How empireproject/empire works
Empire is a post-exploitation command-and-control framework for PowerShell Windows agents and Python Linux/macOS agents. Its principal workflow is operator tasking through the controller, listener-mediated agent communications, and returned results; the README also highlights secure communications, deployable modules, and adaptable transports. The graph preserves those capabilities alongside staging, plugins, events, and shared protocol services. Source excerpts and the index establish several module references, but do not expose all runtime dispatch paths, so uncertain links are dashed.
Main entry points: empire.py Empire controller · agent.py Agent runtime · listeners.py Listener manager · agents.py Agent registry
Components 22
Operator control
- Empire controller
lib/common/empire.py - Agent registry
lib/common/agents.py
Agent communications
- Listener manager
lib/common/listeners.py - HTTP listener
lib/listeners/http.py - Dropbox listener
lib/listeners/dbx.py - Redirector listener
lib/listeners/redirector.py
Agent execution
- Agent runtime
data/agent/agent.py - Agent communication stagers
data/agent/stagers - Stager manager
lib/common/stagers.py - Platform stagers
lib/stagers
Post-exploitation capabilities
- Module catalog
lib/common/modules.py - PowerShell modules
lib/modules/powershell - Python modules
lib/modules/python
Shared services
- Encryption services
lib/common/encryption.py - Packet protocol
lib/common/packets.py - Event dispatch
lib/common/events.py - Plugin system
lib/common/plugins.py - Operator messages
lib/common/messages.py - Template engine
lib/common/templating.py
Other components
- Operator
- Managed hosts
- Dropbox service
Connections 28
- Operator → Empire controller: issues commands
- Empire controller → Agent registry: manages agents
lib/common/empire.py - Empire controller → Listener manager: manages listeners
lib/common/empire.py - Empire controller → Module catalog: manages modules
lib/common/empire.py - Empire controller → Stager manager: manages stagers
lib/common/empire.py - Empire controller → Plugin system: loads plugins
lib/common/empire.py - Empire controller → Operator messages: displays status
lib/common/empire.py - Module catalog → PowerShell modules: catalogs
lib/common/modules.py - Module catalog → Python modules: catalogs
lib/common/modules.py - Empire controller → Event dispatch: dispatches events
lib/common/empire.py - Listener manager → HTTP listener: provides listener
lib/common/listeners.py - Listener manager → Dropbox listener: provides listener
lib/common/listeners.py - Listener manager → Redirector listener: provides listener
lib/common/listeners.py - HTTP listener → Managed hosts: communicates
- Dropbox listener → Dropbox service: uses API
lib/listeners/dbx.py - Dropbox listener → Agent runtime: stages agent
lib/listeners/dbx.py - HTTP listener → Agent runtime: stages agent
lib/listeners/http.py - Agent runtime → Agent communication stagers: uses transport code
- Stager manager → Platform stagers: generates payloads
lib/common/stagers.py - Platform stagers → Agent runtime: delivers agent
- Agent runtime → Packet protocol: exchanges packets
- Packet protocol → Encryption services: encrypts packets
lib/common/packets.py - Agent registry → Encryption services: uses encryption
lib/common/agents.py - Agent registry → Packet protocol: processes agent packets
lib/common/agents.py - Empire controller → Template engine: uses templates
lib/common/empire.py - Empire controller → PowerShell modules: tasks capabilities
- Empire controller → Python modules: tasks capabilities
- Agent runtime → Managed hosts: executes operations