bloodhound-quickwin
Simple script to extract useful informations from the combo BloodHound + Neo4j. Can help to choose a target.
Prerequisites
- python3
pip3 install py2neo
pip3 install pandas
Example
- Use your favorite ingestor to gather ".json"
- Start your neo4j console
- Import "*.json" in bloodhounnd
- Run ./bhqc.py
Usage
[email protected] $ ./bhqc.py -h
usage: bhqc.py [-h] [-b BOLT] [-u USERNAME] [-p PASSWORD]
Quick win for bloodhound + neo4j
optional arguments:
-h, --help show this help message and exit
-b BOLT, --bolt BOLT Neo4j bolt connexion (default: bolt://127.0.0.1:7687)
-u USERNAME, --username USERNAME
Neo4j username (default : neo4j)
-p PASSWORD, --password PASSWORD
Neo4j password (default : neo4j)
Output
[email protected] $ ./bhqw.py
###########################################################
[*] Enumerating all domains admins (rid:512|544) (recursive)
###########################################################
[+] Domain admins (group) : DOMAIN [email protected]
[+] Domain admins (group) : ENTERPRISE [email protected]
[+] Domain admins (group) : [email protected]
[+] Domain admins (enabled) : [email protected] [LASTLOG: < 1 year]
[+] Domain admins (enabled) : DIRECTOR.TREN[email protected] [SPN] [LASTLOG: NEVER]
[+] Domain admins (enabled) : [email protected] [ASREP] [LASTLOG: NEVER]
###########################################################
[*] Enumerating privileges SPN
###########################################################
[+] SPN DA (enabled) : [email protected]
###########################################################
[*] Enumerating privileges AS REP ROAST
###########################################################
[+] AS-Rep Roast DA (enabled) : [email protected]
###########################################################
[*] Enumerating all SPN
###########################################################
[+] SPN (enabled) : [email protected]
[+] SPN (enabled) : [email protected]
[+] SPN (enabled) : [email protected]
[+] SPN (enabled) : [email protected] [AdminCount]
[+] SPN (enabled) : [email protected]
[+] SPN (disabled) : [email protected] [AdminCount]
###########################################################
[*] Enumerating AS-REP ROSTING
###########################################################
[+] AS-Rep Roast (enabled) : [email protected]
[+] AS-Rep Roast (enabled) : [email protected] [AdminCount]
###########################################################
[*] Enumerating Unconstrained account
###########################################################
[+] Unconstrained user (enabled) : [email protected]
###########################################################
[*] Enumerating Constrained account
###########################################################
[+] Constrained user (enabled) : [email protected] ['snmp/dc1.FBC.LAB']
###########################################################
[*] Enumerating Unconstrained computer
###########################################################
[+] Unconstrained computer (enabled) : DC1.FBC.LAB [Windows Server 2016 Standard]
###########################################################
[*] Stats
###########################################################
+--------------------------------------------+------------+-------+
| Description | Percentage | Total |
+--------------------------------------------+------------+-------+
| All users | N/A | 21 |
| All users (enabed) | 85.71 | 18 |
| All users (disabled) | 14.29 | 3 |
| Users with 'domain admins' rights | 16.67 | 3 |
| Not logged (all) since 6 months | 0.0 | 0 |
| Not logged (enabled) since 6 months | 0.0 | 0 |
| Password not changed > 1 y (enabled only) | 0.0 | 0 |
| Password not changed > 2 y (enabled only) | 0.0 | 0 |
| Password not changed > 5 y (enabled only) | 0.0 | 0 |
| Password not changed > 10 y (enabled only) | 0.0 | 0 |
| Users with SPN | 33.33 | 6 |
| Users with AS REP ROAST | 11.11 | 2 |
| Users enabled and has never log | 88.89 | 16 |
+--------------------------------------------+------------+-------+
12 Oct 21, 2022
6 Dec 13, 2022
3 Dec 27, 2021
7 Dec 05, 2022
3 Jan 11, 2022
107 Oct 28, 2022
1.6k Jan 08, 2023
93 Jan 07, 2023
71 Dec 29, 2022
0 Sep 13, 2022
27 Dec 29, 2022
1 Feb 10, 2022
5 Dec 14, 2022
4 Oct 11, 2021
14 Oct 20, 2021
7 Oct 18, 2022
8 Aug 17, 2022
18 Nov 19, 2022
2.7k Jan 07, 2023
2 Apr 07, 2022