chrismaddalena

##########################################################################################
#                                                                                        #
# Locate accounts with a specific suffix or prefix and fetch their regular accounts      #
# to identify user sessions for both accounts. Then output a JSON file that details      #
# session data for these accounts.                                                       #
#                                                                                        #
# Useful if you are looking for computers used by the target users.                      #
#                                                                                        #
##########################################################################################

chrismaddalena

from neo4j import GraphDatabase

def setup_database_conn():
    """Function to setup the database connection to the Neo4j project containing the BloodHound data."""
    try:
        database_uri = 'bolt://localhost:7687'
        database_user = 'neo4j'
        database_pass = 'bloodhound'
        print("[!] Attempting to connect to your Neo4j project using {}:{} @ {}.".format(database_user, database_pass, database_uri))
        neo4j_driver = GraphDatabase.driver(database_uri, auth=(database_user, database_pass))

chrismaddalena

def execute_query(driver, user, enabled=True):
    """Execute the provided query using the current Neo4j database connection."""
    if enabled:
        query = """
        MATCH (u:User)
        WHERE u.name =~ UPPER('%s@.*') AND (u.enabled = True)
        RETURN u.enabled, u.pwdlastset, u.domain
        """ % user  
    else:
        query = """

chrismaddalena

def sanitize(string):
    """Sanitize the provided string by replacing chunks with asterisks."""
    sanitized_string = string
    length = len(string)
    if length == 32:
        sanitized_string = string[0:4] + "*"*(length-8) + string[length-5:length-1]
    elif length > 2:
        sanitized_string = string[0] + "*"*(length-2) + string[length-1]
    return sanitized_string

chrismaddalena

def process_potfile(hashcat_potfile):
    """Process the provided Hashcat potfile to return a dictionary of hash values and plaintext values."""
    with open(hashcat_potfile, 'r') as potfile:
        potfile_hashes = {}
        for line in potfile:
            # This doesn't account for potfile entries for NTLMv2, etc.
            array = line.split(':')
            if len(array) > 2:
                pass
            else:

chrismaddalena

def process_hashes(hash_file):
    """Process the hashes in the provided file and return a dictionary."""
    # Create hashes of the hashes, lol
    with open(hash_file, 'r') as hash_dump:
        hashes = {}
        for line in hash_dump:
            # Ignore machine accounts
            if not '$' in line:
                # Separate DOMAIN\USER from NTLM and USER from DOMAIN
                array = line.split(':::')

chrismaddalena

def compare_dumps(first_hashdump, second_hashdump):
    """Compare the two password dumps and return a dictionary of the results. JSON output:
    {
    "accounts": {
        "CHRISM": {
            "enabled": true,
            "pwdlastset": "2019-04-14 22:53:08",
            "domain": "DOMAIN.COM"
            },
            "matching_accounts": {}

chrismaddalena

chrismaddalena

chrismaddalena