The SharpChisel Plugin runs the Chisel server for Invoke-SharpChisel. The Powershell script loads SharpChisel which has the embeded Golang Chisel binary -- client only to save space. This plugin is entirely contained in Empire and runs in the background. Enable the plugin to start the Chisel server; disable it or exit Empire to shut the socks proxy down. Check out the original Chisel project and SharpChisel.
Prerequisites:
- Empire >= 6.0
- Install via Starkiller plugin marketplace
- Once installed go to the installed plugin page
- Set the port for the server to listen on. It defaults to 8080. This is the port the agent's Chisel client connects back to, not the SOCKS port
- Enable the server with the toggle on the top right
- Once running deploy the Invoke-SharpChisel module on the agent
- Ensure that the socksproxy4.conf file is properly configured for port 1080,
the local SOCKS listener Chisel opens for the reverse tunnel
- You should now be able to run tooling through proxychains
- Run the plugin at any time to list the Chisel sessions opened since the server started. Note that chisel does not log session closes at its default verbosity, so a session that has since dropped is still listed.
Plugin created by Kevin Clark