Hi there,
SadProcessor here, happy to be back on the Insinuator to share with you some of my latest BloodHound adventures and experiments…
TL;DR Well too bad for you…
Before diving into a bit of code and some BloodHound data manipulation,
I would like to thank the BruCon Crew for having me over last week for BruCON0x0B.
I had the pleasure of delivering a 4h BloodHound & Cypher workshop in the lovely city of Gent [in a fantastic training room], and I am pleased with the interaction & feedback I had with the attendees.
I was also very happy to see almost as many Blues as Reds in the room [as well as regular security folks!!], all together having a play with BloodHound & Cypher.
BloodHound was originally designed out of a red team’s need for an AD reconnaissance tool allowing to quickly find attack paths to desired targets during engagements. And it does a great job at it.
But putting BloodHound in the hands of Blue Teams and Security Consultants can help greatly reduce the attack surface before the Red Team comes into play. This will only add value to your red team exercises.
If your car has really old tires, you don’t really need a crash test dummy to come and confirm you wont survive the crash…
I believe BloodHound is great tool for AD auditing in general, and in this post I will share a simple technique that I have successfully used on AD Hardening projects in order to quickly identify sensitive nodes in the BloodHound graph, domain-wide and at scale… and this without even looking at the graph.
Before getting into some PowerShell, I will quickly explain what we are going to do with a simple example.
Let’s say we have the following pseudo-graph in BloodHound:
What we are looking at is actually an overlapping equivalent of the following:
Once we look at it this way, we can easily count how many times a node appears on the total number of path to a specified target…
Doing so gives us a kind of weight for each node on the graph, and we can calculate which node have the most impact on the total number of paths to a specific target.
To achieve this type of data manipulation in Bloodhound “without looking”, you can use the REST API and a bit of Cypher wrapped in the scripting language of your choosing [I chose PowerShell so it runs everywhere… just like BloodHound].
First we will authorize unauthenticated requests to the REST API by uncommenting the following line in neo4j.conf
Note: This other setting being commented restricts it to localhost only [and this is what we want].
Please make sure to consider all security implications of having an open BloodHound database on your network before uncommenting this line.
If this is not for your lab or for localhost only, make sure to implement some kind of authentication,
as you probably don’t want this to be an open-bar…
Once this is done, we can send Cypher to the REST API with the following PowerShell Code.
The REST API returns JSON, so the PowerShell Invoke-RestMethod Cmdlet [aka irm] is a perfect tool for the job… It will automatically convert it to a nice object for you, and you can simply dot properties to expand objects and manipulate them further
[Instructions for calls in Bash or Python can be found here if you prefer [but c’mon bruh…dat PoSh…]]
Using this snippet, I have written a small Cmdlet called Invoke-Cypher that you can use to send any Cypher query to neo4j REST API [and build all kinds of automation around it].
An example of requesting a specific Node would look something like this:
The Node type [aka Label] is in $Node.metadata, and all Node properties are in $Node.data
And you can of course change the Cypher query to anything you like… So let’s get back to some BloodHound…
In the following example we are requesting shortest User paths to DA [any-to-one].
We can do so by sending the following query:
[Path from any user to a specific group with any types of edges and with no max length]
and this is what [one of] the returned Path Object looks like.
Notice how some data is returned in the form of URLs.
More calls [irm] to the REST API are then necessary to request these objects.
[but we will leave it for now… more on this later]
In our example, the returned result was a collection 33 objects, so we have 33 unique users with a path to our target
Same as on the overlapping BloodHound Graph [count if you like…]
The interesting bit for our experiment is the nodes property of these objects returned.
When we expand this with $PathCollection.Nodes, PowerShell gives us a list of all the nodes on all the paths.
Nodes are repeated in the list the number of times that they are present in total [like on the ‘non-overlaping’ graph], and using the Group-Object PowerShell Cmdlet we can very simply count them and get this weight we wanted to calculate…
If you followed carefully so far, you might have noticed that node with a count of 33 already…
And you might have guessed this is our target node [here the DA group], since that’s the one that is on all the 33 path we collected.
[472 is the neo4j DB internal object ID. You can also find it in the metadata of the node object itself]
We can now make those calls to the REST API to get the node info, but we already have the weight we were looking for, and we will have to make less calls to get he rest of the info since each node will only be called once [I had to learn this the hard way when testing this in very large envs…]
Anyways, and getting back to that cool active directory auditing technic I mentioned,
I have put all this into a little set of Cmdlet called WatchDog [just a POC for now and still a work in progress]
I have had good results while testing this at customers, but the scale of the AD environment can however be an issue for my code, as the powerShell Group-Object can become a bottleneck for performance when dealing with a lot of paths …
So I added a limit [in Cypher] to the first 10000 shortest paths by default [which should be way enough in most cases] but you can modify it as a Cmdlet parameter if you need.
The first Cmdlet is Invoke-DataDog [a wrapper around Invoke-Cypher].
Function sends several Cypher queries to BH and formats returned result.
You give it a Group name, and it will do the number crunching for you.
The NodeWeight Property of the result object holds Distance, Weight, and Impact [pct of ttl weight] for each node, as well as node type [label].
The second Cmdlet is Invoke-WatchDog [a wrapper around Invoke-DataDog].
You give it a domain name, and it will look for a list of known DA equiv or sensitive groups [RegEx on SID],
it will do the DataDog thing for you, and output an object per group, holding all the data we need for further investigation.
There is finally an Invoke-ReportDog Cmdlet that will generate a brief human-readable summary of the extracted data.
You can simply pipe DataDog or WatchDog output into it and it will create a mini text report for further analysis and deeper investigation [with CypherDog for example…].
A ‘Total Impact‘ is calculated at the end of the report [there’s also a TotalImpact Cmdlet you can pipe Watchdog output into, but I can’t explain everything here… check it out]
This toolset is just a POC, I have tried to optimize performance but I’m sure better can be achieved.
The technic used is of course not solid steel, but it is a cool way to interact with the BloodHound DB, identify key nodes on the path to sensitive groups, and get some global AD metrics out of it at scale.
I hope some of you will find this useful and want to dig deeper into BloodHound & Automation and this also for usage out of the pure Red Team context…
If you are interested in Active Directory Security in general [and are a German speaker], join us at the ERNW-Insight AD Summit on the 19Nov. in Heidelberg for a full day of AD goodness…
[And don’t forget Troopers is also coming fast… we plan to have an amazing AD track there too… and Rachelle & the Crew are already working hard at making it the best year ever… Be there.]
That’s all I had to share for today…
Thanks for reading…
Code for the WatchDog Cmdlets can be found here.
[Material for the Hands-On BloodHound Workshop can be found there if you like]
Catch me on BloodHound Slack if you have any questions or remarks.
Enjoy the weekend, and Make the world a Safer Place…
Cheers.