Store BloodHound DB in the directory you want, to have 1 DB per engagement

bloodhound-multiplexer.sh

#!/bin/bash

# author: @nil0x42
# store your neo4j BloodHound databases in specific directories
# so you can keep one clean DB per engagement

# add me to you personal ~/bin directory, with chmod +x
# & enjoy this stupid bloodhound/neo4j multiplexer

function fail () {
    >&2 echo '[-] '"$@"
    exit 1
}

function waitfor () {
    while true; do
        sleep 0.1
        grep -q "$1" "$2" && break
    done
}

neo4j_log="/tmp/bloodhound-neo4j.log"
conf="/etc/neo4j/neo4j.conf"
var="dbms.active_database"
val="$1"



###
### checks
###

ps -ef | grep -v grep | grep -q 'neo4j console' \
    && fail "neo4j console is already running"

[[ $EUID -eq 1000 ]] \
    || fail "Your user id must be 1000 (common user)"

[[ -f "$conf" ]] \
    || fail "Config file '$conf' does not exist"

[[ "$#" -eq 1 ]] \
    || fail "Usage: $0 path/to/bloodhound.db/ (mkdir an empty directory to create new db)"

[[ -d "$val" ]] \
    || fail "Usage: $0 path/to/bloodhound.db/ (mkdir an empty directory to create new db)"

[[ "$(readlink -f "$val")" =~ \.db$ ]] \
    || fail "Invalid database: '$1' directory has no '.db' extension"

if [ "$(ls -A "$val")" ]; then
    [ -f "$val/neostore" ] || fail "Invalid database: '$1' must be either empty or contain valid neo4j db objects"
fi


###
### execution
###

function leave () {
    # kill bloodhound
    if ps -ef | grep -Ev 'grep|bloodhound-multiplexer' | grep -iq 'bloodhound'; then
        kill "$bloodhound_pid"
    fi

    # kill neo4j
    if ps -ef | grep -v grep | grep -q 'neo4j console'; then
        sudo pkill -P "$neo4j_pid"
        waitfor 'Stopped.' "$neo4j_log"
    fi
    
    # cleanup custom config
    sudo sed -i "/^$var=/d" "$conf" # remove temp value

    # kill other eventual child processes
    sleep 0.2 && sudo pkill -P $$
}
trap leave EXIT

# set argv1 as active_database on config file
sudo sed -i "/^$var=/d" "$conf" # remove previous value (if any)
echo $var=../../../../../../../../../../..$(readlink -f "$val") | sudo tee -a "$conf"

# start neo4j (with big open files permission)
ulimit -n 40000
sudo neo4j console | tee "$neo4j_log" &
neo4j_pid="$(jobs -p)"

# start bloodhound (only after neo4j is correctly started)
waitfor 'Remote interface available at ' "$neo4j_log"
bloodhound
bloodhound_pid=$!