Arrroooo… Bloodhound Crew!! Heard the news? CypherDog 4.0 is out and
it’s full of new features…
Now a couple of you might be thinking “Hey there, wait a minute… didn’t
CypherDog 3.0 come out not that long ago..??”, and I am happy to see some of you
are paying attention…
Indeed, when Bloodhound 3 came out, I quickly updated CypherDog 2 to CypherDog 3
to be compatible with it.
But Bloodhound 3 is compatible with neo4j 3 and 4, however the neo4j REST API
has been deprecated in neo4j 4 and CypherDog 3 relied on it.
Long story short, CypherDog 4.0 is a full rewrite compatible with the new
neo4j 4 HTTP API, and since I was refactoring the whole thing, I added some
cool new features to the tool.
The idea was to be able to do more with less keystrokes, and to do it
server-side…
And so I made a meme.
SadProcessor here, happy to be back on the Insinuator to share with you some of
my latest BloodHound adventures and experiments…
TL;DR Well too bad for you…
Before diving into a bit of code and some BloodHound data manipulation,
I would like to thank the BruCon Crew for having me over last week for
BruCON0x0B.
I had the pleasure of delivering a 4h BloodHound & Cypher workshop in the
lovely city of Gent [in a fantastic training room], and I am pleased with the
interaction & feedback I had with the attendees.
I was also very happy to see almost as many Blues as Reds in the room [as well
as regular security folks!!], all together having a play with BloodHound &
Cypher.
The PowerShell Conference Europe 2019 took place last
week in Hannover, and I had the pleasure to attend and speak for the second year
in a row. I want to thank @TobiasPSP@Alexandair@sqldbawithbeard and the
@PSConfEU crew for putting up this
#PowerShell feast. From a RaspberryPi
to the Clouds, from PowerShell internals to a dancing Lego robot, if you have
anything to do with windows, PowerShell, or a computer, there was some content
made for you…[I will update this post with links as soon as the videos are
published. Make sure to check it out.]
Some weeks ago, I tweeted about grabbing clipboard content from KeePass with
some PowerShell. From some reactions to this tweet, and after reading it a
couple of times again, I realize it was sending the wrong message, and I would
like to take a bit more than 280 chars to clarify what I meant when I posted
that tweet…
TLDR: Password managers are a must, not using one exposes you to far more risks
than using one. Do it.
When I recently joined the Windows Security team at ERNW, Enno asked me if I
wanted to write a ‘welcome’ blogpost on a topic of my choosing… Up for the
challenge, and since I had been playing with BloodHound & Cypher for the last
couple of months, I first thought I would do something on that topic.
However, after gathering my thoughts and some Cypher I had collected here and
there, I realized that the topic of Bloodhound Cypher might actually require
several blog posts… And so I changed my mind. I will keep the joys of Cypher for
later, and in this post, I will talk about a tiny tool I wrote to query the
Mitre ATT&CK™ knowledge base from the comfort of a PowerShell prompt.
PowerView does not use the built in AD cmdlets to be independent from the Remote
Server Administration Tools (RSAT)-AD PowerShell Module which is only compatible
with PowerShell 3.0+ and by default only installed on servers that have Active
Directory services roles. PowerView, however, is compatible with PowerShell 2.0
and has no outer dependencies. Furthermore, it does not require any installation
process.
