v6.7.1 into main

.github/actions/update-starkiller/action.yml

@@ -22,11 +22,11 @@ runs:
       if: ${{ inputs.repo }}
       shell: bash
       run: |
-        sed -i "s|repo:.*|repo: ${{ inputs.repo }}|" empire/server/config.yaml
+        yq -i '.starkiller.repo = "${{ inputs.repo }}"' empire/server/config.yaml
     - name: Update config.yaml ref
       shell: bash
       run: |
-        sed -i '0,/ref: .*/s//ref: ${{ inputs.starkiller-version }}/' empire/server/config.yaml
+        yq -i '.starkiller.ref = "${{ inputs.starkiller-version }}"' empire/server/config.yaml
     - name: Update changelog
       shell: bash
       run: |

.github/docker-compose.yml

@@ -14,6 +14,11 @@ services:
     image: bcsecurity/empire-test
     entrypoint: /bin/bash
     platform: linux/amd64
+    # Forwarded from the CI step env so the in-container Empire Compiler
+    # download authenticates against the GitHub API (avoids the 60 req/hr
+    # unauthenticated rate limit). Empty/unset is fine for local runs.
+    environment:
+      - GITHUB_TOKEN=${GITHUB_TOKEN:-}
     command: >
       -c "DATABASE_USE=sqlite poetry run python -m pytest . --nodocker && sed -i
       's/localhost:3306/db:3306/g' empire/test/test_server_config.yaml && DATABASE_USE=mysql

.github/workflows/cherry-pick-main.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out sponsor repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: 'BC-Security/Empire-Sponsors'
           submodules: 'recursive'

.github/workflows/dockerimage.yml

@@ -11,15 +11,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -36,7 +36,7 @@ jobs:
             echo "Using latest tag"
           fi
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64

.github/workflows/lint-and-test.yml

@@ -8,7 +8,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: pre-commit/action@v3.0.1
   matrix-prep-config:
     runs-on: ubuntu-latest
@@ -35,13 +35,13 @@ jobs:
     strategy:
       matrix: ${{ fromJson(needs.matrix-prep-config.outputs.config) }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: ${{ endsWith(github.repository, 'Empire') }}
         with:
           submodules: 'recursive'
       # token is only needed in sponsors repo because of private submodules
       # don't use token in public repo because prs from forks cannot access secrets
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: ${{ endsWith(github.repository, 'Empire-Sponsors') }}
         with:
           submodules: 'recursive'
@@ -56,7 +56,7 @@ jobs:
       # Poetry cache depends on OS, Python version and Poetry version.
       # https://gist.github.com/gh640/233a6daf68e9e937115371c0ecd39c61
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'poetry'
@@ -73,6 +73,10 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y mono-runtime mingw-w64 perl
       - name: Run test suite - mysql
+        # Authenticate the Empire Compiler download against the GitHub API so it
+        # isn't throttled by the unauthenticated 60 req/hr shared-runner limit.
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -o pipefail
           if [ "${{ matrix.python-version }}" = "3.14" ]; then
@@ -83,11 +87,13 @@ jobs:
       - name: Run test suite - sqlite
         if: ${{ startsWith(github.head_ref, 'release/') || contains(github.event.pull_request.labels.*.name,
           'test-sqlite') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           DATABASE_USE=sqlite poetry run pytest . -v --runslow --durations=10 -m "not mysql"
       - name: Pytest coverage comment
         if: ${{ matrix.python-version == '3.14' }}
-        uses: MishaKav/pytest-coverage-comment@v1.2.0
+        uses: MishaKav/pytest-coverage-comment@v1.10.0
         with:
           pytest-coverage-path: ./pytest-coverage.txt
           junitxml-path: ./pytest.xml
@@ -99,7 +105,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Test Docker Image
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: 'recursive'
           token: ${{ secrets.RELEASE_TOKEN }}
@@ -118,6 +124,10 @@ jobs:
       - name: Build docker image
         run: DOCKER_BUILDKIT=1 docker compose -f .github/docker-compose.yml build
       - name: Run tests on docker image
+        # Forwarded into the container (see docker-compose.yml) so the Empire
+        # Compiler download is authenticated and not rate-limited.
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: docker compose -f .github/docker-compose.yml run test
       - name: run structure tests docker
         uses: plexsystems/container-structure-test-action@v0.3.0
@@ -144,7 +154,7 @@ jobs:
           # Parrot disabled for now because the apt repo is having some slowness issues.
           # Install is running up way too many minutes.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: 'recursive'
           depth: 0
@@ -163,7 +173,7 @@ jobs:
       # To save CI time, only run these tests when the install script or deps changed
       - name: Get changed files using defaults
         id: changed-files
-        uses: tj-actions/changed-files@v47.0.1
+        uses: tj-actions/changed-files@v47.0.6
       - name: Build images
         if: ${{ contains(steps.changed-files.outputs.modified_files, 'setup/install.sh')
           || contains(steps.changed-files.outputs.modified_files, 'poetry.lock')

.github/workflows/prerelease-sponsor-kali-merge-private.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: 'recursive'
           ref: private-main

.github/workflows/release-private-start.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Set target branch
         run: echo "TARGET_BRANCH=private-main" >> $GITHUB_ENV
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ env.TARGET_BRANCH }}
           submodules: 'recursive'
@@ -35,7 +35,7 @@ jobs:
           git config user.name "GitHub Actions"
           git config user.email noreply@github.com
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
       - name: Setup poetry

.github/workflows/release-private-tag.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: 'recursive'
           fetch-depth: 0
@@ -22,7 +22,7 @@ jobs:
           git config user.name "GitHub Actions"
           git config user.email noreply@github.com
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.14'
       - name: Setup poetry

.github/workflows/release-public-start.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out sponsor repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: 'BC-Security/Empire-Sponsors'
           submodules: 'recursive'

.github/workflows/release-public-tag.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: 'recursive'
           fetch-depth: 0

.github/workflows/release-sponsor-kali-start.yml

@@ -17,7 +17,7 @@ jobs:
           echo "TARGET_BRANCH=sponsors-main" >> $GITHUB_ENV
           echo "STARKILLER_TAG=${{ github.event.inputs.starkillerVersion }}-sponsors" >> $GITHUB_ENV
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: sponsors-main
           submodules: 'recursive'

.github/workflows/release-sponsor-kali-tag.yml

@@ -15,7 +15,7 @@ jobs:
         run: |
           echo "TAG_NAME=$(echo ${{ github.head_ref }} | sed 's/release\///')" >> $GITHUB_ENV
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: 'recursive'
           token: ${{ secrets.RELEASE_TOKEN }}

.gitignore

@@ -13,6 +13,7 @@ empire/server/data/misc/Obfuscated.ps1
 empire/server/data/generated-stagers/*
 empire/server/data/cti**
 empire/server/data/agent/gopire/*.go
+empire/server/data/agent/gopire/vendor/
 
 empire/server/downloads/*
 empire/server/api/static/*

.pre-commit-config.yaml

@@ -12,7 +12,7 @@ repos:
     hooks:
       - id: yamlfmt
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.12
+    rev: v0.15.2
     hooks:
       - id: ruff
         args: [--fix]

CHANGELOG.md

@@ -15,6 +15,57 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 -   Fixed background jobs for the python agent.
 
+## [6.7.1] - 2026-07-25
+-   Updated Starkiller to v3.6.0
+
+### Security
+
+-   Fixed a path traversal vulnerability where a crafted multipart upload filename could write files outside the downloads directory via the avatar (`POST /api/v2/users/{uid}/avatar`) and download (`POST /api/v2/downloads/`) upload endpoints (#824)
+
+### Fixed
+
+-   Empire Compiler downloads now authenticate against the GitHub API with `GITHUB_TOKEN`/`GH_TOKEN` when set, avoiding intermittent `403` rate-limit failures on shared egress IPs (e.g. CI). When the compiler still can't be fetched, the server degrades gracefully and raises a clear error only if C# compilation is attempted, instead of crashing at startup.
+
+## [6.7.0] - 2026-07-06
+
+### Fixed
+
+-   `http_malleable` listener no longer crashes with `AttributeError` when a request arrives on a URI not defined in the malleable profile. It now returns a 404 default response instead of propagating an unhandled exception.
+
+### Added
+
+-   Performance indexes migration (0002) — apply with `poetry run alembic -c alembic.ini upgrade head` (from the Empire root) on existing databases.
+
+### Changed
+
+-   Migrated the data-access layer from the SQLAlchemy 1.x Query API to the 2.0 `select()` idiom across the core services, `data_util`, `jwt_auth`, the `http`/`http_malleable` listeners, and `basic_reporting`. Behavior-preserving and still synchronous; `db.query()` no longer appears in `empire/server`.
+-   Migrated the ORM models in `core/db/models.py` from `Column()`/`declarative_base()` to 2.0 typed declarative (`Mapped[]`/`mapped_column()`). Schema-preserving: generated DDL is identical and `alembic` autogenerate detects no diff.
+-   Modernization quick wins (no behavior change): timezone-aware `datetime.now(UTC)` in `jwt_auth`, O(1) startup existence checks in `core/db/base.py`, removal of the Python-2 `old_div` shim and unused `math_util.py`, and a `ruff` pre-commit bump to match `pyproject.toml`.
+-   Bounded the dynamic-PowerShell helper caches with `lru_cache` and made script generation deterministic, cutting `test_load_modules` from ~54s to ~1s on CI.
+-   Trimmed agent-comms SQL hot paths: dropped `lazy="joined"` on `Agent.host`, and used `db.get(Agent, session_id)` / a scalar `select(Agent.hostname)` in the hot request paths.
+-   Collapsed the per-result-packet `SessionLocal.begin()` loop in `_handle_agent_response` so one agent callback opens a single transaction regardless of how many result packets it carries. Per-callback wall time roughly halves for multi-packet batches on MySQL (e.g. 2.0x at N=10, 2.2x at N=25); N=1 is unchanged. Trade-off: a mid-batch failure now rolls back the whole batch instead of partially committing.
+-   Indexed columns the agent-comms / auth hot paths filter on: composite `(listener, archived)` on `Agent`, single-column `AgentFile.session_id`, `AgentFile.parent_id`, and `User.username`. Model-only via `index=True`; fresh databases pick the indexes up automatically.
+-   `profile_service.load_malleable_profiles` preloads existing `Profile` names once and dedupes in-memory instead of one `SELECT` per file (mirrors `module_service.load_modules`). Duplicate names across categories now log a warning naming the conflicting file instead of being silently caught at commit time.
+-   Lazy-loaded `custom_generate` module classes. The `importlib.spec_from_file_location` + `Module()` instantiation now happens on first execute and is cached, so boot skips the file-by-file import work for modules that may never run in a given session.
+-   Replaced three large credential test fixtures with a tiny synthetic module to cut CI obfuscation time; production module sources are unchanged.
+-   Promoted the `main_menu_mock` and `module_service` fixtures in `test_modules.py` to module scope so the five tests share one `ModuleService`.
+
+### Removed
+
+-   Dropped 4 unused/redundant Python dependencies to reduce supply-chain surface: `pycryptodome` (superseded by `cryptography` in the 2021 pycrypto migration; no `Crypto.*` imports remain), `pyOpenSSL` (last imports removed in 2020 cleanup, forgotten in `pyproject.toml`), `pytest-timeout` (the `@pytest.mark.timeout` markers that justified it have since been removed), and the redundant direct `coverage` pin (already pulled transitively by `pytest-cov`).
+-   Replaced `python-jose` with `pyjwt`. `python-jose` is effectively abandoned (last release 3.3.0 in 2022) and pulled unmaintained `ecdsa` / `rsa` transitive dependencies with a poor security history. `pyjwt` is the actively-maintained library FastAPI now recommends in its OAuth2/JWT tutorial; the call surface in `jwt_auth.py` is identical (`jwt.encode`/`jwt.decode`), with the exception type changing from `JWTError` to `jwt.InvalidTokenError`.
+-   Replaced the `SQLAlchemy-Utc` dependency with a 90-line vendored module (`empire/server/core/db/utc_datetime.py`) carrying the upstream MIT notice. The package shipped only two helpers (`UtcDateTime` column type + dialect-aware `utcnow()` SQL expression); behavior — including per-dialect SQL — is byte-identical so the existing schema and column defaults are unchanged.
+-   Replaced `requests-file` with inline `file://` dispatch in `plugin_service._download_tar` using stdlib `urllib.parse` + `Path.open`. The dependency existed solely to mount a `FileAdapter` on a `requests.Session` for one method; HTTP downloads now use `requests.get(...)` directly and `file://` URLs are handled with a short scheme check.
+-   Modernized the vendored `malleable/` profile parser from Py2/Py3 compatibility (`six.moves.urllib.*` + `six.moves.range`) to Py3 stdlib (`urllib.parse` + builtin `range`). Mechanical change — `six.moves.urllib.parse` ↔ `urllib.parse` is a 1:1 rename, and `six.moves.range` is just the Py3 builtin. Drops the `six` direct dep that was added back when `python-jose` was removed.
+
+### Fixed
+
+-   Preserved subprocess diagnostics across stager compile failures: the Go/Dotnet compilers now include the return code and fall back to stdout when stderr is empty, and `stager_service.generate_stager` surfaces a 400 instead of a 500 stack trace.
+-   Removed the instance-level `threading.Lock` in `AgentCommunicationService` that serialized all concurrent agent file writes; also fixed a zero-byte file left on decompression failure and guarded the download-progress calc against a malformed `total_filesize`.
+-   Fixed `clone_git_repo` leaking its `/tmp` staging directory, which could fill a tmpfs-backed `/tmp` and cause cascades of unrelated-looking test failures.
+-   Fixed the `update-starkiller` release action updating the wrong `ref` in `config.yaml`; it now scopes updates to `starkiller.repo`/`starkiller.ref` with `yq`.
+-   Fixed `undefer(AgentTask.output_original)` referencing a nonexistent attribute (the column is `original_output`).
+
 ## [6.6.0] - 2026-04-25
 -   Updated Starkiller to v3.5.0
 
@@ -1402,7 +1453,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 -   Updated shellcoderdi to newest version (@Cx01N)
 -   Added a Nim launcher (@Hubbl3)
 
-[Unreleased]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.6.0...HEAD
+[Unreleased]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.7.1...HEAD
+
+[6.7.1]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.7.0...v6.7.1
+
+[6.7.0]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.6.0...v6.7.0
 
 [6.6.0]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.5.0...v6.6.0
 

README.md

@@ -18,7 +18,7 @@ Empire is a post-exploitation and adversary emulation framework that is used to
 ### Features
 - Server/Client Architecture for Multiplayer Support
 - Fully encrypted communications
-- HTTP/S, Malleable HTTP, OneDrive, Dropbox, and PHP Listeners
+- HTTP/S, Malleable HTTP, Foreign, Hop, SMB, and Port Forward Pivot Listeners
 - Massive library (400+) of supported tools in PowerShell, C#, & Python
 - Donut Integration for shellcode generation
 - Modular plugin interface for custom server features
@@ -39,7 +39,7 @@ Empire is a post-exploitation and adversary emulation framework that is used to
 - Go
 
 ### Modules
-- [Assembly Execution](https://github.com/BC-SECURITY/Empire/blob/master/empire/server/data/module_source/code_execution/Invoke-Assembly.ps1)
+- [Assembly Execution](https://github.com/BC-SECURITY/Empire/blob/main/empire/server/data/module_source/code_execution/Invoke-Assembly.ps1)
 - [BOF Execution](https://github.com/airbus-cert/Invoke-Bof)
 - [Mimikatz](https://github.com/gentilkiwi/mimikatz)
 - [Seatbelt](https://github.com/GhostPack/Seatbelt)