Active-Directory-Recon icon indicating copy to clipboard operation
Active-Directory-Recon copied to clipboard
verified publisher icon passtheticket

Purple Knight fails to run when using runas via cmd

Open hackerlawyer opened this issue 1 year ago • 3 comments

Ran on an assessment from non domain joined machine by following your instructions and Purple Knight failed to run all security checks. Any insight? Thanks!

hackerlawyer avatar Nov 12 '24 16:11 hackerlawyer

Hi, Did you check that the net view \\unsafe.local\ command returned NETLOGON and SYSVOL? Did Purple Knight accept that you inserted domain name and start working? Is AV or EDR installed on the computer? I successfully executed PK a few days ago.

passtheticket avatar Nov 13 '24 20:11 passtheticket

Thanks for responding! I was able to view the NETLOGON and SYSVOL shares. Purple Knight did start running and accepted the domain name. I am seeing use of EDR/AV on network especially when attempting dumping lsa and sam. However I was able to run snaffler using your instructions no problem. Thanks for that btw! Also able to run bloodhound on this network without anything stopping it so not sure its the AV or EDR that's the problem since those tools are pretty loud

Chriskolezynski avatar Nov 13 '24 21:11 Chriskolezynski

Just worked out of nowhere. Not even sure why this time lol Thanks again for responding

Chriskolezynski avatar Nov 13 '24 21:11 Chriskolezynski