Installation

git clone https://github.com/AssuranceMaladieSec/FoxTerrier
pip install neo4j

Usage

To Use FoxTerrier, The Neo4j database must be up and running and already filled with the SharpHound data.

When your conf.ini and template.json are ready, You just have to launch the script !

python FoxTerrier.py

Configuration files

input file : template.json :

template.json contains the data used by FoxTerrier to create the specific Cypher Queries.

In this file 6 parameters can be used:

• node_start_type : Mandatory. Must be "User" or "Group".
• node_start_name : Mandatory. Can be the full name or a regex (cf.is_node_start_regex). Example "[email protected]" or "JOHN-DOE-\\d{3}@MYDOMAIN.LOCAL".
• is_node_start_regex : If regex are used in node_start_name, the value must be true (be careful to use the value true and not the string "true"). Default value : false
• mode : Relation between start node and objects can be direct or indirect (permissions inherited from a group membership). You can set the mode of your choice by choising between the value "direct", "indirect" or "all" (all is "direct"+"indirect"). Default value : "direct"
• objects_type : The target objects can be "GPO", "OU", "User", "Group","RDP". The values must be within a list. Default value : ["GPO", "OU" ,"User", "Group", "RDP"]
• exclude_node : When using regex the results can be overwhelming. It's possible to exclude specific nodes from the queries. The values must be within a list. Example : ["[email protected]","[email protected]"]

Here is an example of a template.json file:

{	
	"queries": 
	[	
		{
			"node_start_type": "Group",
			"node_start_name": "GENERIC-GROUP-\\d{8}.*@MYDOMAIN.LOCAL",
			"is_node_start_regex": true,
			"mode": "all",
			"objects_type": ["GPO", "OU" ,"User", "Group","RDP"],
			"exclude_node": ["[email protected]","[email protected]"]
		},
		{
			"node_start_type": "User",
			"node_start_name": "[email protected]",
			"is_node_start_regex": false,
			"mode": "direct",
			"objects_type": ["GPO"],
		}		
	]
}

Configuration file : conf.ini

The file conf.ini contains the neo4j credentials, the file name of the summary and the report and the template file name. If you want to change the name of the file generated or the input file, it's here.

[neo4j_credentials]
username=PutYourNeo4jLoginHere
password=PutYourNeo4jPasswordHere
address=127.0.0.1
port=7687

[files]
template_file=template.json
csv_report=my_report.csv
txt_summary=my_summary.txt

FoxTerrier presentation

FoxTerrier is a Free Software tool written in Python and working in the BloodHound environment.

FoxTerrier can be seen as a more flexible version without GUI of BloodHound OUTBOUND CONTROL RIGHTS and EXECUTION RIGHTS (RDP only) features.

In addition, FoxTerrier provides all the results in a csv file and a .txt summary of it.

FoxTerrier allows you to :

• set multiple starting points: identify, from a predefined list of user/groups, all the vulnerable objects (GPO, OU, User, Group, machine with RDP connection available for the object) that can be compromised by them.
• set the type of the desired vulnerable objects: unlike the BloodHound OUTBOUND CONTROL RIGHTS feature, FoxTerrier allows you to narrow down your requests on specific objects types. For instance, if you want to retrieve only the vulnerable GPO that can be compromised by a list of predefined users/groups, you can :)
• use regexp: predefined users and groups can be expressed as regular expressions. It can be handy, for instance, if you want to target, in your start node, all users/groups matching a specific pattern.

Prerequisite: FoxTerrier relies on the Neo4j databases already filled with Active Directory information provided by SharpHound.

Output examples

A summary.txt example :

--- Load JSON File C:\Users\XXX\Documents\Tool\FoxTerrier\template.json
--- JSON file C:\Users\XXX\Documents\Tool\FoxTerrier\template.json Loaded ---

--- Executed queries ---

Match p=(m:Group)-[r]->(n:GPO) WHERE m.name =~ 'MONGROUPE_GENERIQUE-\d{11}.*@MONDOMAIN.LOCAL' AND NOT m.name = '[email protected]' AND NOT m.name = '[email protected]' and r.isacl=true return m.name AS start_name, n.name AS end_name

Match p=(m:Group)-[r1:MemberOf*1..]->(g2:Group)-[r2]->(n:GPO) WHERE m.name =~ 'MONGROUPE_GENERIQUE-\d{11}.*@MONDOMAIN.LOCAL' AND NOT m.name = '[email protected]' AND NOT m.name = '[email protected]' and r2.isacl=true return m.name AS start_name, n.name AS end_name

Match p=(m:Group)-[r]->(n:OU) WHERE m.name =~ 'MONGROUPE_GENERIQUE-\d{11}.*@MONDOMAIN.LOCAL' AND NOT m.name = '[email protected]' AND NOT m.name = '[email protected]' and r.isacl=true return m.name AS start_name, n.name AS end_name

Match p=(m:Group)-[r1:MemberOf*1..]->(g2:Group)-[r2]->(n:OU) WHERE m.name =~ 'MONGROUPE_GENERIQUE-\d{11}.*@MONDOMAIN.LOCAL' AND NOT m.name = '[email protected]' AND NOT m.name = '[email protected]' and r2.isacl=true return m.name AS start_name, n.name AS end_name

Match p=(m:Group)-[r]->(n:User) WHERE m.name =~ 'MONGROUPE_GENERIQUE-\d{11}.*@MONDOMAIN.LOCAL' AND NOT m.name = '[email protected]' AND NOT m.name = '[email protected]' and r.isacl=true return m.name AS start_name, n.name AS end_name

Match p=(m:Group)-[r1:MemberOf*1..]->(g2:Group)-[r2]->(n:User) WHERE m.name =~ 'MONGROUPE_GENERIQUE-\d{11}.*@MONDOMAIN.LOCAL' AND NOT m.name = '[email protected]' AND NOT m.name = '[email protected]' and r2.isacl=true return m.name AS start_name, n.name AS end_name

Match p=(m:Group)-[r]->(n:Group) WHERE m.name =~ 'MONGROUPE_GENERIQUE-\d{11}.*@MONDOMAIN.LOCAL' AND NOT m.name = '[email protected]' AND NOT m.name = '[email protected]' and r.isacl=true return m.name AS start_name, n.name AS end_name

Match p=(m:Group)-[r1:MemberOf*1..]->(g2:Group)-[r2]->(n:Group) WHERE m.name =~ 'MONGROUPE_GENERIQUE-\d{11}.*@MONDOMAIN.LOCAL' AND NOT m.name = '[email protected]' AND NOT m.name = '[email protected]' and r2.isacl=true return m.name AS start_name, n.name AS end_name

Match p=(m:Group)-[r:CanRDP]->(n:Computer) WHERE m.name =~ 'MONGROUPE_GENERIQUE-\d{11}.*@MONDOMAIN.LOCAL' AND NOT m.name = '[email protected]' AND NOT m.name = '[email protected]' return m.name AS start_name, n.name AS end_name

Match p=(m:Group)-[r1:MemberOf*1..]->(g2:Group)-[r2:CanRDP]->(n:Computer) WHERE m.name =~ 'MONGROUPE_GENERIQUE-\d{11}.*@MONDOMAIN.LOCAL' AND NOT m.name = '[email protected]' AND NOT m.name = '[email protected]' return m.name AS start_name, n.name AS end_name

--- Summary of vulnerable object per User or Group ---

[email protected] : 1
[email protected] : 1
[email protected] : 1
[email protected] : 1
[email protected] : 1
[email protected] : 2

--- Summary of CanRDP machines per User or Group ---

[email protected] : 3289
[email protected] : 521
[email protected] : 141
[email protected] : 35
[email protected] : 5
[email protected] : 84
[email protected] : 300
[email protected] : 459
[email protected] : 459
[email protected] : 697

--- Summary of vulnerable object per Type ---

GPO : 4
OU : 1
User : 1
Group : 1
CanRDP : 5990

--- Results available in My_Report.csv ---

A report.csv example:

The results are displayed here in a table for presentation purpose. The results are stored in a csv format in the report file.

Author

• Alice Climent-Pommeret ([email protected])

License

GNU GENERAL PUBLIC LICENSE (GPL) Version 3