rvazarkar

import requests
from bs4 import BeautifulSoup
import re
import sys

if (len(sys.argv) < 2):
  print 'Usage:'
  print 'python arinScraper.py "target"'
  sys.exit()

rvazarkar

╔══════════════════════╦═══════════════════════╦═════════════╦════════════════════════════════════════════════════════════════════════╗
║  Objects in Domain   ║      Time Taken       ║ Cache Built ║                            Other Comments                              ║
╠══════════════════════╬═══════════════════════╬═════════════╬════════════════════════════════════════════════════════════════════════╣
║ ~35000               ║ 25 minutes 34 seconds ║ No          ║                                                                        ║
║ ~3000                ║ 30 seconds            ║ No          ║ Enumeration over VPN                                                   ║
║ ~370000 (not a typo) ║ 9 hours 42 minutes    ║ No          ║ Enumeration over VPN. Powershell ingestor never finished after 3 days  ║
║ ~130000              ║ 40 minutes            ║ No          ║                                                                        ║
║ ~40500               ║ 10 minutes            ║ No          ║ Old inges

rvazarkar

╔═══════════════════╦═══════════════════════╦══════════════════════╗
║ Collection Method ║     Old Ingestor      ║     New Ingestor     ║
╠═══════════════════╬═══════════════════════╬══════════════════════╣
║ Group             ║ 1 minute 10 seconds   ║ 19 seconds           ║
║ LocalGroup        ║ 29 minutes 57 seconds ║ 6 minutes 21 seconds ║
║ Session           ║ 29 minutes 1 second   ║ 5 minutes 36 seconds ║
║ ACL               ║ 10 minutes 20 seconds ║ 37 seconds           ║
╚═══════════════════╩═══════════════════════╩══════════════════════╝

rvazarkar

namespace Sharphound2
{
   //This class exists because of a memory leak in BlockingCollection. By setting the reference to Item to null after enumerating it,
   //we can force garbage collection of the internal item, while the Wrapper is held by the collection.
   //This is highly preferable because the internal item consumes a lot of memory while the wrapper barely uses any
   class Wrapper<T>
   {
       public T Item { get; set; }
   }
}

rvazarkar

BlockingCollection<string> collection = new BlockingCollection<string>();

foreach (var string in collection.GetConsumingEnumerable()){
   DoSomething(string);
}

rvazarkar

public SearchRequest GetSearchRequest(string filter, SearchScope scope, string[] attribs, string domainName = null, string adsPath = null)
{
    Domain targetDomain;
    try
    {
        targetDomain = GetDomain(domainName);
    }
    catch
    {
        return null;

rvazarkar

internal bool DoPing(string hostname)
{
   try
   {
       using (var client = new TcpClient())
       {
           var result = client.BeginConnect(hostname, 445, null, null);
           var success = result.AsyncWaitHandle.WaitOne(_pingTimeout);
           if (!success)
           {

rvazarkar

{
   "statements" : [
       {
           "statement" : "MERGE (n:User {name:'DOMAIN ADMINS@TESTLAB.LOCAL'})-[r:AdminTo]-(m:Computer {name:'PRIMARY.TESTLAB.LOCAL'})"
       }, 
       {
           "statement" : "MERGE (n:User {name:'DOMAIN ADMINS@TESTLAB.LOCAL'})-[r:AdminTo]-(m:Computer {name:'SECONDARY.TESTLAB.LOCAL'})"
       }
   ]
}

rvazarkar

{
   "statements" : [
       {
           "statement" : "MERGE (n:Group {name:{props.name}})",
           "parameters" : {
               "props" : {
                   "name" : "DOMAIN ADMINS@TESTLAB.LOCAL"
               }
           }
       }

rvazarkar

{
  "name": "Shortest Path from SPN User",
  "queryList":[
      {
          "final": false,
          "title":"Select a domain...",
          "query":"MATCH (n:Domain) RETURN n.name ORDER BY n.name DESC"
      },
      {
          "final": false,