Skip to content

Art-Fakt/BloodHoundQueries

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

7 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Advanced BloodHound Usage

This project contains:

Custom BloodHound Queries

Here is a simple description of the BloodHound queries in customqueries.json.

You can add them to your BloodHound by opening the tab "Queries", editing the "Custom Queries", pasting them and reloading them.

Add custom queries

On Linux, you can simply install the queries using this curl command:

$ curl -o "~/.config/bloodhound/customqueries.json" "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/customqueries.json"

On Windows, you can simply install the queries using this PowerShell command:

PS C:\> Invoke-WebRequest -Uri "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/customqueries.json" -OutFile "$env:USERPROFILE\AppData\Roaming\bloodhound\customqueries.json"

All Shortest Paths to Domain (including Computers)

Returns all the shortest paths to the Domain, including the Computers.

Similar to the pre-built query "Find Shortest Paths to Domain Admins", except that it includes not only the users but the computers as start nodes and targets the Domain instead of Domain Admins.

All Shortest Paths to no LAPS

Returns all the shortest paths to computers without LAPS installed.

Handy in environments where LAPS is deployed on almost every computer in order to find the ones without it, attack them and possibly reuse local administrator passwords.

All Shortest Paths from Kerberoastable Users to Computers

Returns all the shortest paths from the kerberoastable users to computers.

Similar to the pre-built query "Shortest Paths from Kerberoastable Users", except that the user doesn't have to be selected individually.

All Shortest Paths from Kerberoastable Users to High Value Targets

Returns all the shortest paths from the kerberoastable users to targets marked as High Value.

All Shortest Paths from Owned Principals (including everything)

Returns all the shortest paths from any principal marked as Owned to anything (users, computers, groups...).

Similar to the pre-built query "Shortest Path from Owned Principals", except that the user doesn't have to be selected individually and displays the paths to everything, not every to computers.

All Shortest Paths from Owned Principals to Domain

Returns all the shortest paths from any principal marked as Owned to the Domain.

All Shortest Paths from Owned Principals to High Value Targets

Returns all the shortest paths from any principal marked as Owned to targets marked as High Value.

All Shortest Paths from Owned Principals to no LAPS

Returns all the shortest paths from any principal marked as Owned to computers without LAPS.

Handy in environments where LAPS is deployed on almost every computer in order to find the ones without it, attack them and possibly reuse local administrator passwords.

All Shortest Paths from no Signing to Domain

Returns all the shortest paths from computers without SMB signing to the Domain.

Handy in environments where SMB signing is enforced on almost every computer in order to find the ones without it, attack them and possibly reuse local administrator passwords.

The computers without signing have to be imported manually with BloodHoundLoader.py.

All Shortest Paths from no Signing to High Value Targets

Returns all the shortest paths from computers without SMB signing to targets marked as High Value.

Handy in environments where SMB signing is enforced on almost every computer in order to target them specifically.

The computers without signing have to be imported manually with BloodHoundLoader.py.

All Shortest Paths from Domain Users and Domain Computers (including everything)

Returns all the shortest paths from the Domain Users and Domain Computers to anything (users, computers, groups...).

All Unconstrained Delegation Principals (excluding Domain Controllers and Administrators)

Returns all the principals allowed to perform Unconstrained Delegation (source: https://twitter.com/_wald0/status/1108660095800479744).

Similar to the pre-built query "Shortest Paths to Unconstrained Delegation Systems", except that the Domain Controllers and the Administrators are excluded.

In order to exploit it, use the Unconstrained Delegation with the corresponding account:

All Constrained Delegations

Returns all the principals allowed to perform Constrained Delegation with their target.

All Computers Allowed to Delegate for Another Computer

Returns all the computers allowed to perform Constrained Delegation with their target.

All ACLs to Computers (excluding High Value Targets)

Returns all the users with an ACL to a computer, except the ones marked as High Value.

In order to exploit it, use the Resource-Based Constrained Delegation with the corresponding account:

All Computers in Domain Admins

Returns all the computers members of Domain Admins.

This can be exploited by triggering an SMB connection from this computer to the attacker's computer and relaying it to any computer in the domain in order to gain local administrative privileges. The reason is that Domain Admins are local administrators of every computer in the domain.

Requirements:

  • Domain account
  • Print spooler service on the source computer active, or another way of triggering an outgoing connection
  • No SMB signing on the target computer or a working RPC attack
  • No firewall blocking the connection from the source computer to the attacker
  • No firewall blocking SMB/RPC from the attacker to the target computer

All Computers Local Admin to Another Computer

Returns all the computers that are local administrators to another computer.

This can be exploited by triggering an SMB connection from the first computer to the attacker's computer and relaying it to the other computer in order to gain local administrative privileges.

Requirements:

  • Domain account
  • Print spooler service on the source computer active, or another way of triggering an outgoing connection
  • No SMB signing on the target computer or a working RPC attack
  • No firewall blocking the connection from the source computer to the attacker
  • No firewall blocking SMB/RPC from the attacker to the target computer

All Computers without LAPS

Return all the computers without LAPS.

All High Value Targets

Return all targets that have been marked as High Value.

All Owned Principals

Return all the principals that have been marked as Owned.

All Users with Password in AD

Return all the users with a password in the AD object, can then be read in the Node Info.

All Users with "Pass" in AD Description

Return all the users with the string "pass" in their description, might indicate a stored password.

All Users with Password not Required

Return all the users with the password not being required and that can therefore be blank.

All Users with with Same Name in Different Domains

Return all the users that have the same name and are in different Domains, the password could be reused.

Set DCSync Principals as High Value Targets

Mark all the principals with DCSync rights as High Value.

Set Unconstrained Delegation Principals as High Value Targets

Mark all the principals with Unconstrained Delegation privileges as High Value.

Set Local Admin or Reset Password Principals as High Value Targets

Mark all the principals that are local administrators or that can reset passwords as High Value.

Set Principals with Privileges on Computers as High Value Targets

Mark all the principals with certain privileges on computers as High Value.

Set Members of High Value Targets Groups as High Value Targets

Mark all the members of High Value groups as High Value.

Remove Inactive Users and Computers from High Value Targets

Unmark the inactive users (disabled) and computers (disabled or no login during the last 6 months) as High Value.

Custom Neo4j Queries

The following queries are to be used in Neo4j Browser directly (by default http://localhost:7474/browser/).

LAPS

Show how many computers have LAPS enabled and disabled:

MATCH (c:Computer) RETURN c.haslaps, COUNT(*)

Local Administrators

In certain cases, the groups being local administrators are added locally on the computer and not deployed via GPO. In that case, the "AdminTo" edges are not visible in BloodHound.

If the naming convention allows it, it is possible to find which group has access to which computer and to add the corresponding edges.

First of all, search for all the groups containing the name of a computer and lists the mapping:

MATCH (g:Group), (c:Computer) WHERE g.name =~ (".*" + replace(c.name, ("." + c.domain), (".*" + "@" + c.domain))) RETURN g.name AS Group, c.name AS Computer

If result is similar to this, you might be lucky and be able to add several new edges to your BloodHound:

Group                                   Computer
[email protected]    COMPUTER1.DOMAIN.LOCAL
[email protected]    COMPUTER2.DOMAIN.LOCAL
[email protected]    COMPUTER3.DOMAIN.LOCAL

In order to create the new the edges according to the naming convention, you can use the following query where you have to replace the "PREFIX_" and "_SUFFIX" according to the results above:

MATCH (g:Group), (c:Computer) WHERE g.name =~ ("PREFIX_" + replace(c.name, ("." + c.domain), ("_SUFFIX" + "@" + c.domain))) CREATE (g)-[r:AdminTo]->(c) RETURN g.name AS Group, c.name AS Computer

BloodHoundLoader

BloodHoundLoader.py is a tool to set the value of an attribute in BloodHound (e.g. high value, owned...) for all the items contained in a file.

It should be used with Python 3 and with the Neo4j module installed since it is run directly against the Neo4j database:

pip3 install neo4j

Set all the computers in the file "high_value.txt" to high value targets:

python BloodHoundLoader.py --dburi bolt://localhost:7687 --dbuser neo4j --dbpassword BloodHound --mode h high_value.txt

Set all the computers in the file "owned.txt" to owned principals:

python BloodHoundLoader.py --mode o owned.txt

Set all the computers in the file "no_smb_signing.txt" to "hassigning = false", in order to use them with the queries "All Shortest Paths from no Signing to *":

python BloodHoundLoader.py --mode s no_smb_signing.txt

The names of users and computers in the text file should correspond to the text shown on the GUI, e.g.:

DC.ACME.COM
COMPUTER.ACME.COM
[email protected]

Full help:

python BloodHoundLoader.py --help
usage: BloodHoundLoader.py [-h] [--dburi DATABASEURI] [--dbuser DATABASEUSER] [--dbpassword DATABASEPASSWORD]
                           (-m {h,o,s} | -o OPERATION) [-c COMMENT] [-v]
                           filePaths [filePaths ...]

BloodHoundLoader, tool to set attributes in BloodHound for all the items contained in files

positional arguments:
  filePaths             Paths of files the to import

optional arguments:
  -h, --help            show this help message and exit
  --dburi DATABASEURI   Database URI
  --dbuser DATABASEUSER
                        Database user
  --dbpassword DATABASEPASSWORD
                        Database password
  -m {h,o,s}, --mode {h,o,s}
                        Mode, h = set to high value, o = set to owned, s = set to no SMB signing
  -o OPERATION, --operation OPERATION
                        Operation to perform if the mode is not set, for instance "highvalue = true"
  -c COMMENT, --comment COMMENT
                        Comment for the log
  -v, --verbose         Verbose mode

References

BloodHound pre-built queries:

Introduction to Cypher query language:

Cypher cheat sheet:

Cypher queries collection:

About

No description, website, or topics provided.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 100.0%