auto_mark_pwned.cna

# This script will mark user accounts as "owned" in BloodHound
# It's a blind fire-and-forget across the cred store using USER@REALM,
# so it may mark more than necessary if you have overlapping REALMs in
# your cred store. And yeah, it's possible to get Injection in neo4j 
# since the username parameter isn't sanitized.
#
# Set these in your neo4j.conf
#    dbms.connector.http.enabled=true
#    dbms.connector.http.listen_address=:7474
#   or https
#    dbms.connector.https.enabled=true
#    dbms.connector.https.listen_address=:7473
# - @NotMedic
#
# sendhttp() code borrowed from @vysec and @Und3rf10w's prior work:
# https://github.com/vysec/Aggressor-VYSEC/blob/master/pushover-ng.cna
#
# Update the $bloodhoundurl to your bloodhound instance
# Update the $authheader to your creds. "echo -n neo4j:bloodhound | base64"
#
# TODO:
# 1. Parameterized query for neo4j
# 2. Parse JSON response using vysec's json code:
#     https://github.com/vysec/ANGRYPUPPY/tree/master/json
# 3. Profit

import java.net.URLEncoder;
import java.io.BufferedReader;
import java.io.DataOutputStream;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URL;

sub sendhttp{
    $authheader = "Basic bmVvNGo6Ymxvb2Rob3VuZA==";
    $bloodhoundurl = "http://localhost:7474/db/data/cypher/";

    $method = $1;
    $url = $2;
    $body = $3;

    $USER_AGENT = "Mozilla/5.0";

    $urlobj = [new URL: $url];
    
    $con = [$urlobj openConnection];

    [$con setRequestMethod: $method];

    [$con setRequestProperty: "User-Agent", $USER_AGENT];
    [$con setRequestProperty: "Content-Type", "application/json"];
    [$con setRequestProperty: "Authorization", $authheader];
    [$con setRequestProperty: "Connection", "close"];
    [$con setRequestProperty: "Accept-Encoding", "identity"];
    [$con setRequestProperty: "Accept", "application/json"];

    [$con setDoOutput: true];
    $wr = [new DataOutputStream: [$con getOutputStream]];
    [$wr writeBytes: $body];
    [$wr flush];
    [$wr close];

    $responseCode = [$con getResponseCode];

    $in = [new BufferedReader: [new InputStreamReader: [$con getInputStream]]];

    $inputLine = "";

    $response = "";

    $inputLine = [$in readLine];
    $response = $response . $inputLine . "\r\n";

    while ($inputLine ne ""){
        $inputLine = [$in readLine];
        $response = $response . $inputLine . "\r\n";
    }

    [$in close];

    return $response;
}

sub mark_owned {
    $username = $1;
    $body = '{ "query" : "MATCH (n:User) WHERE n.name STARTS WITH \'' . $username . '\' SET n.owned= TRUE RETURN n.name"}'; 
    sendhttp("POST", $bloodhoundurl, $body);
}

on beacon_initial {
    if (-isadmin $1){
        $computer = binfo($1, "computer");
        $body = '{ "query" : "MATCH (n:Computer) WHERE n.name STARTS WITH \'' . $computer . '\' SET n.owned= TRUE RETURN n.name"}';
        println("Marking " . $computer . " as owned");
        sendhttp("POST", $bloodhoundurl, $body);
    }
}

on heartbeat_1m {
foreach $cred (credentials())
    {
        $username = uc("$cred['user']\@$cred['realm']") ;
        if ( $username in @OwnedUsers )
             {
                 #println("Skipping because we've already marked " . $username . " as owned");
	     }
        else 
            {	
                 println("Marking " . $username . " as owned");
                 mark_owned($username);
                 add(@OwnedUsers, $username);
            }
    }
}