mvelazc0 / PurpleSharp

PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Current build errors - Scout.exe - Could not load file or assembly 'Newtonsoft.Json"

ronroberts5467 opened this issue · comments

Hello,

I am building from the current main branch using Visual Studio 2019, I add the Newtonsoft.Json package and the tool builds ok and outputs the exe and dll into the build directory which runs ok but when I run it against another machine the scout.exe file is created and attempts to run but the process does not appear and the the purplesharp console shows the message:

[+] Uploading and executing the Scout on \testmachine\C$\Windows\Temp\Scout.exe
[+] Connecting to the Scout ...

If I attempt to run that scout.exe on the client machine I get this error:

Unhandled Exception: System.IO.FileNotFoundException: Could not load file or assembly 'Newtonsoft.Json, Version=12.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed' or one of its dependencies. The system cannot find the file specified.
at PurpleSharp.Program.Main(String[] args)

If I place the NewtownSoft dll in the same directory as the Scout file it launches ok but then when attempting to test a technique the file downloads the FirefoxInstaller file and then hangs waiting on communication.

I don't see this behavior with the August 2020 release. Am I incorrectly building the application? I appreciate the tool and for taking a look at this.

Thanks,

Ron

Hey @ronroberts5467 !

Can you please share the exact command line you are using ? I assume you are trying to run it on a remote host right ? I'll test it and see if I encounter the same issue.

Thanks

@ronroberts5467 looking forward to get more details and fix this issue.

@ronroberts5467 someone else pointed me to this issue and I was able to identify the cause. I will push a change to fix it early next week.

Thanks.

@ronroberts5467 this is now fixed. Thanks for letting me know !