allocation For this lab, everything will be deployed in virtual machine (VM) and in private network, simple. These are minimum specification I used in this lab; you can allocate more if you have more resources. CPU: 2 cores Network: bridged connection and replicate physical network connection state Storage: 80 GB RAM: 8 GB (For both Ubuntu VM, I’m allocating 16GB for better performance) Architectural & System Design Refer to the diagram above We will deploy two (2) Ubuntu 20.04 Desktop a...

So for this entry, we will pickup where we left off. If you not yet read part 1 you can read it here:  Powershell Empire :  Swiss-Army Knife for Windows Post-Exploitation (Part 1) . I apologize for taking some time to post this due to other commitment and now I have the time to finish this series as I currently on long holiday. To summarize the previous post, we have covered about Empire components and what it do, how to create listener, generating stager, execute the stager, getting connected with the agents and exiting Empire gracefully. So now, we will explore on how to performing post exploitation using module in Empire and do housekeeping tasks on the agents. Side note here, some example shown might have different agent name due to connection lost. But, the essence of the activity and the principal of the action is still the same. Managing Agents To view, list and start interacting with agents registered to your Empire, use command agents . In figure 1, you can see there ...