Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set computer accounts as owned in bloodhound if local admin privs #90

Merged
merged 6 commits into from
Nov 4, 2023

Conversation

NeffIsBack
Copy link
Contributor

If you achieve to gain local admin privileges you basically have control over the comuter account. Therefore this is account is set to owned in bloodhound now. (Even with NetBIOS name support for the domain 😁)
image

FYI: this is branched of #35 so it is already up-to-date if this one gets merged

@NeffIsBack NeffIsBack added the enhancement New feature or request label Oct 23, 2023
@NeffIsBack NeffIsBack added this to the v1.1.0 milestone Oct 23, 2023
@NeffIsBack
Copy link
Contributor Author

We could probably delete the bh_owned module now

Signed-off-by: Marshall Hallenbeck <Marshall.Hallenbeck@gmail.com>
Copy link
Collaborator

@Marshall-Hallenbeck Marshall-Hallenbeck left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure if it's just me, but setting the bloodhound flag in every protocol seems pretty bad and unmanageable. Is there anyway we could move it to a centralized place?

@NeffIsBack
Copy link
Contributor Author

Agreed. When you look into these functions the whole block of code mostly the same across the protocols. I just added it to the end of the block but we should centralise a lot of the code probably, but I didn't want to do it in this PR. It is probably a bigger problem.

I can do it in this PR but we should imo open up another one where we tackle the big problem on its own.

Signed-off-by: Marshall Hallenbeck <Marshall.Hallenbeck@gmail.com>
Copy link
Collaborator

@Marshall-Hallenbeck Marshall-Hallenbeck left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Created #96 for us to look into and fix it at a later time.

@mpgn
Copy link
Collaborator

mpgn commented Nov 2, 2023

With local auth

image

@NeffIsBack
Copy link
Contributor Author

Showcasing the use case when the domain was not found in the database (e.g. the user specified a wrong domain or used local auth):
image

  1. For Administrator multiple User Accounts were found in the db so we exit. (Forest with several "Administrator" Accounts)
  2. For the computer CASTELBLACK we successfully retrieve the account (even without a domain) and set it as owned.

(Final result of course without debug output)

@NeffIsBack
Copy link
Contributor Author

Working example with --local-auth only adding the host to the database:
image

@mpgn
Copy link
Collaborator

mpgn commented Nov 4, 2023

image

@mpgn mpgn added the tested label Nov 4, 2023
Copy link
Collaborator

@Marshall-Hallenbeck Marshall-Hallenbeck left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code looks good but I haven't ran tests since I haven't set up Bloodhound yet. If you've confirmed it works then it should be good to go.

@Marshall-Hallenbeck Marshall-Hallenbeck merged commit 470b4e8 into develop Nov 4, 2023
2 checks passed
@Marshall-Hallenbeck Marshall-Hallenbeck deleted the neff-bh-pc branch November 4, 2023 20:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request tested
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants