Merge pull request #823 from BC-SECURITY/release/6.6.0

v6.6.0 into main

Author: vinnybod

.github/workflows/lint-and-test.yml

@@ -76,15 +76,15 @@ jobs:
         run: |
           set -o pipefail
           if [ "${{ matrix.python-version }}" = "3.14" ]; then
-            DATABASE_USE=mysql poetry run pytest -v --runslow --cov=empire/server --junitxml=pytest.xml --cov-report=term-missing:skip-covered . | tee pytest-coverage.txt
+            DATABASE_USE=mysql poetry run pytest -v --runslow --durations=10 --cov=empire/server --junitxml=pytest.xml --cov-report=term-missing:skip-covered . | tee pytest-coverage.txt
           else
-            DATABASE_USE=mysql poetry run pytest -v --runslow .
+            DATABASE_USE=mysql poetry run pytest -v --runslow --durations=10 .
           fi
       - name: Run test suite - sqlite
         if: ${{ startsWith(github.head_ref, 'release/') || contains(github.event.pull_request.labels.*.name,
           'test-sqlite') }}
         run: |
-          DATABASE_USE=sqlite poetry run pytest . -v --runslow
+          DATABASE_USE=sqlite poetry run pytest . -v --runslow --durations=10 -m "not mysql"
       - name: Pytest coverage comment
         if: ${{ matrix.python-version == '3.14' }}
         uses: MishaKav/pytest-coverage-comment@v1.2.0

.gitignore

@@ -19,6 +19,7 @@ empire/server/api/static/*
 empire/server/api/v2/starkiller-temp
 empire/server/api/v2/starkiller
 empire/server/Empire-Compiler
+loader.bin
 
 # client
 empire/client/generated-stagers/*

CHANGELOG.md

@@ -15,8 +15,70 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 -   Fixed background jobs for the python agent.
 
-## [6.5.0] - 2026-03-08
--   Updated Starkiller to v3.4.0
+## [6.6.0] - 2026-04-25
+-   Updated Starkiller to v3.5.0
+
+### Added
+
+-   Added 8 new modules (7 PowerShell, 1 Python) based on Atomic Red Team to fill partial ATT&CK coverage gaps: thread execution hijacking (T1055.003), cached domain credentials (T1003.005), Safe Mode boot defense evasion (T1562.009), default file association hijack (T1546.001), screensaver persistence (T1546.002), Office template macro injection (T1137.001), Wi-Fi credential extraction (T1555, T1016.002), and Linux proc filesystem credential dumping (T1003.007)
+-   Added 16 new modules (13 PowerShell, 3 Python) based on Atomic Red Team for ATT&CK gap coverage: mshta execution (T1218.005), CHM execution (T1218.001), CMSTP UAC bypass (T1218.003), InstallUtil execution (T1218.004), regasm execution (T1218.009), msiexec execution (T1218.007), indirect command execution (T1202), browser cookie theft (T1539), base64 file encoding (T1027), compile-after-delivery (T1027.004), root certificate installation (T1553.004), hidden user creation (T1564.002), Python startup hooks (T1546.018), Windows Terminal profile persistence (T1547), exfiltration over alternative protocols (T1048.003), and Linux at job scheduling (T1053.002)
+-   Added 25 new modules (19 PowerShell, 6 Python) based on Atomic Red Team for ATT&CK gap coverage: clear command history (T1070.003), impair history logging (T1562.003), disable firewall (T1562.004), hide artifacts (T1564.001), FSUtil indicator removal (T1070), network share removal (T1070.005), rename system utilities (T1036.003), masquerading (T1036, T1036.005), rundll32 proxy execution (T1218.011), regsvr32 proxy execution (T1218.010), signed script proxy (T1216), jsc.exe compilation (T1127), BITS jobs (T1197), logon script persistence (T1037.001), VM detection (T1497.001), system language discovery (T1614.001), web beaconing (T1071.001), and local data staging (T1074.001)
+-   Added `./ps-empire test` command as a convenience wrapper for pytest with passthrough arguments
+-   Added Alembic database migration framework for versioned schema management. Untracked databases are stamped at the baseline revision on first startup; already-tracked databases are left as-is so pending migrations can be applied. Includes `migrate_db()` and `backup_db()` functions for future update workflows.
+-   Added configurable MySQL connection pool settings (`pool_size`, `max_overflow`, `pool_pre_ping`, `pool_recycle`) via server config YAML
+-   Added pool health monitoring that warns at 80% capacity
+-   Added `mysql` pytest marker for tests requiring MySQL and Docker
+-   Added performance test suite (`empire/test/test_performance/`) for pool exhaustion and event loop blocking regression testing
+-   Added performance tests for module obfuscation (event loop blocking detection, latency measurement, pre-obfuscation latency)
+-   Added `POST /api/v2/obfuscation/modules/preobfuscate` endpoint for targeted pre-obfuscation of specific modules by ID (runs in background, returns 202)
+-   Added `strict` and `suggested_values` to boolean switch options in modules for better validation and UI hints
+-   Added dynamic `depends_on` options to stagers so dependent fields (e.g. `Bypasses`, `Obfuscate`, `ObfuscateCommand`) are shown/hidden based on the selected listener type
+-   Added `nanodump` BOF module for creating minidumps of the LSASS process using various evasion techniques (handle duplication, process forking, snapshot, seclogon handle leaking)
+-   Added 7 new BOF modules sourced from Sliver Armory for defense evasion and credential access:
+    -   `unhook` — refresh DLLs to remove EDR/AV API hooks (T1562.001)
+    -   `patchit` — all-in-one AMSI + ETW patch/check/revert (T1562.001)
+    -   `inject_amsi_bypass` — AMSI bypass in a remote process via syscalls (T1562.001)
+    -   `inject_etw_bypass` — ETW bypass in a remote process via syscalls (T1562.001)
+    -   `credman` — dump Windows Credential Manager via SeTrustedCredManAccess (T1555.004)
+    -   `handlekatz` — LSASS dump via handle duplication to evade handle-based detection (T1003.001)
+    -   `bofroast` — Kerberoasting as a BOF without .NET CLR dependency (T1558.003)
+-   Added multi-language stager support (powershell, csharp, ironpython, go) to UAC bypass privesc modules: `bypassuac`, `bypassuac_env`, `bypassuac_eventvwr`, `bypassuac_sdctlbypass`, `bypassuac_wscript`
+-   Added configurable `obfuscation.timeout` setting (default: 300s, set to 0 to disable) for the PowerShell obfuscation subprocess, settable via `config.yaml` or `EMPIRE_OBFUSCATION__TIMEOUT` env var
+
+### Changed
+
+-   Agent check-in uses single INSERT with ON DUPLICATE KEY UPDATE / ON CONFLICT DO NOTHING instead of SELECT-then-INSERT (2 queries → 1)
+-   All FastAPI route handlers converted from `async def` to `def`. FastAPI now dispatches every handler to a thread pool, preventing synchronous SQLAlchemy calls from blocking the uvicorn event loop. Handlers that previously offloaded work via `asyncio.to_thread()` no longer need to — the thread pool provides the same isolation automatically.
+-   High-frequency hooks (`AFTER_AGENT_CALLBACK_HOOK`, `AFTER_TASKING_RESULT_HOOK`, `AFTER_AGENT_CHECKIN_HOOK`, `AFTER_TASKING_HOOK`) now fire with `None` as the session argument. `_run_async_hook` and `run_hooks` provide a fresh managed session to hook callbacks, eliminating the 2x connection amplification that occurred when hooks opened a second connection while the caller still held the first.
+-   Cleaned up redundant "Switch." prefixes and duplicate description text from module option descriptions
+-   Marked `Listener` and `Command` options as conditionally required in 7 lateral movement modules (`invoke_psexec`, `invoke_wmi`, `invoke_smbexec`, `invoke_dcom`, `invoke_psremoting`, `inveigh_relay`, `invoke_executemsbuild`) so they are validated when their `depends_on` condition is met
+
+### Removed
+
+-   Removed legacy `archive` field from `empire_compiler` config; use `repo` and `ref` instead
+
+### Fixed
+
+-   Fixed flaky `test_pool_exhaustion_at_concurrency_levels[250]` CI failures by marking the 250-concurrency case with `pytest.mark.flaky(reruns=2)` via the new `pytest-rerunfailures` dev dependency. The assertion is preserved exactly (250 stays 250), so a real throughput regression still fails all retries while transient CI resource contention clears on rerun.
+-   Fixed DB pool exhaustion under concurrent load causing 503/504 cascading failures. The root cause was hook connection amplification: async hooks called inside DB session blocks opened a second pool connection via `_run_async_hook` while the caller still held the first, doubling connection usage per check-in.
+-   Fixed event loop blocking across all API endpoints. Previously only stager, listener, and plugin endpoints were addressed; now all 216 handlers use `def` to prevent any synchronous DB call from blocking the event loop.
+-   Fixed `donut-shellcode` failing with "Cannot open file" when a root-owned `loader.bin` exists in the working directory, breaking all shellcode generation tests and stager paths. Donut calls now run in an isolated temp directory via a shared `donut_create()` utility with a threading lock for concurrency safety.
+-   Fixed unnecessary GitHub API call on every server startup when the compiler is already cached locally
+-   Fixed unhandled `TagInvalidException` in `parse_routing_packet` that caused request crashes from stale agents or non-agent traffic
+-   Fixed `TypeError` in BOF module parameter packing when integer values were passed to options that require space-checking
+-   Fixed module option descriptions for `Obfuscate` and `ObfuscateCommand` that contained redundant text
+-   Fixed `evaluate_dependencies` crashing when `DependsOn` key exists but is `None`
+-   Fixed strict option validation crashing when `SuggestedValues` is `None`
+-   Fixed options with unmet `depends_on` conditions being excluded from params, causing `KeyError` in module `generate()` functions — they now pass through with their default value
+-   Fixed broken `revert_options` logic in `stager_service` that assigned entire option dicts as values, causing circular reference errors during JSON serialization
+-   Fixed `invoke_ntsd` module setting stager options without the `["Value"]` key, causing `TypeError` during launcher generation
+-   Fixed `invoke_executemsbuild` `Command` option `depends_on` pointing to `Payload=Empire` instead of `Payload=Manual`, and added missing `depends_on` for `Listener`
+-   Fixed agent staging log messages displaying wrong language (e.g. "Python PUB key" for PowerShell agents, "PS" in C# block) by replacing hardcoded language names with the actual agent language
+-   Fixed incorrect log levels in agent communication: `log.error` for normal conditions (agent not active, agent exiting) downgraded to `log.debug`/`log.info`, `log.info` for invalid data (bad language spec, malformed sysinfo) upgraded to `log.warning`
+-   Fixed typo in SOCKS client error message ("failed to started" -> "failed to start")
+-   Fixed double-obfuscation in PowerShell module script generation — when a module source was already obfuscated (via `get_module_source` or `auto_get_source`), `finalize_module` was re-obfuscating the entire combined script, spawning a redundant PowerShell subprocess per task. `finalize_module` now accepts `script_already_obfuscated` to skip the expensive re-obfuscation while still obfuscating the invoke command (`script_end`).
+-   Fixed obfuscation subprocess (`Invoke-Obfuscation`) running indefinitely with no timeout. Added 300s timeout, process group isolation (`start_new_session`), return code checking, and empty output validation. On failure, gracefully falls back to keyword-obfuscated script with error logging.
+-   Fixed background jobs for the python agent.
 
 ## [6.5.0] - 2026-03-08
 -   Updated Starkiller to v3.4.0
@@ -29,6 +91,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 -   Added `clipboard_window_inject_list` BOF module for enumerating processes with clipboard window class
 -   Added PIC shellcode C template and linker script for MinGW-based shellcode compilation
 -   Added unit tests for `shellcode_compiler` and rewrote `test_bof_packer` to cover the new `Packer` class API
+-   Added `repo` and `ref` fields to `empire_compiler` config, replacing the hardcoded archive URL with GitHub Releases API asset discovery
+-   Added unit tests for compiler platform resolution and download URL logic
 -   Added a runtime `Background` option to C# modules, allowing operators to override background/foreground execution at task time
 -   Added C# PatchETW module for in-process ETW patching via ntdll!EtwEventWrite
 -   Added C# PatchlessAMSI module for patchless AMSI bypass using hardware breakpoints and vectored exception handling
@@ -37,6 +101,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 -   Added Python linux_keyring module for credential extraction from the Linux kernel keyring subsystem
 -   Added Python aws_imds module for AWS IAM role credential theft via EC2 Instance Metadata Service
 -   Added BOF `spawn` module for EarlyBird process hollowing with suspended process creation, shellcode injection, and APC thread hijacking
+-   Agent "got results" log message now includes the task ID for easier post-mortem correlation
 
 ### Changed
 
@@ -1337,7 +1402,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 -   Updated shellcoderdi to newest version (@Cx01N)
 -   Added a Nim launcher (@Hubbl3)
 
-[Unreleased]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.5.0...HEAD
+[Unreleased]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.6.0...HEAD
+
+[6.6.0]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.5.0...v6.6.0
 
 [6.5.0]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.4.1...v6.5.0
 

alembic.ini

@@ -0,0 +1,5 @@
+[alembic]
+script_location = empire/server/core/db/alembic
+# Database URL is resolved programmatically in env.py
+# using the existing Empire configuration system.
+sqlalchemy.url =

conftest.py

@@ -16,16 +16,23 @@ def pytest_addoption(parser):
 def pytest_configure(config):
     config.addinivalue_line("markers", "slow: mark test as slow to run")
     config.addinivalue_line("markers", "no_docker: mark test as failing in docker")
+    config.addinivalue_line(
+        "markers", "compiler: requires C# compiler (EmpireCompiler)"
+    )
+    config.addinivalue_line(
+        "markers", "mysql: mark test as requiring MySQL (and Docker)"
+    )
 
 
 def pytest_collection_modifyitems(config, items):
     if config.getoption("--runslow"):
         # --runslow given in cli: do not skip slow tests
-        return
-    skip_slow = pytest.mark.skip(reason="need --runslow option to run")
-    for item in items:
-        if "slow" in item.keywords:
-            item.add_marker(skip_slow)
+        pass
+    else:
+        skip_slow = pytest.mark.skip(reason="need --runslow option to run")
+        for item in items:
+            if "slow" in item.keywords:
+                item.add_marker(skip_slow)
 
     if config.getoption("--nodocker"):
         # --nodocker given in cli: skip tests that fail in docker

docs/SUMMARY.md

@@ -45,6 +45,7 @@
     * [Main Agent Class](agents/go/mainagentclass.md)
     * [Packet Handler Class](agents/go/packethandlerclass.md)
     * [Main.go Template](agents/go/template.md)
+  * [C](agents/c/README.md)
   * [Staging](agents/staging.md)
 * [RESTful API](restful-api/README.md)
   * ```yaml

docs/agents/README.md

@@ -27,6 +27,21 @@ The Go agent (`Gopire`) is designed for use in environments where Go is advantag
 
 Additional documentation on the agent can be found [here](./go/README.md).
 
+## C Agent
+The C agent (`Cpire`) is an experimental native agent modeled after the Go agent. It compiles into a standalone binary and supports Windows and Linux targets. **Currently, the C agent supports the HTTP listener only.**
+
+The C agent is only available in the [Sponsors](https://github.com/sponsors/BC-SECURITY) version of Empire.
+
+### Features
+- Cross-platform: supports Windows and Linux targets.
+- Native compiled binary with no runtime dependencies.
+- Runs PowerShell, C#, BOF, and shell taskings.
+- Full DH key exchange staging with Ed25519 certificate verification.
+- File download/upload and directory listing.
+- Agent controls: delay/jitter, kill date, working hours, lost-limit enforcement.
+
+Additional documentation on the agent can be found [here](./c/README.md).
+
 ## PowerShell Agent
 The PowerShell agent is the original agent for Empire.
 

docs/agents/c/README.md

@@ -0,0 +1,79 @@
+# C Agent Overview
+
+The C agent (`Cpire`) is an experimental native agent for Empire, modeled after the Go agent (Gopire). It compiles into a standalone binary and supports Windows and Linux targets via cross-compilation. **Currently, the C agent supports the HTTP listener only.**
+
+The C agent is only available in the [Sponsors](https://github.com/sponsors/BC-SECURITY) version of Empire.
+
+## Prerequisites
+
+To compile the C agent, the following are required:
+
+- A C compiler (GCC or MinGW for cross-compilation)
+- OpenSSL development libraries
+- For Windows targets: `x86_64-w64-mingw32-gcc` (MinGW-w64 toolchain)
+
+## Compilation and Setup
+
+The C agent is compiled server-side via the `CCompiler` class. When generating a stager through the `multi/c_exe` stager, the server handles compilation automatically using the configured compiler.
+
+### Stager Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `Listener` | Listener to use (required) | - |
+| `CC` | C compiler override | `x86_64-w64-mingw32-gcc` (Windows) or `gcc` (Linux) |
+| `CFLAGS` | Extra compiler flags | - |
+| `TargetOS` | Target OS: `windows` or `linux` | `windows` |
+
+### Manual Compilation (Outside Empire)
+
+```bash
+# Windows target (cross-compile from Linux)
+x86_64-w64-mingw32-gcc -o cpire.exe main.c agent/*.c comms/*.c crypto/*.c tasks/*.c common/*.c profile/*.c \
+  -I. -Iagent -Icomms -Icrypto -Itasks -Icommon -Iprofile \
+  -I/opt/openssl-mingw64/include -L/opt/openssl-mingw64/lib64 \
+  -lssl -lcrypto -lws2_32 -lwinhttp -lcrypt32 -lole32 -loleaut32 -ladvapi32 -static
+
+# Linux target
+gcc -o cpire main.c agent/*.c comms/*.c crypto/*.c tasks/*.c common/*.c profile/*.c \
+  -I. -Iagent -Icomms -Icrypto -Itasks -Icommon -Iprofile \
+  -lssl -lcrypto -lcurl
+```
+
+## Features
+
+- **Cross-platform**: Supports Windows and Linux targets.
+- **Native binary**: Compiles to a standalone executable with no runtime dependencies (statically linked on Windows).
+- **Full staging**: DH key exchange with Ed25519 certificate verification, AES-CBC encrypt-then-HMAC session keys, and ChaCha20-Poly1305 routing packets.
+- **Encrypted comms**: HTTP/HTTPS via WinHTTP (Windows) or libcurl (Linux).
+- **Task execution**: Shell commands, PowerShell, C#/.NET assembly loading, and BOF (Beacon Object File) execution.
+- **File operations**: File download (chunked), upload, and JSON directory listing.
+- **Agent controls**: Delay/jitter, kill date, working hours, and lost-limit enforcement.
+- **OPSEC**: No debug output in production builds. Debug logging available via `-DCPIRE_DEBUG` compile flag.
+- **HTTP listener support**: Only supports the HTTP listener for communication.
+
+## Supported Tasks
+
+| Task ID | Name | Description |
+|---------|------|-------------|
+| 1 | SYSINFO | Collect system information |
+| 2 | EXIT | Terminate the agent |
+| 10/12 | SET/GET_DELAY | Set or query delay and jitter |
+| 30/31 | SET/GET_KILLDATE | Set or query kill date |
+| 32/33 | SET/GET_WORKING_HOURS | Set or query working hours |
+| 40 | SHELL | Execute a shell command |
+| 41 | DOWNLOAD | Download a file from target (chunked) |
+| 42 | UPLOAD | Upload a file to target |
+| 43 | DIR_LIST | List directory contents (JSON) |
+| 100 | POWERSHELL | Execute PowerShell script (wait for output) |
+| 101 | POWERSHELL_CMD_WAIT | Execute PowerShell with save-file prefix |
+| 102 | POWERSHELL_CMD_JOB | Execute PowerShell (background) |
+| 120 | CSHARP_CMD_WAIT | Load and execute .NET assembly |
+| 121 | CSHARP_CMD_WAIT (save) | Load .NET assembly with save-file prefix |
+| 122 | CSHARP_CMD_JOB | Load .NET assembly (background) |
+| 123 | CSHARP_CMD_JOB (save) | Load .NET assembly background with save-file |
+| 130 | BOF_CMD_WAIT | Execute Beacon Object File |
+
+## Security
+
+The `CCompiler` class validates compiler flags and compiler binaries against an allowlist to prevent command injection during server-side compilation. The agent zeros all cryptographic key material using `OPENSSL_cleanse` before freeing memory to prevent forensic recovery.