Scoubi / BloodhoundAD-Interogari

***** DOMAIN USERS este administratorul computerului MATCH p = (m: Group) – [: AdminTo] -> (n: Computer) UNDE numele de utilizator incepe cu revenirea „DOMAIN USERS” p ***** ** ***** ShortestPath De la utilizatorii de domeniu la administratorii de domeniu MATCH p = ShortestPath ((n {name: “DOMAIN [email protected]”}) – [* 1 ..] -> (m {name: “DOMAIN ADMINS @ TESTLAB.LOCAL “})) RETURN p ******* ******* Gasiti cea mai scurta cale de la DOMENIUL UTILIZATORILOR la ​​obiectivele cu valoare ridicata MATCH (g: grup), (n {highvalue: true}), p = shortestPath ((g) – [* 1 ..] -> (n)) UNDE g.name INCEPE CU RETURNAREA „DOMENIUL UTILIZATORILOR” p ******** ******* Gasiti TOATE calea din UTILIZATORII DOMENIULUI pana la obiectivele cu valoare ridicata MATCH (g: grup) UNDE g.name INCEPE CU MATCHULUI „DOMAIN USERS” (n {highvalue: true}), p = shortestPath ((g) – [r * 1 ..] -> ( n)) return p ***** ***** Gasiti toti ceilalti utilizatori de domeniu corect nu ar trebui sa aiba MATCH p = (m: Group) – [r: Owns |:WriteDacl |: GenericAll |: WriteOwner |: ExecuteDCOM |: GenericWrite |: AllowedToDelegate |: ForceChangePassword] -> (n: Computer) UNDE m.name INCEPE CU RETURNUL „DOMAIN USERS” p ***** ***** Kerberoastable Conturi MATCH (n: Utilizator) UNDE n.hasspn = adevarat RETURN n ***** ***** Kerberoastable Accounts membru al grupului High Value MATCH (n: Utilizator) – [r: MemberOf] -> (g: Group ) UNDE g.highvalue = adevarat Si n.hasspn = adevarat RETURN n, g, r ****** ****** Gasiti statii de lucru in care utilizatorii domeniului pot RDP Pentru a se potrivi p = (g: Grup) – [: CanRDP] -> (c: Computer) unde g.name INCEPE CU „UTILIZATORI DE DOMENIU” SI NU c. Sistemul de operare CONTINE returnarea „Server” p ******* ******* Gasiti SERVERII unde utilizatorii domeniului RDP Pentru a se potrivi p = (g: Group) – [: CanRDP] -> (c: Computer) unde g.name INCEPE CU „DOMAIN USERS” SI c.operatingsystem CONTAIN „Server”return p ******* ******* Top 10 computere cu majoritatea administratorilor MATCH (n: utilizator), (m: computer), (n) – [r: AdminTo] -> (m) WHERE NOT n.name INCEPE CU „LOGON ANONIM” SI NU n.name = ”„ CU m, numarati (r) ca rel_count ordonati prin rel_count desc LIMITA 10 MATCH p = (m) <- [r: AdminTo] – (n) RETURN p ******* ******* Cate tinte de mare valoare poate atinge un nod MATCH p = shortestPath ((n) – [* 1 ..] -> (m {highvalue: true}) ) WHERE NOT n = m RETURN DISTINCT (m.name), ETICHETE (m) [0], COUNT (DISTINCT (n)) ORDER BY COUNT (DISTINCT (n)) DESC ******* **** *** Toate sesiunile de cont DA MATCH (n: User) – [: MemberOf] -> (g: Group {name: “DOMAIN [email protected]”}) MATCH p = (c: Computer) – [: HasSession] -> (n) return p ******** ******** DA Sesiuni catre NON DC – NOU MATCH DE VERSIUNE DE LUCRU (dc: Computer) – [: MemberOf * 1 ..] -> ( g: grup) UNDE CONTINE g.name “CONTROLATOARE DE DOMENIU “CU COLECTARE (dc.name) ca dcs MATCH (c: Computer) WHERE NOT c.name in dcs MATCH p = (c) – [: HasSession] -> (n: User) – [: MemberOf] -> (g: Grup) UNDE g.name INCEPE CU RETURNUL „ADMINISTRATORI DE DOMENIU” n.name ca nume de utilizator ******** ******** Conteaza pe cate masini non-DC au sesiuni – Interogare originala de Waldo (Nu functioneaza afaik) Probabil ca lipseste un COLLECT dupa CU MATCH (c: Computer) – [: MemberOf * 1 ..] -> (g: Group) UNDE g.objectsid INCHEIE CU „-516” CU c.name ca DomainControllers MATCH p = (c2: Computer) – [: HasSession] -> (u: User) – [: MemberOf * 1 ..] -> (g: Group) UNDE g.objectsid INCHEIE CU “-512” SI NU c2 .name in DomainControllers RETURN DISTINCT (u.

madres viciosas porno español creampie
follada en la playa porno caca
michelle jenner desnuda porno gitanas españolas
porno gay violado porno suizo
tetas saltarinas follando en el trastero
abuelas ardientes mi mujer es muy puta
pillados follando infraganti orgias con abuelas
subporno madura en la playa
parejas pilladas en la calle abuelas sexi
videos porno online sexo gratis porno
creampie abuelas pajas pollones
maduras en playas nudistas familia española follando
vidio xxxx porno viejas alemanas
porno interactivo gratis pierre wodman
videos xxx violadas tetas en las playas
gordibuenas españolas videos porno maduras españa
hentai castellano paginas videos porno gratis
sexporn incestos madres hijos
porno caliente videos de zofilia
porno violacion gay la engaña para follar

name), COUNT (DISTINCT (c2)) ORDER BY COUNT (DISTINCT (c2)) DESC ********* ********* EXCLUDE PATH ( Edge) din mers MATCH (n: Utilizator), (m: Group {nume: “DOMAIN [email protected] “}), p = shortestPath ((n) – [r * 1 ..] -> (m)) WHERE ALL (x in relatii (p) WHERE tastati (x) <>” AdminTo ” ) RETURN p ********** ********** Setati SPN la un MATCH utilizator (n: User {nume: “[email protected]”}) SET n.hasspn = adevarat ********** ********** Adaugati DOMAIN USERS ca administrator la COMPxxxx MERGE (n: grup {nume: “DOMAIN [email protected]”}) CU n MERGE ( m: computer {nume: “COMP00673.TESTLAB.LOCAL”}) CU n, m FUZE (n) – [: AdminTo] -> (m) ********** ******* *** Testati noua noastra relatie MATCH p = (n: Group {name: “DOMAIN [email protected]”}) – [r: AdminTo] -> (m: Computer {name: “COMP00673.TESTLAB.LOCAL”} ) RETURN p ********** Incercati sa inlocuiti AdminTo cu 1 ** ********** Stergeti o relatie MATCH p = (n: Group {name: “DOMAIN USERS @ TESTLAB. LOCAL “}) – [r: AdminTo] -> (m:Computer {name: “COMP00673.TESTLAB.LOCAL”}) STERGE r ********** ********** Cea mai scurta cale de la utilizatorii de domeniu la administratorii de domeniu MATCH (g: grup {nume : “DOMAIN [email protected]”}), (n {nume: “DOMAIN [email protected]”}), p = shortestPath ((g) – [* 1 ..] -> (n)) returneaza p ********** ********** Cea mai scurta cale de la utilizatorii de domeniu la administratorii de domeniu (fara administrator) MATCH (g: grup {nume: “DOMAIN [email protected]”}) , (n {nume: “DOMENIU [email protected]”}), p = shortestPath ((g) – [r * 1 ..] -> (n)) WHERE ALL (x in relatii (p) WHERE tastati ( x) <> „AdminTo”) returneaza p ********** ********** Gasiti grupul de administratori neetichetat highvalue MATCH (g: grup) UNDE g.name CONTINE „ADMIN” SI g.highvalue IS null RETURNARE g.name ********** ********** Setati grupul de administrare ca valoare inalta MATCH (g: grup) UNDE g.nume CONTINE „ADMIN” SI g.highvalue IS null SET g.highvalue = true ********** ********** Remore Admin User highvalue MATCH p = (g: Group {highvalue : true}) <- [: MemberOf] – (u: User) UNDE g.name CONTINE SET “ADMIN” g.highvalue = NULL ********** Daca doriti sa enumerati toate proprietatile disponibile: Potriviti (n: Computer) returneaza proprietati (n) ********** Listeaza toate computerele cu delegare fara restrictii MATCH (c: Computer {unconstraineddelegation: true}) returneaza c.name ********** ********** Computer in care cei mai multi utilizatori pot RDP to MATCH (c: Computer) OPTIONAL MATCH (u1: User) – [: CanRDP] -> (c) OPTIONAL MATCH (u2: User) – [ : MemberOf * 1 ..] -> (: Group) – [: CanRDP] -> (c) WITH COLLECT (u1) + COLLECT (u2) ca tempVar, c UNWIND tempVar ca utilizatori RETURN c.name,COUNT (DISTINCT (utilizatori)) ORDER BY COUNT (DISTINCT (utilizatori)) DESC ********** ********** Lungimea medie a caii MATCH (g: Group {name: ‘ DOMAIN [email protected] ‘}) MATCH p = shortestPath ((u: User) – [r: AdminTo | MemberOf | HasSession * 1 ..] -> (g)) CU EXTRACT (n in NODES (p) | ETICHETE (n) [0]) ca pathNodes CU FILTRU (x IN pathNodes WHERE x = “Computer”) as filteredPathNodes RETURN AVG (LENGTH (filteredPathNodes)) ********** MATCH (u: User) MATCH ( g: Group {highvalue: True}) MATCH p = shortestPath ((u: User) – [r: AddMember | AdminTo | AllExtendedRights | AllowedToDelegate | CanRDP | Contine | ExecuteDCOM | ForceChangePassword | GenericAll | GenericWrite | GetChangesAll | GpLink | | Detine | ReadLAPSPassword | TrustedBy | WriteDacl | WriteOwner * 1 ..] -> (g)) RETURN DISTINCT (u.name), u. Comanda activata de u.nume ********** Numarati cati utilizatori au o cale catre DA MATCH p = shortestPath ((u: User) – [* 1 ..] -> (m: Group {name: “DOMAIN ADMINS @ TESTLAB.LOCAL “}))) RETURN COUNT (DISTINCT (u)) ********** **********% din cati utilizatori au o cale catre DA OPTIONAL MATCH p = shortestPath ((u: User) – [* 1 ..] -> (m: Group {name: “DOMAIN [email protected]”})) MATCH OPTIONAL (uT: User) CU COUNT (DISTINCT (uT)) ca uTotal , COUNT (DISTINCT (u)) ca uHasPath RETURN uHasPath * 100 / uTotal ca procent ********** ********** Gasiti utilizatori FARA o cale catre DA MATCH (n: User ), (m: Group) WHERE NOT EXISTS ((n) – [*] -> (m {name: “DOMINIU [email protected]”})) RETURN n.name ********** AVERTISMENT – Acesta este extrem de lung ********** Gasiti utilizatori cu valoare ridicata care NU fac parte din grupul de utilizatori protejati MATCH (prot: User) – [: MemberOf * 1 ..] -> (g: Group) UNDE g.name = “PROTECTED [email protected] “WITH COLLECT (prot) AS protected_user MATCH p = (np: User) – [: MemberOf * 1 ..] -> (m: Group) WHERE m.highvalue = True AND NOT np IN protected_user RETURN np ********** ********** Gasiti calea „usor de exploatat” catre tinta cu valoare ridicata din MATCH proprietar p = shortestpath ((s: User {posedat: true}) – [: MemberOf | AdminTo | Detine | ForceChangePassword | AddMember * 1 ..] -> (t {highvalue: true})) RETURNARE p