[MUSIC PLAYING]
PowerShell-Empire-- in this video,
we're going to take a look at how to set up and install
PowerShell-Empire, as well as how to use it to gain access
or to exploit a Windows system.
All right.
And one of the key things that I want to highlight in this video
is the actual distinction between PowerShell-Empire
and the Metasploit framework.
Even if I've paired them within the same videos
within the same section within this course,
it's very important to understand how they differ.
All right.
So let's get an understanding of what PowerShell-Empire is.
So PowerShell-Empire, also known as Empire,
is a pure PowerShell exploitation
and post-exploitation framework that's
built on cryptological secure communications
and flexible architecture.
Empire implements the ability to run PowerShell agents
without needing PowerShell.exe, rapidly
deployable post-exploitation modules ranging from keyloggers
to Mimikatz, and adaptable communications
to evade network detection, all wrapped up
in a usability-focused framework.
Now, I want to highlight something here.
The Metasploit Framework is really
a very, very useful exploitation framework
for penetration testers, primarily because it
allows you to perform or automate
each phase of a penetration test.
And of course, we've explored this within the Metasploit
framework course.
We can literally perform information gathering,
port scanning, enumeration, vulnerability scanning,
exploitation, post-exploitation, privilege escalation,
establish persistence, dump hashes--
all of that can be performed within the Metasploit
framework.
And one of the key differences between PowerShell-Empire
and the Metasploit Framework is the Metasploit framework
can be used to exploit a plethora of operating systems
and platforms.
It can be used to exploit Windows, Linux, macOS, Unix,
BSD, as well as web applications--
so PHP, JSP, ASP, et cetera, et cetera.
Whereas PowerShell-Empire is more of a specialized
exploitation and post-exploitation framework,
that doesn't have the whole information gathering,
enumeration, and vulnerability scanning or detection
functionality built into it.
It's primarily focused on exploitation
and post-exploitation.
As the name suggests, it's primarily designed for use
with Windows targets.
Now, it's not limited to Windows targets,
but most of the additional post-exploitation
functionality, like the modules--
the ability to use Mimikatz, or to essentially
perform any other type of post-exploitation technique
is primarily limited to Windows systems.
And again, this is a framework that I really
didn't want to showcase right now, because it's
more of an advanced framework and seen
as a command and control server for Windows targets.
So again, I'm going to be showing you how to set it up,
and how you can use it to exploit a Windows system.
But again, this is something that you really
shouldn't focus on right now, because its use will become
more important as we progress, or as you progress
in your pen testing career.
It's, again, something that's used not just by pen testers,
but more specifically by red teamers.
All right.
So PowerShell-Empire recently received an update
and is now officially supported and maintained by Kali Linux.
So more information regarding the update
can be found on the link that I've
provided within the slides.
And I'll be explaining this during
the practical demonstration.
And let's take a look at Starkiller.
So you might be asking yourself, well, what's PowerShell-Empire?
And now you're introducing Starkiller.
Well, Starkiller is essentially a graphical user interface
frontend for PowerShell-Empire.
It is an Electron application written in the VueJS scripting
language, and provides users with an intuitive
way of interacting with Empire.
In order to get an understanding of how Empire works
and the components that make up the framework,
I would recommend going through the official documentation--
because I can make a complete course on PowerShell-Empire
and how it can be used, so it's quite advanced.
That's why in this video, I'm focusing on a simple scenario,
just gaining access to a Windows system.
PowerShell-Empire and Starkiller are both available as packages
in the Kali Linux repository.
So that means you don't have to go to the GitHub repository--
clone the repository and install it manually.
You can just install it via the Aptitude Package
Manager on Kali Linux.
All right, so that's what we're going
to be taking a look at now.
This video doesn't have a lab environment attached to it,
so I'm going to be performing all the techniques
within my own virtual environment.
So I have a Kali Linux VM set up,
and that's going to be the attacker system.
And I also set up a Windows 7 VM,
and that's going to be the target system.
So again, you can follow along with the demonstrations.
The objective of this video is to give you a first
introduction to PowerShell-Empire,
and essentially take you through how it works--
how the Starkiller graphical user interface works
and how you can use it to gain access.
So I'll just switch over into my Kali Linux VM,
and we can get started with the practical demonstration.
All right.
So I'm back within my Kali Linux VM.
And the first step will involve installing PowerShell-Empire
and Starkiller.
Now, this can be done through the use of the Aptitude Package
Manager, so I would recommend updating your repositories
first.
So I can say apt-get update and sudo apt-get install
powershell-empire--
that is a powershell hyphen empire--
and starkiller, like so.
Now, in my case, I already have PowerShell-Empire
and Starkiller installed, so I will not
go through the installation process.
The packages are a couple of megabytes,
so it'll take a couple of seconds to a couple of minutes,
depending on your internet connection speed.
So as I said, I already have the latest version
of PowerShell-Empire and Starkiller installed.
The next step after installing PowerShell-Empire
and Starkiller is to actually start up
the PowerShell-Empire server.
Now, what is the PowerShell-Empire server?
The PowerShell-Empire server is the back end
of the PowerShell-Empire exploitation
and post-exploitation framework, and is responsible for managing
the listeners as well as callbacks from agents--
and also the various compilation plug-ins available.
Now, as I said, you really don't need
to know what this means in depth.
All that you need to know is that this is the back end.
So how do you start it up?
You need to run the command with sudo.
So sudo powershell-empire server.
So we're starting up the server first,
and then we can start up the client
to interact with the PowerShell-Empire framework.
So I'll hit Enter.
And during your first setup, it will actually
take a couple of seconds to a couple of minutes.
So in my case, you can see it's loading the default config.
And it's then going to start up the Empire RESTful
API on port 1337.
And that is the actual API that is going to be accessed
by Starkiller, or that is used by starkiller to interact with
the PowerShell-Empire server--
and of course, the client.
And you can see right over here, it's
also going to start up the plug-in C-Sharp server.
The C-Sharp server plug-in is used to compile Windows C-Sharp
stages.
So I'll get into what stages are.
So this is your server here.
And I'll not go into the various commands
that you can essentially perform,
or that you can use in regards to interacting with the server.
But at the bottom, you can see, it's
right of the Empire team server.
You have 0 agents.
Agents are essentially target systems
that have gained access to.
You have 0 listeners.
Listeners are essentially what they are on the Metasploit
framework.
These are essentially just like a Netcat listener,
or a multi-handler.
They are essentially listening for connections
from the actual target once the stager is executed.
So a stager is just a piece of code
that is executed on a target operating system.
The stager actually contains information like the attacker's
IP address--
or in this case, the listener IP that we will be setting up.
So again, this utilizes the typical reverse-shell
communication methodology, or infrastructure, if you will.
All right.
So that is the PowerShell-Empire server.
So I'll open up a new tab.
It's important that you actually have
the PowerShell-Empire server running in order
to utilize the client.
So I think that's pretty self-explanatory.
So again, we just type in, sudo powershell-empire.
And we now type in, client.
And I'll hit Enter.
Type in my password.
There we are.
And that's going to start up the actual client.
So there we are.
Welcome to the Empire.
It's then going to connect to the actual API that
was actually referenced here on the server.
And there we are.
So welcome to PowerShell-Empire.
As you can see it has quite a similar interface
to that of MSF Console.
So you have your prompt here that,
again, tells you that you are currently
working within Empire.
It tells you that we have 390 eight modules currently loaded,
0 listeners currently active, and 0 agents currently active.
So listeners tells you how many listeners
you currently have active, and agents tells you
how many systems that you have exploited-- you currently
have access to.
So within the actual client is where
we can start typing in commands, like listeners, to list out
the listeners available, or agents, so on
and so forth-- and also stages.
But we'll get into that in a couple of seconds.
All right.
So in terms of navigating around the client,
it's very, very simple.
Let's take a look at Starkiller now.
So once you've installed Starkiller as well
as PowerShell-Empire just open up the actual menu here,
and you can search for it.
So Starkiller, there it.
The icon is in fact that of a Starkiller,
if you're familiar with what a Starkiller is.
So you can see it connects to the actual RESTful API--
the PowerShell-Empire server RESTful API.
So that's localhost port 1337.
Now, in order to log in the default credentials
that you can use to get started are Empire admin.
And the password, I believe, is password123.
So we can type in empire admin and password.
And I'll just type that in correctly-- so password123.
And we can click on remember URL and username.
So submit.
And that log you into Starkiller.
All right.
So as I said, Starkiller is a frontend
for the PowerShell-Empire framework-- more specifically,
the client side of things--
but it also provides you with functionality
that allows you to interact with the server.
So you can see that it's a very well designed interface.
And if you head over to the left,
you have a collapsible sidebar here,
that tells you the version of Starkiller.
And from this menu, you have listeners, stages, agents,
modules, credentials, reporting, users,
and plug-ins settings, about, et cetera.
So if you click on About, that will give you
information regarding this specific build of Starkiller.
On the left, you can click on Settings.
This will allow you to change or switch between dark mode
and light mode--
so whatever suits you.
You can also update your current user password.
I'd recommend doing that.
And you can also clear the application data, if you want.
And that will clear the UI preferences
and the locally-stored stages.
You then have your plug-ins.
Now, by default, you'll have three plug-ins here.
You'll have you C-Sharp server.
You'll have Websockify and Reverse Shell Stages server.
So this is a server for Reverse Shell using msfvenom
to act as stage 0.
And we then have C-Sharp server, which is an Empire C-Sharp
server for agents.
More specifically, the C-Sharp server
allows you to compile C-Sharp stages.
So it allows you to compile C-Sharp stages
for Windows targets.
Once those stages are compiled, of course, the output
will be in the form of an EXE.
Once that stager is compiled, you
can then transfer it over to the target Windows system
and execute it.
Alternatively, the stager could be a part of a larger exploit.
And yeah, so that's essentially the plug-ins there.
So I would recommend starting up the C-Sharp server.
So make sure the status is set to start, and click on Submit.
And you can see it's already started,
as we saw within the PowerShell-Empire server here.
So there we are.
It tells us plug-in C-Sharp server ran successfully.
All right.
So that's your plug-ins.
Users-- this allows you to create other users that
can access Starkiller.
So right now, we are currently empire admin.
And you can modify details pertinent to that account.
So you can change the password as you
could within the settings.
You then have reporting, which allows you--
and again, I'll not get into this right now.
It allows you to essentially start compiling or reporting
pertinent to actions that you've performed,
or tasks that you've performed on the target system.
You then have credentials.
This particular page allows you to actually view
the credentials you have been able to gather from the target
systems, or the agents that have gained access to.
And you also have the ability to create your own credential
here.
So it has great logging functionality,
that allows you to store important data
pertinent to your exploitation and the activities
involved in post-exploitation.
As for your modules, these are the available modules here.
You can see you have about 398.
I can change that to list a hundred per page.
And as I said, these are primarily
going to be, I would say, in most cases Windows
post-exploitation modules.
So you can see the modules are listed over here.
And they perform various types of functionality.
So for example, we have C-Sharp SharpSploit lateral movement
via the WMI interface on Windows.
So WMIGrunt, et cetera.
And you can actually search for specific modules.
So for example, if I was looking for persistence modules
like so, I can search for persistence modules.
And this will bring up all the available persistence modules.
And in many cases, these are primarily
designed for Windows systems.
However, at the bottom, you can see that you have your Python.
You have your various modules that
have been designed in Python specifically
for Mac OS, right over here.
So you can see OS X. And then you also
have your multi-option here.
This is for multiple operating systems,
primarily in this case for Linux or Unix.
OK.
And on the right, you can see that you have your technique
ID.
This essentially provides you with a reference
that you can then compare to with the Mitre ATT&CK
framework.
And you can essentially see what this particular module
is a part of in terms of the technique highlighted here
within the Mitre ATT&CK framework right over here.
So that's very important information.
And as I said, this is a very, very useful exploitation
framework for red teamers.
You then have your listeners, stages, and agents.
So this is very important.
Your listeners are exactly that.
They are just listeners that are going
to essentially listen for connections from your target
systems.
You then have your stages right over here.
As I've already mentioned previously,
these are essentially just pieces of code,
or executables that will be executed on the target system.
Now, how you deliver them to the target system
is entirely up to you.
They can be part of a social engineering campaign.
You can also inject some of the stages
you generate here into documents,
in the form of macros.
You can inject these stages, if they are executables,
into legitimate executables.
There are various techniques that you can use.
And then, of course, you have your agents.
So your agents, this is a dynamic page, that
will essentially show up, or bring up any of the systems
that you've exploited, or any of the systems
on which a stager has been ran on.
And agents are essentially your target systems.
And you have the ability to have more than one, up to as many
as you want.
And the information displayed, of course,
will essentially display the name--
when it was last seen, when it was first seen.
So in the event the system goes offline,
it'll display the times here.
You then have the hostname, process, architecture,
language, username, internal IP, and actions.
So let's get started with a simple scenario.
And I'll perform this through Starkiller Because as I said,
PowerShell-Empire can be quite confusing in the beginning,
especially through the CLI interface,
or through the PowerShell-Empire client interface.
So the first thing we need to do is
we need to create a listener.
So the reason we need to create a listener
is in order to receive the reverse connection
from the target system.
So we'll create a listener here.
So I'll click on Create.
You then need to specify the type.
Now, again, the type will typically
depend on your own environment that you're working on it.
It could be a Meterpreter, listener, et cetera.
However, I would typically recommend
using the HTTP, listener or the http_hop listener.
Now as I said, if you want to learn more
about these listeners and how they differ from each other,
you can check out the PowerShell-Empire documentation
page that I highlighted within the slides.
So I'll specify HTTP here.
And you then need to specify additional options.
So the name for your listener, I'll just leave that as HTTP.
And for the host, this is going to be your IP address.
So make sure that it corresponds with your Kali Linux IP.
So open up a new terminal.
And I say, ifconfig.
Just type in, kali.
There we are.
So you can see my IP address is 10.10.10.5.
And that is done.
As for the port, you can configure
this to whatever you want.
So for example, we can set this up on maybe port 1335, or 1336.
It gives you the options there.
So we can say 1335.
If we wanted to specify a bind IP option,
this allows you to specify the IP
to bind on the control server.
We're not going to go through that right now.
And we can take a look at the default delay.
So that's the agent delay reach back interval.
And the default jitter--
that is the jitter options that allows
you to specify the jitter in the agent reach back interval.
You then have your default profile right over here.
That's the default communication profile for the agent,
because it's an HTTP listener.
And the headers, you can specify whatever
header you want-- because, again, the stager is
communicating to a listener.
And because this is an HTTP listener,
you can provide headers pertinent to an HTTP web
server.
So for example, Microsoft IIS.
And then, you also have your launcher.
This is going to be the PowerShell.
These are the partial arguments that
are going to be executed-- so the launcher string.
And then, your staging key--
this is the staging key for the initial agent negotiation.
As I mentioned in the slides, there is actual encryption.
And that's one of the great features
that PowerShell-Empire provides you with.
OK.
So we'll leave all of the other options as they are.
And we can essentially change the user agent
string, or the name of the agent,
but we'll leave it as is.
And we'll click on Submit.
And you can see the new listener HTTP started.
So we can click on View there.
And if it actually doesn't reload,
then you can head over back into listeners.
And we have our listeners set up here.
OK, so our listener is set up.
The next step, of course, is to generate our stager.
So we'll click on stagers here.
And we can get started.
So I'll click on Create.
And the type in this case--
again, depending on your target operating system,
it could be a Linux system.
So in that case, you can use a bash stager.
So if you go back to the bind and reverse shell
section of this course, on the last video where
we are taking a look at the reverse shell cheat sheet,
I mentioned that the target doesn't
need to initiate a connection to the listener with Netcat.
It can also be done with a PowerShell code, bash code,
so on and so forth.
So you can see this is typically for Linux.
You also have your various OS X stages here.
But in this case, what we are primarily looking for
is the Windows stages.
And we have different types of Windows stages.
We have Windows cmd exec.
So that's a CMD code that will then
be executed on the target system within the command prompt.
We are looking for Windows C-Sharp exe.
That will generate a Windows executable, that will then
connect back to our listener.
So we'll give it the following.
We'll leave the name as is.
And the listener-- we'll specify the listener that we created--
so HTTP.
The language is C-Sharp.
You can specify the .NET version based on what version of .NET
is installed on the target system.
So in this case, we'll leave it as .NET 4.0.
The out file, this is the name of the actual stager--
so when it's generated, what do you want to call it?
So in this case, we can call it just stager, just
to keep things really simple.
If you want to add any bypasses, you can perform that.
As for obfuscation this is something
that I will not be covering right now.
This allows you to obfuscate the code
based on the actual security mechanisms and antivirus
solutions installed on the target.
Once that is all specified, you can click on Submit.
And the stager is then going to be
compiled into the final executable, called stager.exe.
So give this a couple of seconds.
There we are.
So it looks like it's done.
You can see that that has been created there.
And the listener is the HTTP listener.
You can then head over into Actions
and download the stager.
So you can see stager.exe.
So I'll save it on in my Downloads folder.
There we are.
And if I open up my Downloads folder now,
you can see that we have stager.exe.
So this stager, this contains the code
that will connect back to our listener.
Now, as I said, it can be part of a larger exploit.
And again, in terms of stages, you're
not just limited to generating executables.
Especially for Windows systems, you can generate batch files.
You also have VBS--
so VBS scripts.
And you can also generate a standard reverse shell
shellcode.
So it really is an advanced framework in that regard.
So we'll just use the one that we've generated.
We now need to transfer this over to the target.
So I'll open up my terminal here.
And we can open up a new tab.
And we want to make sure that we keep
the PowerShell-Empire server running.
So I'll navigate into my Downloads directory,
and I'll set up a simple web server with the Python
module simple HTTP server.
So there we are.
We have stager.exe.
So I'll say, sudo Python -m SimpleHTTPServer.
And I'll run this on port 80.
Provide my password.
And it looks like I need to run this with Python 3.
And that is going to be the HTTP.server.
So that was the Python 2 module-- so HTTP.server.
And I'll just type that in.
I'll give this a couple of seconds.
There we are.
So HTTP server.
Hit Enter.
And that is going to host that particular stager for us
on a simple web server that is accessible via the Kali Linux
IP.
So again, the actual method of delivering the stager
is entirely up to you, or to the attacker.
In this case, we're just taking a look at a proof of concept
as to how PowerShell-Empire works in
regards to gaining access to a target system.
So I'll now switch over to my Windows 7 VM,
and I'll download the stager.
And then, I'll execute it.
And you'll see that we should receive an agent callback.
And the target system should be displayed within agents.
So let me just switch over to the Windows 7 system.
All right, so I'm back on the Windows 7 VM.
And I'll just open up my browser to download the stager
from the actual web server that I set up on the Kali Linux
system.
So that was 10.10.10.5.
This is the IP address of my Kali Linux VM.
I'll hit Enter.
You can see that it's hosting stager.exe.
So I'll click on it to download it, save it.
And I'll save it on my desktop--
save and close.
That looks like it's downloaded successfully.
So I can now execute it.
So again, I'm currently using a user account
that is a part of the local administrators group.
And if I wanted to execute this with elevated permissions--
so if I right-click and say, run as administrator,
then I would receive a privileged agent--
whereas if I just run it standard like so--
just click on Run--
I should receive a callback on Starkiller.
So I'll just switch over to my Kali Linux VM.
So I'm back on Starkiller.
And if I click on Agents, you can
see that we get a callback from the target system.
And indeed it is the Windows 7 system.
So you can see the process is stager.
So that's the name of the executable-- so stager.exe--
the architecture, language, the username.
So we're currently win7.
That's our user-- and the internal IP.
And one important thing that I would recommend doing
is, of course, renaming this.
So you can click on an agent, and that will
allow you to interact with it.
But before we do that, you can actually click on it here,
and you can specify the actions.
And you can then view it.
Within the actual viewing options, or the interaction,
you can click on View here and rename it
to something that makes much more sense, like Windows 7--
so that you can uniquely identify it.
Once that is done, that should be saved.
Let me see.
That should be saved.
And if we go back into agents, you
can now see it's called Windows 7.
So what can you do with an agent?
An agent essentially means that you have remote access
to this target system.
So via Starkiller, if you click on it,
you can see that you can interact with the system.
You can type in a simple shell command, or CMD, command,
if you will.
So for example, who am I?
And then hit Run.
Now, it's going to say, shell command requested.
And if you click on this arrow here,
it'll actually bring up a sudo terminal,
that will display the output of a command that you've run.
So when you're using Starkiller this
may take a couple of seconds, so do be wary of that.
And again, I'm just going to give this a couple of seconds
to be executed.
But while that's being done, we can click on the file browser.
This is where things start getting interesting,
especially when you compare it to the Metasploit framework.
So it provides you with a graphical file browser
here on the system.
So I can navigate the entire file system on the target.
So if I click on the C drive here,
it will display all the directories within the C drive.
So if we go to Users and give it a couple of seconds--
because each of these commands or tasks
are being executed one by one.
And let me head over to the Windows 7 user on the desktop.
And you should see that we have the stager file
that we had copied over, just to verify that this is indeed
the system--
so desktop.
Give that a couple of seconds.
There we are.
And we have stager.exe.
So that's the file browser.
You can also upload files to the system and download files
from the system.
So if I right-click, for example, on stager,
I can say, download to empire.
And that will be saved.
I can then pop out.
Which, again, if I just click on it,
that'll open up the actual agent itself.
And that'll allow me to interact within its own window.
But I'll just click on it again.
And we can then click on the Tasks tab, which
will give you a list of tasks that you've
executed on the target system.
We can then click on View, which displays information regarding
the target system.
So right of here, that's all the information
that was being displayed within these columns here.
So we can click on a system.
And we can also execute a module,
if we wanted to perform any type of post-exploitation technique.
So for example, if we wanted to set up assistance,
we can use any of the persistence modules, et cetera.
Now, in some cases, you will have an issue
with the shell commands being executed,
so you may have to revert to the actual PowerShell-Empire
client.
I'm currently within the client, you
can see it highlights the fact that a new listener was started
and a new agent actually checked in.
And then, you can see it's going to send
the agent and the second stage to the target for execution.
So we can say, for example, agents, and hit Enter.
And it'll display the active agents here.
And we can then say, interact with the agent--
so in this case, Windows 7--
and hit Enter.
And this is the output of all the commands that we executed.
This output may not make sense to you,
but this is all the actual file navigation
that we were performing.
So when we were navigating through the directories,
this is the output via the PowerShell-Empire client,
as opposed to Starkiller.
We can also see that the first command that we run--
the who am I command--
actually returned the output here.
So again, if we wanted to run a command now,
you can open up the Help menu.
So if I say, help, for example, that
will give you a list of commands that you can run on the target.
So again, if I wanted to run a command--
and I'm currently using the system here.
So I can say, for example, ipconfig here and hit Enter.
And I'll just give this a couple of seconds.
And the output of that command should be displayed
in a couple of seconds.
Now, as I said, a PowerShell-Empire agent really
doesn't provide you with real-time feedback
like a Meterpreter session would.
And again, you also have the ability
of setting up a Meterpreter listener,
so that you obtain an Meterpreter session.
And that is all handled from within PowerShell-Empire.
So again, if I just say, interact with Windows 7
again here, in some cases, it may actually
take a while for that to be displayed.
So let me hit Exit here.
No, I don't want to exit from the actual client.
If I just list out, for example, the agents
here, and I say, interact with Windows 7,
it doesn't look like the output is
being displayed for the command that we ran earlier.
So let's use the View option here,
which should display the historical view of everything
that was executed.
As I said, in some cases, it may actually
take a couple of seconds.
If it doesn't, just give it a couple of seconds.
And you can also use the history command.
So that will display the last number of tasks results.
So we can say, history--
there we are.
And you can see that we pretty much have
the directory navigation here.
And it looks like it didn't execute the IP config.
So let's try and run that here.
So we go back into Starkiller and say, IP config,
and hit Run.
That's going to be queued and then executed.
So if we say, history, again, that
should display the IP config information.
As I said, you pretty much want to give it a couple of seconds.
So I'll just give this a couple of seconds now.
So after a couple of seconds, you
can see the ipconfig command is executed.
And it essentially provides us with the networking information
on the target system.
So as I said, PowerShell-Empire is really
used for long-term engagements.
And that's why I mentioned that it's used specifically
by red teamers, in that it allows you to maintain
persistent access on target systems for as long
as you require--
and it provides you with extremely useful
post-exploitation modules, that you will typically not
find on the Metasploit framework.
So I just wanted to give you an introduction
to PowerShell empire and Starkiller.
And again, you can follow along with the techniques.
It really is very simple to replicate.
You just need a Kali Linux VM and another Windows VM,
or a Windows system, and you can follow along
with the proof of concept that I just highlighted.
And I would recommend that you actually
explore the different types of listeners-- learn how they work
and how they differ from one another, as well
as the various types of stages you can generate-- and also
try and gain access to Linux systems.
With that being said, that's going
to conclude the practical demonstration
side of this video.
All right.
So that concludes the Exploitation Frameworks section
of this course.
You should now have a good understanding
of what the Metasploit Framework is
and how it differs from the PowerShell-Empire framework.
So in the next section, we're going
to begin the Windows exploitation section, where
we'll be taking a look at how to exploit Windows
systems in the context of a simulated black-box penetration
test.
So we're actually going to go through the process
of exploiting a Windows system with the objective of exploring
as many exploitation vectors as possible.
And it's really going to be awesome,
and you guys will have a lot of fun with it.
So I'll see you in the next section.