BloodCheck

BloodCheck enables Red and Blue Teams to manage multiple Neo4j databases and run Cypher queries against a BloodHound dataset.

Installation

From Source

BloodCheck requires Python 3.7 (and above), and Neo4j 3.5.x to be installed.

The Neo4j binary can be downloaded from the Neo4j website.

Once downloaded, the Neo4j setup can be carried out by running the following command as administrator:

<neo4j_path>\neo4j-community-<neo4j_version>\bin\neo4j.bat install-service

You can check the Neo4j installation path using the following command:

<neo4j_path>\neo4j-community-<neo4j_version>\bin\neo4j.bat status -Verbose

If it's pointing to another installation path, change the NEO4J_HOME environment variable:

set NEO4J_HOME=<neo4j_path>\neo4j-community-<neo4j_version>
echo %NEO4J_HOME%

To update the Neo4j service, run the update-service command:

<neo4j_path>\neo4j-community-<neo4j_version>\bin\neo4j.bat update-service

In order to install the pip requirements, run the following commands:

cd BloodCheck
pip3 install -r requirements.txt

If you have issues installing the Pandas' package, you can use the following command:

pip3 install --trusted-host pypi.python.org pip pandas

Once all dependencies have been installed, the configuration file config.py must be initialized (using the config.py.sample sample file) with the associated program variables.

Finally, uncomment the #dbms.active_database=graph.db line in the neo4j.conf Neo4j configuration file, located in the <neo4j_path>\neo4j-community-<neo4j_version>\conf directory.

Docker

In order to run BloodCheck using Docker, you first need to build the Docker image using the following command:

cd BloodCheck
docker build --tag bloodcheck .

BloodCheck can then be run as follows:

docker run -ti bloodcheck

      |________|___________________|_
      |        |B|L|O|O|D|C|H|E|C|K| |________________
      |________|___________________|_|                ,
      |        |                   |                  ,

usage: BloodCheck.py [-h] [-c CONFIGFILE] [-dG] [-dL] [-dP] [-dR] [-dS] [-oI OWNEDINJECTFILE] [-oU OWNEDUNDOFILE] [-oW] [-qA] [-qF QUERYFILE] [-qD QUERYDIRECTORY] [-qS QUERYSUBDIRECTORY] [-o OUTPUTDIRECTORY] [-s] [-v]

optional arguments:
  -h, --help            show this help message and exit
  -c CONFIGFILE, --config CONFIGFILE
                        define Neo4j configuration file
  -dG, --generate       generate Neo4j database
  -dL, --list           list Neo4j database
  -dP, --purge          purge Neo4j database
  -dR, --restart        restart Neo4j local service
  -dS, --switch         switch Neo4j database
  -oI OWNEDINJECTFILE, --inject OWNEDINJECTFILE
                        inject owned principales
  -oU OWNEDUNDOFILE, --undo OWNEDUNDOFILE
                        undo the owned principales injection
  -oW, --wipe           wipe all owned principales
  -qA, --analytics      run Neo4j database analytics
  -qF QUERYFILE, --query QUERYFILE
                        run cypher query
  -qD QUERYDIRECTORY, --dir QUERYDIRECTORY
                        run all cypher queries from directory
  -qS QUERYSUBDIRECTORY, --subdir QUERYSUBDIRECTORY
                        run all cypher queries from all subdirectories
  -o OUTPUTDIRECTORY, --output OUTPUTDIRECTORY
                        output results in specified directory
  -s, --save            save results to files
  -v, --verbose         increase output verbosity

Usage

Help

Running BloodCheck.py -h will print the help message and list all available options:

$ python BloodCheck.py -h

      |________|___________________|_
      |        |B|L|O|O|D|C|H|E|C|K| |________________
      |________|___________________|_|                ,
      |        |                   |                  ,

usage: BloodCheck.py [-h] [-c CONFIGFILE] [-dG] [-dL] [-dP] [-dR] [-dS] [-oI OWNEDINJECTFILE] [-oU OWNEDUNDOFILE] [-oW] [-qA] [-qF QUERYFILE] [-qD QUERYDIRECTORY] [-qS QUERYSUBDIRECTORY] [-o OUTPUTDIRECTORY] [-s] [-v]

optional arguments:
  -h, --help            show this help message and exit
  -c CONFIGFILE, --config CONFIGFILE
                        define Neo4j configuration file
  -dG, --generate       generate Neo4j database
  -dL, --list           list Neo4j database
  -dP, --purge          purge Neo4j database
  -dR, --restart        restart Neo4j local service
  -dS, --switch         switch Neo4j database
  -oI OWNEDINJECTFILE, --inject OWNEDINJECTFILE
                        inject owned principales
  -oU OWNEDUNDOFILE, --undo OWNEDUNDOFILE
                        undo the owned principales injection
  -oW, --wipe           wipe all owned principales
  -qA, --analytics      run Neo4j database analytics
  -qF QUERYFILE, --query QUERYFILE
                        run cypher query
  -qD QUERYDIRECTORY, --dir QUERYDIRECTORY
                        run all cypher queries from directory
  -qS QUERYSUBDIRECTORY, --subdir QUERYSUBDIRECTORY
                        run all cypher queries from all subdirectories
  -o OUTPUTDIRECTORY, --output OUTPUTDIRECTORY
                        output results in specified directory
  -s, --save            save results to files
  -v, --verbose         increase output verbosity

Configuration file

BloodCheck requires a configuration file config.py to be initialized (see section Installation From Source).

You can also specify an alternate configuration file using the -c parameter:

$ python BloodCheck.py -c configuration_file.py

Neo4j databases management

To generate a clean Neo4j database (named 'CleanNeo4jDB') that can be used with BloodHound, specify its name using the following command:

$ python BloodCheck.py -dG

      |________|___________________|_
      |        |B|L|O|O|D|C|H|E|C|K| |________________
      |________|___________________|_|                ,
      |        |                   |                  ,

[!] Access to Neo4j installation path [OK]

Please input the new Database name: CleanNeo4jDB
[!] Creating database 'CleanNeo4jDB'

All Neo4j databases can be listed with the -dL parameter:

$ python BloodCheck.py -dL

To switch to a specific Neo4j database (which requires the Neo4j service to be restarted), use the -dS option:

$ python BloodCheck.py -dS

To restart the Neo4j local service, use the -dR parameter:

$ python BloodCheck.py -dR

Parameters can be stacked. For instance, if you want to switch to another database and restart the Neo4j service, use the following command:

$ python BloodCheck.py -dS -dR

To purge (delete) a specific Neo4j database, use the -dP parameter:

$ python BloodCheck.py -dP

Inject owned

One feature of BloodCheck is the ability to inject owned principales via batch processing, using the following command:

$ python BloodCheck.py -oI owned_file.txt

The content of the specified owned file is as follow:

owned principale;wave
owned principale;wave

To undo the owned principales injection, just run BloodCheck with the -oU option followed with the previously provided owned file:

$ python BloodCheck.py -oU owned_file.txt

To wipe all owned principales attributes, use the -oW parameter:

$ python BloodCheck.py -oW

Cypher query

BloodCheck also enables cypher queries to be run against a BloodHound Neo4j database using yaml templates.

To run a specific cypher query against the BloodHound instance, just run the following command:

$ python BloodCheck.py -qF query_file.yml

The command below can be used to run all cypher queries from a directory:

$ python BloodCheck.py -qD query_directory

Use the -qS parameter to run all cypher queries from all subdirectories:

$ python BloodCheck.py -qS query_directory

Only the first 10 entries of each query results will be returned to the standard output.

Results can be saved to files using the -s parameter. By default, output results will be saved to the _output directory. This can be overridden by specifying the output directory using the -o option.

The cypher query yaml template consists of the following required sections:

Description: <Description of the cypher query>
Hash: <SHA256 hash of the cypher query>
Headers:
  - <First header>
  - <Second header>
  - ...
Query: '
<Cypher query to run>
'

For instance, the following template will returned a table of all users with Name, Description, pwdlastset attribute value and the enabling state:

Description: Users descriptions
Hash: 56DA67064F47AA4C06F68CD3A683462BCF0B93424D3360AEB95C0962549693AC
Headers:
  - Name
  - Description
  - pwdlastset
  - Enabled
Query: '
MATCH (u:User)
WHERE u.description is not null
RETURN u.name AS `Name`, u.description AS `Description`, u.pwdlastset AS `pwdlastset`, u.enabled AS `Enabled`
'

Note that the cypher query must not contain any additional quotes. Otherwise the following error would occur:

Error while parsing a block mapping
  in "yamlfile.yml", line 1, column 1
expected <block end>, but found '<scalar>

Finally, there are some builtins analytics cypher queries that can be run against the BloodHound instance using the following command:

$ python BloodCheck.py -qA

Those builtins analytics cypher queries retrieve the nodes distributions, the number and name of available domains, as well as all the principals marked as owned.

Contribution

If you want to contribute and make BloodCheck better, your help is very welcome.

You can use it and give me feedbacks.

Pull requests are also welcomed! So, if you have some improvements to provide, or a new cypher query to add to the project, please do ;)

Credits

This project would not have been possible without the amazing work of @_wald0, @CptJesus, and @harmj0y on the BloodHound project.

A big shout out also for @Haus3c and its amazing BloodHound Cypher Cheatsheet.

BloodCheck enables Red and Blue Teams to manage multiple Neo4j databases and run Cypher queries against a BloodHound dataset.

Related tags

Overview

BloodCheck

Installation

From Source

Docker

Usage

Help

Configuration file

Neo4j databases management

Inject owned

Cypher query

Contribution

Credits

Owner

Mr B0b

My tools box script for sigma

Example python package with pybind11 cpp extension

An example of python package

Allow you to create you own custom decentralize job management system.

Leveraging pythonic forces to defeat different coding challenges 🐍

switching computer? changing your setup? You need to automate the download of your current setup? This is the right tool for you :incoming_envelope:

CarolinaCon CTF Online

Code for ML, domain generation, graph generation of ABC dataset

A Notifier Program that Notifies you to relax your eyes Every 15 Minutes👀

A flexible free and unlimited python tool to translate between different languages in a simple way using multiple translators.

Stack BOF Protection Bypass Techniques

Hspice-Wave-Generator is a tool used to quickly generate stimuli souces of hspice format

LinuxHelper - A collection of utilities for non-technical Linux users accessible via a GUI

A python package for bitclout.

A project to explore and provide useful code for Mango Markets

A simple wrapper for joy library

Python bilgilerimi eğlenceli bir şekilde hatırlamak ve daha da geliştirmek için The Big Book of Small Python Projects isimli bir kitap almıştım.

A Red Team tool for exfiltrating sensitive data from Jira tickets.

This is a Saleae Logic custom high level analyzer that allows you to search and mark specific packets.

A type based dependency injection framework for Python 3.9+