hello everyone
welcome and thanks for stopping by my
session purple sharp
automated adversary simulation really
happy to be
in this first adversary village at
defcon
um and yeah during the next 30 minutes
what i want to do is i'd like to present
to you
the adversary simulation tool i've been
working on for the past couple of years
now on and off
called purple sharp my goal with this
session and the tool itself is to
encourage other encourage detection
teams to
integrate adversary simulation exercises
and practices
into their detection program so to
enhance the detection programs
so yeah hopefully this is helpful to for
some of you and
let's go ahead and start so we'll start
with a quick introduction
first of all let me introduce myself my
name is mauricio velasco
i'm currently a part of a splunk's
threat research team
before that i used to be i used to be
part of a blue team i would
i used to run the threat management team
or the detection team for a fortune 500
organization
did that for a few years and before that
i was a pen tester
i love meeting new people and chatting
about infosec
and interesting topics so i'll leave you
my twitter account here
where i share my work other people's
work so do follow me on twitter
if you are interested about adversary
simulation threat hunting detection
engineering
i invite you to visit my github page
where you'll find resources
for the work i've done in the past years
and
some of the talks i've given the tools
i've released etc
um but okay let's let's move on so today
i want to start
talking about why i wrote purple sharp
and
um so as i mentioned before before
uh being a threat researcher i used to
run a blue team and specifically
i built and and deployed a detection
program
and when i was building a detection
program i learned a lot of things from
from being a blue team but one lesson i
think i learned that was the most
important lesson about um about leading
a detection program
and i want to share with that with you
guys i firmly believe
that detection engineers need the
capability
to generate attack telemetry in order to
be successful
at their jobs imagine a scenario where
we have
we have instrumented an environment
where we are
getting telemetry from networks
endpoints
applications and you're centralizing
that to an event pipeline
um through an analytics engine like a
sim or something like that right
and detection engineers are creating
detection supporting detections
uh maintaining this this complex
architecture
when i was doing this i realized that
we can have all the data all the
telemetry but if we don't have that
telemetry generated by attack techniques
by
executing the technique detections
engineers are always going to be limited
because you cannot write a detection if
you don't know if you don't know
how an attack looks like right so like i
firmly believe that a detection team
needs the capability to generate attack
telemetry
in other words i think detection teams
need the capability to simulate
techniques to simulate
attack techniques and this is why i
wrote purple sharp right
purple sharp is an adversary simulation
tool that executes adversary techniques
within windows active directory
environments
it follows the attack miner framework
you know for
organization of the techniques it's
written in c
sharp um so for for the attack
simulations what i use is
that net libraries wherever possible and
windows 32 api calls where i can
and its main goal is to generate the
attack telemetry
that enables detection teams to build
test
and enhance detection controls okay
that's the main goal of the tool one
interesting thing is that
purple sharp is not weaponized even
though it executes
techniques it doesn't provide the output
to the
to the operator so it's not weaponized
for example
when i'm doing a curve roasting attack
even though i'm getting a service ticket
for that spn i don't get the hash back i
don't present the hashtag
um so it executes techniques but it
doesn't
provide the output and it doesn't help
you in a red team that's why
it's what i call um adversary simulation
right because
if the goal is to execute the technique
to generate the telemetry
and not necessarily to execute the
technique to move on to a different goal
like a red team or a pentest would do
so now let's let's dive deep into uh
purple sharp and how it works okay let's
and then
after that we'll we're gonna go to some
demos
okay so there's five points i want to go
over real quick uh in the next
eight to eight ten minutes uh around
purple sharp
and um why i think it's uh different and
why i think it's helpful
so first flexibility purple sharp is
flexible it's a simple c
sharp assembly right when i was when we
used to do
adversary simulation exercises in my
previous job at the beginning
uh what we would do is you know work
with command and control frameworks
like open source and commercial both of
them right but
we would always lose time on setting up
the infrastructure
getting a shell back infecting that hose
getting a payload
and don't get me wrong they definitely
work well right
but we needed we needed to be a little
bit more flexible a little bit faster
right
so now with purple sharp all i have to
do is drop that c sharp binary
and run it right like no command and
control no pain
no um um you know reverse shells
or anything like that um another thing
is that we for purple sharp supports
json simulation playbooks a lot of other
tools do this
and i like to call this the simulation
as code
where you can define a
simulation playbook with json
files right and each technique
has different parameters supported
so let me look at an example here on the
right this
is a playbook for a password spraying
attack okay as you can see i defined the
technique
the password even the protocol you can
define which protocol to use
i added here sleep time so we can we're
going to wait 30 seconds between each
authentication event
we define the users that we're going to
spray we define the target right
so all the simulations supported by
purple sharp
come in a similar way you know easy to
flexible easy to customize a lot of
different parameters
uh to customize the specific execution
of the technique
here's another two other examples on the
first one this is how we create us
we execute a persistent technique to
create a service
and on the right side to create a
scheduled task as you can see we can
define
the name of the service the command that
is going to be executed
same for the scheduled task right
next point um one of the goals that i
had when
writing a simulation tool is that i
wanted to be able
to repo remote simulation deployment i
wanted to be able to execute techniques
in remote hosts
why is that because when you're
executing techniques
on your local network you're only
testing
the local network's detection controls i
wanted to be able to drop that
simulation
far away on that network that is maybe
in a different country maybe in a
different continent
without actually having to have someone
there right
so that was my goal uh what i ended up
doing
is just leveraging native services
of windows like smb to copy the file
um wmi to execute the file
and name pipes for communication and of
course it has a couple of requirements
that this means that
when we want to deploy the simulation on
a remote host
we're going to need to have network
connectivity to these services
as well as administrative credentials to
these remote hosts right
now let's dive a little even deeper on
how this works
there's three modules that work together
the orchestrator that runs on the
operator's computer
the scout that runs on the simulation
target
and the simulator that also runs on the
simulation target
so these are three different modules um
that synchronize with each other to
execute the simulation um
now one important thing is these modules
they needed to
share information right about the
simulation
um so what i'm using is name pipes
and serialized objects so that they
communicate
over the network using namepipe so
i did this because in a previous version
i was just using command line parameters
uh so i would have to copy those command
line parameters and use them on the
remote host
but that wasn't good opsec right because
you could see the parameters there and
it was easy to detect that this was a
simulation
but now there's no more parameters
because all the communication all the
details about the simulations
is flowing through name pipes from the
orchestrator to the scout
and from the scout to the simulator okay
at a high level the way it works is that
the orchestrator first
copies itself using smb to
the target to similar like psx right it
copies itself
then it uses wmi to execute the scout
right the scout runs which is
essentially a service like a name pipe
service
the scout runs some recon tasks to get a
little bit more information about the
target host
and then the orchestrator starts talking
to the scout over name pipes they share
information
once everything is ready the scout then
executes the simulator which is in
charge of actually
the actual simulation itself i wanted to
separate
simulation the pro deployment from
simulation itself
which is why i separated these two okay
um yeah this is just an example
on the source code of like the scout
this is the scout service as you can see
it starts at namepipe service
okay and it waits for the orchestrator
to connect to it
once it connects to it it it receives an
object
i know the object is the simulation
request which is
uh essentially a small kind of like a
protocol that i came up with
on how to exchange this simulation
details right so this is the simulation
request that has a header
a type and it has a simulation playbook
which has all the details about all the
simulations that need to be executed
um so yeah that's you can look at the
source code to see how that works but
it's pretty interesting
and i'm pretty pretty happy with the
results
another requirement that i had when
writing purple sharp
is that when i was executing remote uh
simulations
the challenge was that because i'm using
wmi to execute the scout
the scout runs under the context of that
service account
that you use to deploy simulation right
but i wanted to get user impersonation
because when i'm executing a remote
technique i know that there's a user
logged on here
so i wanted my simulation to run under
the context of that user
that's logged in on that host at that
time right
so how do i achieve that well
i had a first a few approaches my first
approach was to play with tokens
and i used these api
calls to duplic duplicate tokens and to
start a process with a token that i
stole because
the scout runs in a high privilege mode
so it has access
it can get a handle to other processes
my second approach was to inject shell
code so inject
purple sharp as a shell code to a remote
process
because once i inject that then i'm
going to run under the context of that
process and whoever owns that process
so i tested these two first approaches
they worked
but still they were what i needed i
ended up going in a different route what
i did was
i use parent process
id spoofing technique which allows me to
do two things
one the parent process of my simulator
now is going to be as is going to run
under the context of the user who's
logged in
so i i'm breaking that parent
child process relationship between the
scout and the simulator
and second because i'm using
explorer.exe
as the parent process then the child
process
the the simulator is also gonna run
under the context of that user
so i am stealing that
token and leveraging that user's token
that's logged in on that host
without having to um to you know
actually steal the token i'm just using
parent process id spoofing right
so now my simulator thanks to this
runs under the context of that user and
it's pretty that's pretty pretty
interesting
because it allows me to execute my
simulation
under a real user right so we no longer
have to have that service account
simulating techniques but now we have
that real user
that is able to authenticate to other
hosts he's able to get
coverage tickets um so now it looks like
this is an actual user that has been
compromised
and is attacking the network which is
pretty cool
this is again just some code on how i do
this this is the scout
uh the the function called runs
scout service serialize and
as soon as the scout runs it receives
that
protocol uh that that message from the
orchestrator like a syn packet
and then automatically starts doing the
recon okay
so it sends that back to the
orchestrator the orchestrator
stages the attack the simulation and
once the simulation is ready
the orchestrator sends an act command
and when that act command is received if
the opsec technique is ppid
what the scout runs it it runs the
simulator
using the parent process id spoofing
technique
right again you can look at the source
code yourself and
and check this out how this works
so what we end up getting is something
like this where as you can see here we
have the scout
running under the context of this p
sharp account which is a service account
that you're going to use to remotely
authenticate to host
but the simulator actually runs under
the context of a real user that's logged
in
on this host and the panel process is
going to be explorer
right so now when this comes to an
analyst
they're going to think that this is a
real attack and they're going to
investigate it the right way which is
another reason that i built purple
shutter i wanted to test my team my sub
team
and this is one way of doing this
because
now this real user has real real hosts
real data real proxy logs so they can
hunt through this data
and look for suspicious behavior
another important thing for me was to
execute the same technique
in different variations and why is that
because i want to be able to bypass
or at least attempt to bypass existing
detections
it helps me validate detection
resilience here's an example
the technique power shell the way purple
sharp can execute them is two ways
one just calling powershell.exe right
and putting the command there an encoded
command but also another way is
using.net and executing powershell
leveraging the.net libraries without
having to call powershell.exe so there's
two ways of executing this technique
and defenders should know how to detect
these two ways
here's a cooler example you probably
know about this technique remote
services
it's when you are able to a lateral
movement technique that allows you to
execute code remotely
by starting a remote service or by
messing with a remote service right
so there's three ways that i can support
this
one just using a negative binary sc.exe
which allows you to
if you have the right permissions on a
remote host it allows you to create a
remote
service and start a remote service this
is how i do it on purple shark
second way is no longer using the
command line but now using
windows api calls the api called
create service that allows me to create
a remote service remotely
and then i can also start that service
remotely
to execute that technique but finally
and here's a way to bypass detections
the first two ways
what happens is that they both generate
an event a service creation event which
is a really cool way of detecting this
technique
but with this third variation we are no
longer
creating a new service because what
purple sharp does is going to
find an existing service modify it
so that it's its binary path
gets changed gets updated to a malicious
command
and then reverts it back right so now we
bypass we're still leveraging
service control manager on that remote
host to execute code
but we're no longer creating a new
service what we're doing now
is modifying existing service and by the
way credits to the author
this is a technique that i first saw on
this tool called sc
shell and i just replicated it
so three ways of executing this
technique another
another example is password spraying i
know that
within active directory you can use
passwords frame with kerberos
and ntlm and that looks different on the
logs
it so it could be a way to bypass
detection well purple sharp supports
both
kerberos and ntlm just by leveraging the
api
call logon user and i have to change a
variable here and that's all you have to
change
to force the authentication to happen
over curve rows instead of ntlm or
the opposite so technique variations
right pretty pretty interesting feature
for proper shot finally another another
important thing
for proper sharp is i wanted to have
active directory support meaning
be able to execute techniques in active
of course purple services c-sharp binary
focus on windows
but i also wanted to do more so for
example purpose sharp is able to
interact with active directory and the
domain members
in the context of that logged user right
it also supports
ldap queries to for random target
selection so there are some techniques
that require targets
for example password spraying requires
user targets right
but a lateral movement technique
requires host targets
so what i do with purple sharp is that
you can define two variables
host target type or user target type and
what these variables define
is which targets you want to attack
if you set these variables to two what
happens is that proper sharp is going to
automatically do random ldap queries
against the against active directory and
obtain
random users obtain rendered hosts so
you can target them
in your simulation exercises
and and when you're picking holes it
actually does an extra check
it goes against ldap it gets a list of
hosts
but also checks if those sources are
alive with a pin
it also checks with a a quick port scan
on specific ports
to see if those hosts are responding or
not so it does some checks before
returning
um just an ldap result so pretty
interesting because now
i can pick random targets without
having to define passwords because
remember i'm leveraging that logged
users token so and that user is already
authenticated to domain so i'm just
leveraging that to do all the queries
without having to define passwords
so now that we've looked at a few
few ways of how purple sharp works a few
features of purple sharp
let me jump to the demos okay now what
i'm going to do
now i'm going to stop the video and i
need to set up my environment
but at a high level this is what we're
going to be look at
looking at right i have a lav
environment
a few i think 10 windows hose i'm using
windows event forwarding
and then i'm using a splunk community
version
and to get all those logs and we're
going to be executing techniques
and looking at some dashboards okay so
give me a minute i'm going to set up my
live environment
and i'll be right back
okay bucks uh sorry okay guys um okay so
i'm back
now and let's look at the first demo
so on this first demo we're gonna
execute two playbooks
on the first playbook we're going to
execute some reconnaissance or discovery
techniques
using the command line so using native
files native windows binaries
and then we're going to use the cover
roasting attack
okay on the second playbook we're going
to execute this
these techniques on a different hose
we're going to execute
some similar reconnaissance techniques
but this time
we're no longer going to use the command
line to
to execute them but we're going to use
powershell commands
so that that's going to look different
on the logs and finally we're going to
start executing some password spraying
techniques
from from that host okay
all right so let's jump to this demo
real quick guys
um so i have my lab environment as i was
showing as i was mentioning here we have
a bunch of hoes i think it's 10
uh 10 hoes uh oop i don't know what i
did here
hold on let me come back to this
okay so i was as i was saying um so i
have
10 vms here a domain environment right
and i have this computer here uh and as
you can see i'm not
this computer is not part of the domain
okay
so it's within a work group and i have a
proper shop so what i'm going to do what
i'm going to do is from here
i'm going to deploy remote simulations
to some of these hosts
okay um so let's start looking at the
playbook so for the first playbook we
have this playbook
let's quickly go over it so this is a
remote playbook because i'm going to
again i i said i'm going to deploy the
simulation against remote hosts on this
network
i'm going to use this is going to be the
service account that is going to be used
to authenticate to those remote hosts
so for this case for this first
simulation i'm gonna um
deploy to this windows 10-1 which is
this guy
and as you can see here it has the the
march simpson
user logged in okay so we're gonna
deploy we're gonna execute simulation
under the context of this user thanks to
purple sharp's um
user impersonation we defined
the scout and the path and sorry the
scout path
and the simulator path um because they
are also configurable
and this is where the simulation is
going to come from right
and then we start defining some
techniques
system discovery using command line
account
using command line i'm not going to go
over each one of these techniques
you can look at mitre attack to see what
they are finally we're going to use a
curve roasting techniques we're going to
use variation number one which means get
all the service get all get a service
ticket for all the service principal
names that purposely can find
which is a noisy way of executing it
right but purple search supports other
ways
as well and i'm going to put a sleep
time because
why not i can put a sleep time and on my
second simulation
i'm going to run it against another hose
windows 10-2
and similar techniques but now this time
i'm going to use powershell this is
why i set the variation number two here
with powershell with this variation too
i'm gonna
use powershell and i'm gonna use
two password spraying techniques one
using kerberos
against 20 randomly picked users
as i mentioned on the slides and on
another password spring attack but this
time we're going to authenticate
to a remote hole so we're going to do a
remote spatula
spraying attack by finding a hose
random hose and spraying it okay
so i'm gonna execute this and and then
just pause the video so we don't have to
wait
for this to finish okay so i
define the password and here we go so
i'm gonna stop the video and come back
to this i'll be right back
so one once purpose up is finished we
can go in and look at the results
uh don't forget that purple sharp writes
the results to a json file in case you
want to do that but
for the purpose of time we'll just do
this manually okay
so two playbooks have executed let's
look at the results
on the first on the first one we see
that purpose are authenticated to
windows 10-1
and started executing commands under
this simulator of course
under the context of a real user with
this pid
and starts executing some some
enumeration commands using the command
line
and nothing fancy here get some results
back
right we can we're going to see that on
splunk in a lunatic
and then after that it starts the curve
roasting technique so
it queries ldap for spns it finds them
and it starts getting a service ticket
for each one of them executing kerberos
and as you can see waits one second
for each authentication event because we
define that sleep time okay
finally actually let's come back to the
to
the logs to see how this looks like so
if i
refresh this this dashboard that i have
here
we can see that in fact this host
windows 10-1
and this user march simpson executed a
bunch of weird
enumeration commands right but here
here's the interesting things if we look
at this curve roasting
dashboard we see that in fact
windows 10-1 and march samsung
start getting service tickets for all
these service accounts
and waiting one second between each
authentication and as you can see here
and so that looks pretty interesting
right um
so now let's look at the results of the
second playbook
on the second playbook um now we started
doing some intermodation
but now this time we use powershell
instead of the command line so we're
going to look at that
and finally e purple sharp would can
execute
um password spring attack against
random users using kerberos and then now
another password spring attack against
another host
using ntlm right so if we look
at our enumeration dashboard now we see
that
this hosts windows 10-1 started
executing
this a bunch of powershell commands that
are used for enumeration
right and if we look at how it looks
like on the command line
we just see that a bunch of powershell
being executed which is not helpful
but if you have powershell logs we can
see this right
and finally if we look at the password
spraying dashboard that we have here
we can see hopefully that this guy
puzzle spray against 19 users
random users picked up a purple sharp
this is with kerberos
this is within tlm because purposeful
also supports
ntlm here we can see another way of
catching this technique from the
simulator
how the simulator attempted to antique
to authenticate with these 10 users
um so yeah you get you get the idea
right like different attacks different
ways of detecting it
okay cool all right so now real quick
we're gonna move to the next demo uh in
the next
four minutes that we have here uh this
guys we're gonna use
lateral movement okay and a cool thing
is that
we're gonna execute these techniques on
a remote host
and the user that's logged in on this
remote host
if they have the privileges we're gonna
be able to execute code remotely
okay so let's continue to this demo
okay so now we have a different playbook
this playbook and now we're gonna
execute
the service creation and oh before i
jump there
let's look at the details so now we're
gonna be using
for the most the four most common
lateral movement techniques in windows
environments
um we're gonna use remote services
secure remote service
schedule tasks to create a remote
schedule task we're to use wmi
in winram proposal supports all four of
them
and also we're going to use some network
service scanning so scan some ports
on on some random host and we're also
going to do some network share
enumeration why not okay
okay so let's jump to
our operator computer we have the
playbook here this playbook is going to
execute it when it's windows 10-2
um actually both the the both tasks
on the first playbook are going to
execute against windows 10-2
the reason behind that is that on
windows 10-2
we have a user mr burns and mr burns
he is a local admin on all windows 10
endpoints so which is what we need to be
able to
successfully move laterally okay so on
this first technique we define
like i said the scout the the simulator
first we're gonna randomly scan
hosts like pick random holes and scan
them why not
and then we're going to first create a
and start a remote schedule task
um on windows 10-3 i think this is wrong
here windows 10-3 as you can see here
using the command line so using sch
tasks um
okay and then we're going to create and
start a remote service
on also windows 10.3 this time using api
call
create service and this is the command
that we're going to execute as part of
the service
um actually against windows 10-4 sorry
about that
the target is windows 10-4 okay
and on the separate playbook we're going
to execute commands remotely using wmi
and winram
as you can see here this one is um
first actually we're gonna use some
network share enumeration why not
against five random hosts then we're
gonna execute
code remotely using wmi against five
random
random hosts here as you can see we
define whole target type two which
picks random targets five for a local
for a total of five
random targets and we're going to
execute this command why not
and then using winram executing
against five other random hosts using
winram
and finally we're going to execute a
variation of that same technique psx or
remote services but
this time we're gonna go over against
windows 2019-1
and there's a service here called purple
sharp service
as you can see here netflanders
there's a service called purple sharp
service okay
and this purple sharp service has
notepad what purpose
is going to do is going to authenticate
to a host
and then uh change the configuration of
that service
so instead of note that we execute
powershell and then move that service
back to its original configuration okay
all right so we execute demo2
and let me just make sure that our hosts
are up and running
oh i'm missing one so give me one second
okay i'm back and one thing that i
forgot to mention is
for the second playbook that executes
code on random host
i'm gonna run it again windows 10-4
and why is that because on windows 10-4
i have mr smithers logged in
and mr smithers he's a domain admin so
he's going to be able to
execute code remotely on any host which
is what we want because we're going to
pick random hosts
okay so let's
execute this this now
and let me just confirm that these guys
are all up and running
yeah this guy needs to come back okay so
we
execute it and we pass that service
account password and just like before
i'm gonna stop the video so we don't
have to wait for this to finish
and come back okay so purpose are
finished and let's quickly take a look
at this so the first playbook
we run against windows 10-2 right so
we're running under mr burns
right here and we create a scheduled
task on a remote host
and then we we now create a remote
service
against windows 10-4 as we can see here
purple sharp
generated a random service name and use
windows api calls to create
start and delete that service um so
let's like
let's take a look at how this looks on
the logs so first if we look at
what windows 10-2 did we can see that it
actually executed sch task
to clear a remote task on this remote
host again
under the context of mr burns right and
if we look at this
dashboard that i have here looking for
object changes we can see that
um a schedule task was created
on windows 10-3 right legit task
as we saw here running run dll and
finally we also see this service account
with a random name that matches that
name that we saw
on on on the logs and mshta was executed
on windows 10-4
right so this is how we cut this
and if we move on to the last playbook
now we're going to execute code using wm
oh first we do some network share
numeration i'm not going to because of
time
i'm not gonna go over the results we're
just gonna go over
the lateral movement so now we're gonna
be using
um wmi to execute
code on five hosts remotely
and then winaram to execute code
on five other hosts remotely in the
first case msi exec and the second case
request vr32
so if we look at a parent
process relationship uh logs here and if
we refresh this
we're gonna see the the child processes
of wmi prvse.exe
msi exec as you can see here right so
this is how
we cut this lateral movement technique
and finally moving on with powershell
because when you execute code using
winram
we see a different a different
uh command executing on this host that
purple sharp
executed remote code on we used to win
ram
and finally for the first last task of
this playbook
we connected to windows 2019 2019-1
and then we identified the purpose of
service that was coming
using notepad.exe so now
purple sharp is going to change its
configuration to run powershell
started start that service and then move
it back
of course we confirmed this because we
did not get
a service creation event but if you look
here
we did see services.exe spawning
powershell.exe
on windows 10.1 so this was successful
but we bypassed some detection right
so that concludes my demos guys and i
think it's right on time a little bit
over but good on time if you like purple
sharp here's some documentation
if you like it do give me a star on
github if you have any feedback
wanna help with the project please
please you're more than welcome
and by the way all these json playbooks
um
i'm creating a database of or more like
a centralized
repository of playbooks so you can look
at this project to
to start getting some ideas on
simulations so
that's it for me guys thanks a lot and
yeah you have a great day