hausec / bloodhound-custom-queries

Custom Query list for the Bloodhound GUI based off my cheatsheet

BloodHound Custom Queries

Custom Query list for the Bloodhound GUI based off my cheatsheet

Replace the .json file located in C:\Users[USERNAME]\AppData\Roaming\BloodHound\customqueries.json with this one, or open up your file (click on the pencil icon next to Custom Queries in the Queries tab) and copy+paste in my contents, Then refresh Bloodhound (Queries tab>Custom Queries>Refresh icon).

Tweet me with questions/concerns/comments: https://twitter.com/Haus3c

bloodhound-custom-queries's Issues

A query to find all users that have a path to domain admin ?

Hi awesome tool, i couldn't find this query any help ?

Query to find on which computers a specific user can RDP to

Hello dear hausec,
A very great job!!!!!! thanks!
Can you guide me please how to write a query which finds on which computers a specific user can RDP to?

Thanks!

Ilan-sec.

Line 280 "Find Kerberoastable users and where they are AdminTo"

Currently query reads: "query": "OPTIONAL MATCH (u1:User) WHERE u1.hasspn=true OPTIONAL MATCH (u1)-[r:AdminTo]->(c:Computer) RETURN u"

Should read: "query": "OPTIONAL MATCH (u1:User) WHERE u1.hasspn=true OPTIONAL MATCH (u1)-[r:AdminTo]->(c:Computer) RETURN u1"

Although, even with that, the data I'm looking at only returns the kerberoastable accounts. I tried adding ",c" to the end of the query and I do get the machines, but it's missing the relationship between the two. When I tried adding "r" as well, it went back to producing only kerberoastable accounts

Incorrect queries?

Are the two queries below correct?

• Find users that logged in within the last 90 days
• Find users with passwords last set within the last 90 days <-- I'll be using this as an example

I took your query and added info to get the actual name and pwdlastset timestamp. In the Neo4j browser:
MATCH (u:User) WHERE u.pwdlastset < (datetime().epochseconds - (90 * 86400)) and NOT u.pwdlastset IN [-1.0, 0.0] RETURN u.name, u.pwdlastset

I get this data back:

u.name	u.pwdlastset
"USERNAME@DOMAIN"	1540398615.0

Converting that timestamp to a date:
MATCH (u:User) WHERE u.pwdlastset < (datetime().epochseconds - (90 * 86400)) and NOT u.pwdlastset IN [-1.0, 0.0] RETURN u.name,datetime({epochSeconds:toInteger(u.pwdlastset)})

I get this data back (which is more than 90 days):

u.name	datetime({epochSeconds:toInteger(u.pwdlastset)})
"USERNAME@DOMAIN"	"2018-10-24T16:30:15Z"

I think the text needs to be flipped to read Find users with passwords last set in 90 days or more or the less than symbol (<) needs to be flipped around to a greater than symbol (>)