infosecn1nja
/
BloodHound
mirror of https://github.com/infosecn1nja/BloodHound.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add new data to node displays

master
Rohan Vazarkar 2018-08-16 10:47:45 -04:00
parent 26a43f838f
commit e996e496d2
4 changed files with 220 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

101
src/components/SearchContainer/Tabs/ComputerNodeData.jsx
View File

@ -262,6 +262,15 @@ export default class ComputerNodeData extends Component {
distinct
/>
<NodeCypherLink
property="Reachable High Value Targets"
target={this.state.label}
baseQuery={
'MATCH (m:Computer {name:{name}}),(n {highvalue:true}),p=shortestPath((m)-[r*1..]->(n)) WHERE NONE (r IN relationships(p) WHERE type(r)= "GetChanges") AND NONE (r in relationships(p) WHERE type(r)="GetChangesAll")'
}
start={this.state.label}
/>
<NodeCypherLinkComplex
property="Sibling Objects in the Same OU"
target={this.state.label}
@ -320,6 +329,47 @@ export default class ComputerNodeData extends Component {
distinct
/>
<h4>Inbound Execution Privileges</h4>
<NodeCypherLink
property="First Degree RDP Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(n)-[r:CanRDP]->(m:Computer {name:{name}})"
}
end={this.state.label}
distinct
/>
<NodeCypherLink
property="Group Delegated RDP Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(n)-[r1:MemberOf*1..]->(g:Group)-[r:CanRDP]->(m:Computer {name:{name}})"
}
end={this.state.label}
distinct
/>
<NodeCypherLink
property="First Degree DCOM Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(n)-[r:ExecuteDCOM]->(m:Computer {name:{name}})"
}
end={this.state.label}
distinct
/>
<NodeCypherLink
property="Group Delegated DCOM Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(n)-[r1:MemberOf*1..]->(g:Group)-[r:ExecuteDCOM]->(m:Computer {name:{name}})"
}
end={this.state.label}
distinct
/>
<h4>Group Memberships</h4>
<NodeCypherLink
@ -381,6 +431,57 @@ export default class ComputerNodeData extends Component {
distinct
/>
<h4>Outbound Execution Privileges</h4>
<NodeCypherLink
property="First Degree RDP Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:Computer {name:{name}})-[r:CanRDP]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<NodeCypherLink
property="Group Delegated RDP Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:Computer {name:{name}})-[r1:MemberOf*1..]->(g:Group)-[r2:CanRDP]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<NodeCypherLink
property="First Degree DCOM Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:Computer {name:{name}})-[r:ExecuteDCOM]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<NodeCypherLink
property="Group Delegated DCOM Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:Computer {name:{name}})-[r1:MemberOf*1..]->(g:Group)-[r2:ExecuteDCOM]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<NodeCypherLink
property="Constrained Delegation Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:User {name:{name}})-[r:AllowedToDelegate]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<h4>Outbound Object Control</h4>
<NodeCypherLink
property="First Degree Object Control"

9
src/components/SearchContainer/Tabs/GpoNodeData.jsx
View File

@ -222,6 +222,15 @@ export default class GpoNodeData extends Component {
displayMap={this.state.displayMap}
ServicePrincipalNames={[]}
/>
<NodeCypherLink
property="Reachable High Value Targets"
target={this.state.label}
baseQuery={
'MATCH (m:GPO {name:{name}}),(n {highvalue:true}),p=shortestPath((m)-[r*1..]->(n)) WHERE NONE (r IN relationships(p) WHERE type(r)= "GetChanges") AND NONE (r in relationships(p) WHERE type(r)="GetChangesAll")'
}
start={this.state.label}
/>
<br />
<h4>Affected Objects</h4>
<NodeCypherLink

50
src/components/SearchContainer/Tabs/GroupNodeData.jsx
View File

@ -244,6 +244,15 @@ export default class GroupNodeData extends Component {
end={this.state.label}
/>
<NodeCypherLink
property="Reachable High Value Targets"
target={this.state.label}
baseQuery={
'MATCH (m:Group {name:{name}}),(n {highvalue:true}),p=shortestPath((m)-[r*1..]->(n)) WHERE NONE (r IN relationships(p) WHERE type(r)= "GetChanges") AND NONE (r in relationships(p) WHERE type(r)="GetChangesAll")'
}
start={this.state.label}
/>
{/* <NodeCypherLink property="Sibling Objects in the Same OU" target={this.state.label} baseQuery={"MATCH (o1:OU)-[r1:Contains]->(g1:Group {name:{name}}) WITH o1 MATCH p= (d: Domain)-[r2:Contains*1..]->(o1)-[r3:Contains]->(n)"} /> */}
<h4>Group Members</h4>
@ -337,6 +346,47 @@ export default class GroupNodeData extends Component {
distinct
/>
<h4>Execution Privileges</h4>
<NodeCypherLink
property="First Degree RDP Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:Group {name:{name}})-[r:CanRDP]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<NodeCypherLink
property="Group Delegated RDP Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:Group {name:{name}})-[r1:MemberOf*1..]->(g:Group)-[r2:CanRDP]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<NodeCypherLink
property="First Degree DCOM Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:Group {name:{name}})-[r:ExecuteDCOM]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<NodeCypherLink
property="Group Delegated DCOM Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:Group {name:{name}})-[r1:MemberOf*1..]->(g:Group)-[r2:ExecuteDCOM]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<h4>Outbound Object Control</h4>
<NodeCypherLink

61
src/components/SearchContainer/Tabs/UserNodeData.jsx
View File

@ -91,7 +91,6 @@ export default class UserNodeData extends Component {
return;
}
let pics = this.state.pics;
let temp = pics[event.index];
pics.splice(event.index, 1);
this.setState({
pics: pics
@ -279,6 +278,15 @@ export default class UserNodeData extends Component {
}
/>
<NodeCypherLink
property="Reachable High Value Targets"
target={this.state.label}
baseQuery={
'MATCH (m:User {name:{name}}),(n {highvalue:true}),p=shortestPath((m)-[r*1..]->(n)) WHERE NONE (r IN relationships(p) WHERE type(r)= "GetChanges") AND NONE (r in relationships(p) WHERE type(r)="GetChangesAll")'
}
start={this.state.label}
/>
<NodeCypherLinkComplex
property="Effective Inbound GPOs"
target={this.state.label}
@ -358,6 +366,57 @@ export default class UserNodeData extends Component {
distinct
/>
<h4>Execution Privileges</h4>
<NodeCypherLink
property="First Degree RDP Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:User {name:{name}})-[r:CanRDP]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<NodeCypherLink
property="Group Delegated RDP Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:User {name:{name}})-[r1:MemberOf*1..]->(g:Group)-[r2:CanRDP]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<NodeCypherLink
property="First Degree DCOM Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:User {name:{name}})-[r:ExecuteDCOM]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<NodeCypherLink
property="Group Delegated DCOM Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:User {name:{name}})-[r1:MemberOf*1..]->(g:Group)-[r2:ExecuteDCOM]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<NodeCypherLink
property="Constrained Delegation Privileges"
target={this.state.label}
baseQuery={
"MATCH p=(m:User {name:{name}})-[r:AllowedToDelegate]->(n:Computer)"
}
start={this.state.label}
distinct
/>
<h4>Outbound Object Control</h4>
<NodeCypherLink