[BUG] Powershell stager for http listener drops custom headers

[ruvolof]

Is there an existing issue for this?

• I have searched the existing issues

Empire Version

6.6.0

Python Version

3.14

Operating System

Kali

Database

MySQL

Current Behavior

Profiles for http listener look like this:

path1.php,path2.php||AdditionalHeader1:Val1|AdditionalHeader2:Val2

When generating a launcher, additional headers are retrieved here:

Empire/empire/server/listeners/http.py

Line 240 in dbe7e71

customHeaders = profile.split("|")[2:]

and the launcher headers are populated here:

Empire/empire/server/listeners/http.py

Line 315 in dbe7e71

if customHeaders != []:

When generating an agent, the profile is replaced into the agent here:

Empire/empire/server/listeners/http.py

Line 675 in dbe7e71

f'$Profile = "{profile}"',

and the agent then retrieves the headers here:

Empire/empire/server/data/agent/agent.ps1

Line 131 in dbe7e71

$script:Headers = @{};

, populating $Script:Headers which is then read to add headers to the web client.

However, when generating the stager, there's only this dead code that tries to replace a variable that does not exist in the stager template:

Empire/empire/server/listeners/http.py

Line 582 in dbe7e71

remove = []

and as a result of this the stager does not set the proper headers to the listener.

Expected Behavior

Custom headers should be maintained for all communications.

Steps To Reproduce

Set a profile with custom headers and verify that stager-only requests do not include the custom headers.

Anything else?

I first noticed this dead code and lack of custom headers from the stager while working on this merge request: #830.