seajaysec

{
    "queries": [{
            "name": "List all owned users",
            "queryList": [{
                "final": true,
                "query": "MATCH (m:User) WHERE m.owned=TRUE RETURN m"
            }]
        },
        {
            "name": "List all owned computers",

seajaysec

• Prologue

• Day One

  • Chapter 1
  • Chapter 2
  • Chapter 3
  • Chapter 4
  • Chapter 5

• [Chapter 6](https://soundcloud.com/macaudio-2/chapter-6-wind-and-truth-by-brand

seajaysec

seajaysec

Cypher Queries

Cypher Queries can be entered into the neo4j console, accessible at http://localhost:7474. These often return text-based content. There's a max of 1000 displayed rows within the console, however each query result can be downloaded as a CSV for more in depth analysis. When pasting, replace all instances of "EXAMPLE.COM" with the domain name that you are operating on. These are from a wide range of sources. A lot of them came or were inspired by discussions on the Bloodhound Slack.

Basic

Generate list of all operating systems

MATCH (c:Computer)

seajaysec

#!/bin/bash
# This script assumes Responder is in /opt/Responder

# Error messages begone!
exec 2>/dev/null

# Hardcoded location for script output files
OUTDIR=${HOME}'/working/loot/gathered'
# Hardcoded location for ntlmrelayx's .sam file output directory
NTLMRELAY=${HOME}'/working/loot/ntlmrelay'

seajaysec

#!/bin/bash
 
user="CHANGEME"
pages=$(curl -I https://api.github.com/users/$user/starred | sed -nr 's/^Link:.*page=([0-9]+).*/\1/p')

cd /opt/

for page in $(seq 0 $pages); do
    curl "https://api.github.com/users/$user/starred?page=$page&per_page=100" | jq -r '.[].html_url' |
    while read rp; do

seajaysec

#!/bin/bash
# prereqs: pypykatz, all the dumps in current working dir

mkdir ./ppktz_tickets 2>/dev/null
ext='.dmp'

for i in *$ext; do
    txtfile=${i::-3}txt
    secrets=${i::-3}secrets
    pypykatz lsa minidump $i -o $txtfile -k ./ppktz_tickets/;

seajaysec

Winter2018
Winter2018!
Winter2019
Winter2019!
Winter18
Winter18!
Winter19
Winter19!
Winter12
Winter12!

seajaysec

#!/bin/bash
# Requirements: httpie, jq
# Inspired by:
# https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/april/apples_app_site_association_the_new_robots_txt/

echo 'Testing URL for AASA'

full=$1/.well-known/apple-app-site-association

check=`curl -sL -w "%{http_code}\n" "$full" -o /dev/null`

seajaysec

#!/bin/bash
# prereqs: jq, all the dumps in current working dir

# create csv file, add headers
echo "source,type,domain,username,result" >out.csv

# function: remove first and last lines:
sedfl() {
    sed '1d;$d'
}