Empire post exploitation for Windows

Assuming that we have already got an agent connected to us, we will now perform post exploitation on Windows OS when the agent's security context is low. As demonstrated in the following screenshot, we have got an agent which has low privileges (high_integrity: 0):

We can elevate the privileges using the privilege escalation modules in Empire. For this scenario, we will be using the bypassuac_eventvwr module.

To execute this module, use the bypassuac command and the listener as the argument passed to bypassuac_eventvwr:

The same thing can be achieved using the following commands:

usemodule privesc/bypassuac_eventvwr 

This will bring us to the bypassuac_eventvwr menu.

Let's execute the info command to see the options available in this module:

The Listener field is required here, so let's set up the listener using the following...