mvelazc0 / purplesharp

PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

Hi there 👋

I'm Mauricio. Currently, I'm a security researcher at Microsoft. My areas of focus include detection engineering, threat hunting and adversary simulation.

I (ocassionally) maintain a blog at https://medium.com/@mvelazco/.

I have presented and hosted workshops at conferences including BlackHat Arsenal, Defcon, DerbyCon, BSides, X33fcon, BruCON, Splunk .conf, SANS, MITRE ATT&CKcon, and others. Most of these can be found here: Talks-Presentations.

You can also find me on Twitter and LinkedIn.

---

purplesharp's Issues

Error while running single technique id on local system

Hi @mvelazc0 ,

how are you?

can you please help me out is there any assembly need to load in PowerShell before executing the purple sharp? Because when I run purplesharp.exe /t technique-id, I am getting object reference not set error. Please find the attached error snapshot.

Please suggest

Network path not found

Hi @mvelazc0 ,

I don't know why but, each time I try to execute a remote technique playbook, I have this problem :

All my machines are in the same network (AD Server, Windows Target and operator endpoint why PurpleSharp), I checked the network settings and tried without Windows Defender. But every time it doesn't work. Have you ever encountered this problem or know where it could come from?

Here is my playbook configuration :

Run tests on localhost

Is it possible to run the tests against localhost?

C:\malware>PurpleSharp_x64.exe /t 1218.011 /rhost localhost /ruser neo /d DESKTOP-8ERPDM5
Password for DESKTOP-8ERPDM5\neo:

[+] Uploading and executing the Scout on \\localhost\C$\Windows\Temp\Scout.exe

Unhandled Exception: System.Management.ManagementException: User credentials cannot be used for local connections
   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
   at System.Management.ManagementScope.InitializeGuts(Object o)
   at System.Management.ManagementScope.Initialize()
   at System.Management.ManagementObject.Initialize(Boolean getObject)
   at System.Management.ManagementObject.InvokeMethod(String methodName, Object[] args)
   at PurpleSharp.Lib.RemoteLauncher.wmiexec(String rhost, String executionPath, String cmdArgs, String domain, String username, String password)
   at PurpleSharp.Program.ExecuteRemoteTechniquesSerialized(CommandlineParameters cmd_params)
   at PurpleSharp.Program.Main(String[] args)

I can't find an example in the documentation.

purplesharp is detected as malware

I compiled purplesharp and tried it but my Microsoft defender report it as:
'Lilac' malware was detected on one endpoint
is that a normal behavior?

why

Why do I always prompt that my account or password is incorrect when I use purplesharp?
The remote local account password is correct

Current build errors - Scout.exe - Could not load file or assembly 'Newtonsoft.Json"

Hello,

I am building from the current main branch using Visual Studio 2019, I add the Newtonsoft.Json package and the tool builds ok and outputs the exe and dll into the build directory which runs ok but when I run it against another machine the scout.exe file is created and attempts to run but the process does not appear and the the purplesharp console shows the message:

[+] Uploading and executing the Scout on \testmachine\C$\Windows\Temp\Scout.exe
[+] Connecting to the Scout ...

If I attempt to run that scout.exe on the client machine I get this error:

Unhandled Exception: System.IO.FileNotFoundException: Could not load file or assembly 'Newtonsoft.Json, Version=12.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed' or one of its dependencies. The system cannot find the file specified.
at PurpleSharp.Program.Main(String[] args)

If I place the NewtownSoft dll in the same directory as the Scout file it launches ok but then when attempting to test a technique the file downloads the FirefoxInstaller file and then hangs waiting on communication.

I don't see this behavior with the August 2020 release. Am I incorrectly building the application? I appreciate the tool and for taking a look at this.

Thanks,

Ron