Safe Mode Demo Labs - Vincent Rose
A walkthrough of Starkiller, a graphical user interface frontend for managing PowerShell Empire post-exploitation agents and operations.
Summary
In this technical demonstration from DEF CON Safe Mode Demo Labs, core developers Anthony (Coin), Jake (Hubble), and Vincent Rose showcase Starkiller, the multi-user graphical user interface for PowerShell Empire. Opening at 00:06, the team explains how they forked and modernized the post-exploitation framework following the sunset of the original project, expanding it to over 300 active modules.
At 02:00 and 04:00, the presenters demonstrate the Starkiller interface, showing how red team operators connect to a centralized Empire team server, manage active listeners, and task compromised endpoints collaboratively.
At 10:00 and 15:01, the demo highlights filtering post-exploitation modules by MITRE ATT&CK tactics, executing stealthy lateral movement commands, and generating dynamic stagers to emulate advanced adversary tradecraft during enterprise security assessments. (AI summary — Gemini Flash)
Related talks
Demo Labs·40 min
PyRDP
A demonstration of PyRDP, a Python tool for Remote Desktop Protocol interception, credential capture, and honeypot deployment.
Briefings·36 min
Adam Crosser
Red team operators frequently struggle with establishing interactive command and control (C2) over traditional C2 channels.
Main Stage·16 min
Scott Taylor
Scott Taylor introduces C4, an open-source framework decoupling payload implants from command-and-control protocols using versatile external connectors.