Empire 5.2 Release Notes

In cybersecurity, tools evolve rapidly as defenders and attackers adapt to an ever-changing landscape. Empire 5.2 continues this tradition by delivering new features, enhancements, and bug fixes that further streamline your experience.

Let’s dive into the release notes and explore what’s new.

New Features

Plugin Tasks: Empire 5.2 introduced new plugin functionality by Vinnybod, including plugin tasks and task endpoints. The new tab allows you to queue tasks directly to a plugin and view their outputs right from Starkiller.

Updates

Flask Server Double Header Issue: A duplicate Server Header issue caused by Flask has been fixed, removing a key indicator from Empire’s HTTP responses. Previously, both the Python and Microsoft IIS headers were visible when inspecting network traffic. A deeper dive into this issue will be covered in an upcoming blog post.

Donut Update: The Donut module has been updated to v1.0.2.

Nim Version Lock: The Nim version has been locked in the install script to ensure proper compatibility during installation.

Powerview Module Update: Dynamic detection on overhead functions that use PowerView has been fixed again and now uses ZeroDayLab’s PowerSploit version.

Task and Tasking Terminology Update: To reduce confusion:

• tasks → AgentTasks
• tasking → task

Note: Hook names remain unchanged.

Fixes

Improved Install Path Handling: Resolved an issue where the install path wasn’t properly referenced in the database. Switching Empire instances (e.g., GitHub vs. Kali) should now work without errors.

OneDrive Listener Fixes: Multiple OneDrive listener bugs introduced in Empire 5.0 have been fixed. Full functionality has been restored.

Docker Fix for Starkiller: Thanks to 0x4xel, a Starkiller error occurring in Docker environments has been resolved, ensuring smoother compatibility between Starkiller and Docker.

Malleable C2 IronPython Agent Fix: The Malleable C2 module now correctly generates IronPython agents.

Conclusion

We encourage everyone to update to the latest version of Empire. The Empire team thanks all contributors for their hard work and dedication to this release.

Happy hacking!