internal void StartEnumeration() { var output = new BlockingCollection <Wrapper <JsonBase> >(); var writer = StartOutputWriter(output); foreach (var domain in _utils.GetDomainList()) { Extensions.SetPrimaryDomain(domain); _noPing = 0; _timeouts = 0; _currentCount = 0; Console.WriteLine($"Starting Enumeration for {domain}"); _watch = Stopwatch.StartNew(); var input = new BlockingCollection <Wrapper <SearchResultEntry> >(1000); var taskHandles = new Task[_options.Threads]; var ldapData = LdapFilter.BuildLdapData(_options.ResolvedCollMethods, _options.ExcludeDC, _options.LdapFilter); ContainerHelpers.BuildGpoCache(domain); for (var i = 0; i < _options.Threads; i++) { taskHandles[i] = StartRunner(input, output); } _statusTimer.Start(); foreach (var item in _utils.DoWrappedSearch(ldapData.Filter, SearchScope.Subtree, ldapData.Properties, domain, _options.Ou)) { input.Add(item); } input.CompleteAdding(); Utils.Verbose("Waiting for enumeration threads to finish"); Task.WaitAll(taskHandles); if (_entDcs.Count > 0) { var dObj = _utils.GetForest(domain); var d = dObj == null ? domain : dObj.RootDomain.Name; var n = $"ENTERPRISE DOMAIN CONTROLLERS@{d}"; var obj = new Group { Name = n, Members = _entDcs.ToArray() }; obj.Properties.Add("domain", d); obj.Properties.Add("objectsid", "S-1-5-9"); obj.Properties.Add("highvalue", true); output.Add(new Wrapper <JsonBase> { Item = obj }); } _statusTimer.Stop(); PrintStatus(); _watch.Stop(); Console.WriteLine($"Finished enumeration for {domain} in {_watch.Elapsed}"); Console.WriteLine($"{_noPing} hosts failed ping. {_timeouts} hosts timedout."); _watch = null; } output.CompleteAdding(); Utils.Verbose("Waiting for writer thread to finish"); writer.Wait(); if ((_options.ResolvedCollMethods & ResolvedCollectionMethod.SessionLoop) == 0) { return; } _options.SessionLoopRunning = true; _options.ResolvedCollMethods = ResolvedCollectionMethod.SessionLoop; Console.WriteLine(); Console.WriteLine("---------------------------"); Console.WriteLine("Starting Session Loop Mode."); Console.WriteLine("---------------------------"); Console.WriteLine(); new ManualResetEvent(false).WaitOne(1000); StartSessionLoopEnumeration(); }
internal void StartStealthEnumeration() { var output = new BlockingCollection <Wrapper <JsonBase> >(); var writer = StartOutputWriter(output); foreach (var domainName in _utils.GetDomainList()) { Extensions.SetPrimaryDomain(domainName); _currentCount = 0; _timeouts = 0; _noPing = 0; _watch = Stopwatch.StartNew(); Console.WriteLine($"Starting Stealth Enumeration for {domainName}"); _statusTimer.Start(); var domainSid = _utils.GetDomainSid(domainName); var res = _options.ResolvedCollMethods; var data = LdapFilter.BuildLdapData(res, _options.ExcludeDC, _options.LdapFilter); ContainerHelpers.BuildGpoCache(domainName); foreach (var entry in _utils.DoSearch(data.Filter, SearchScope.Subtree, data.Properties, domainName)) { var resolved = entry.ResolveAdEntry(); _currentCount++; if (resolved == null) { continue; } Console.WriteLine(resolved.BloodHoundDisplay); Console.WriteLine(resolved.ObjectType); var domain = Utils.ConvertDnToDomain(entry.DistinguishedName); var sid = entry.GetSid(); if (resolved.ObjectType == "user") { var obj = new User { Name = resolved.BloodHoundDisplay }; obj.Properties.Add("domain", domain); obj.Properties.Add("objectsid", sid); obj.Properties.Add("highvalue", false); ObjectPropertyHelpers.GetProps(entry, resolved, ref obj); GroupHelpers.GetGroupInfo(entry, resolved, domainSid, ref obj); AclHelpers.GetObjectAces(entry, resolved, ref obj); output.Add(new Wrapper <JsonBase> { Item = obj }); } else if (resolved.ObjectType == "group") { var obj = new Group { Name = resolved.BloodHoundDisplay }; obj.Properties.Add("domain", domain); obj.Properties.Add("objectsid", sid); if (sid.EndsWith("-512") || sid.EndsWith("-516") || sid.EndsWith("-519") || sid.EndsWith("-520") || sid.Equals("S-1-5-32-544") || sid.Equals("S-1-5-32-550") || sid.Equals("S-1-5-32-549") || sid.Equals("S-1-5-32-551") || sid.Equals("S-1-5-32-548")) { obj.Properties.Add("highvalue", true); } else { obj.Properties.Add("highvalue", false); } ObjectPropertyHelpers.GetProps(entry, resolved, ref obj); GroupHelpers.GetGroupInfo(entry, resolved, domainSid, ref obj); AclHelpers.GetObjectAces(entry, resolved, ref obj); output.Add(new Wrapper <JsonBase> { Item = obj }); } else if (resolved.ObjectType == "computer") { var obj = new Computer { Name = resolved.BloodHoundDisplay, }; obj.Properties.Add("domain", domain); obj.Properties.Add("objectsid", sid); obj.Properties.Add("highvalue", false); if (entry.DistinguishedName.ToLower().Contains("domain controllers")) { _entDcs.Enqueue(new GroupMember { MemberType = "computer", MemberName = resolved.BloodHoundDisplay }); } ObjectPropertyHelpers.GetProps(entry, resolved, ref obj); GroupHelpers.GetGroupInfo(entry, resolved, domainSid, ref obj); AclHelpers.GetObjectAces(entry, resolved, ref obj); output.Add(new Wrapper <JsonBase> { Item = obj }); } else if (resolved.ObjectType == "domain") { var obj = new Domain { Name = resolved.BloodHoundDisplay, }; obj.Properties.Add("objectsid", sid); obj.Properties.Add("highvalue", true); ObjectPropertyHelpers.GetProps(entry, resolved, ref obj); AclHelpers.GetObjectAces(entry, resolved, ref obj); ContainerHelpers.ResolveContainer(entry, resolved, ref obj); TrustHelpers.DoTrustEnumeration(resolved, ref obj); output.Add(new Wrapper <JsonBase> { Item = obj }); } else if (resolved.ObjectType == "gpo") { var obj = new Gpo { Name = resolved.BloodHoundDisplay, Guid = entry.GetProp("name").Replace("{", "").Replace("}", "") }; obj.Properties.Add("highvalue", false); AclHelpers.GetObjectAces(entry, resolved, ref obj); foreach (var a in LocalGroupHelpers.GetGpoMembers(entry, domain)) { output.Add(new Wrapper <JsonBase> { Item = a }); } output.Add(new Wrapper <JsonBase> { Item = obj }); } else if (resolved.ObjectType == "ou") { var obj = new Ou { Guid = new Guid(entry.GetPropBytes("objectguid")).ToString().ToUpper() }; obj.Properties.Add("name", resolved.BloodHoundDisplay); obj.Properties.Add("highvalue", false); ContainerHelpers.ResolveContainer(entry, resolved, ref obj); output.Add(new Wrapper <JsonBase> { Item = obj }); } } if (Utils.IsMethodSet(ResolvedCollectionMethod.Session)) { Console.WriteLine("Doing stealth session enumeration"); foreach (var target in SessionHelpers.CollectStealthTargets(domainName)) { if (!_utils.PingHost(target.BloodHoundDisplay)) { _noPing++; continue; } try { foreach (var session in SessionHelpers.GetNetSessions(target, domainName)) { output.Add(new Wrapper <JsonBase> { Item = session }); } } catch (TimeoutException) { _timeouts++; } } } if (_entDcs.Count > 0) { var dObj = _utils.GetForest(domainName); var d = dObj == null ? domainName : dObj.RootDomain.Name; var n = $"ENTERPRISE DOMAIN CONTROLLERS@{d}"; var obj = new Group { Name = n, Members = _entDcs.ToArray() }; obj.Properties.Add("domain", d); obj.Properties.Add("objectsid", "S-1-5-9"); obj.Properties.Add("highvalue", true); output.Add(new Wrapper <JsonBase> { Item = obj }); } PrintStatus(); _statusTimer.Stop(); Console.WriteLine($"Finished stealth enumeration for {domainName} in {_watch.Elapsed}"); Console.WriteLine($"{_noPing} hosts failed ping. {_timeouts} hosts timedout."); } output.CompleteAdding(); Utils.Verbose("Waiting for writer thread to finish"); writer.Wait(); }
public void StartStealthEnumeration() { var output = new BlockingCollection <Wrapper <OutputBase> >(); var writer = _options.Uri == null ? StartOutputWriter(output) : StartRestWriter(output); foreach (var domainName in _utils.GetDomainList()) { Console.WriteLine($"Starting stealth enumeration for {domainName}\n"); var domainSid = _utils.GetDomainSid(domainName); var data = LdapFilter.GetLdapFilter(_options.CollectMethod, _options.ExcludeDC, true); switch (_options.CollectMethod) { case CollectionMethod.ObjectProps: Console.WriteLine("Doing stealth enumeration for object properties"); foreach (var entry in _utils.DoSearch(data.Filter, SearchScope.Subtree, data.Properties, domainName)) { var resolved = entry.ResolveAdEntry(); OutputBase props; if (resolved.ObjectType.Equals("computer")) { props = ObjectPropertyHelpers.GetComputerProps(entry, resolved); } else { props = ObjectPropertyHelpers.GetUserProps(entry, resolved); } if (props != null) { output.Add(new Wrapper <OutputBase> { Item = props }); } } break; case CollectionMethod.Session: Console.WriteLine("Doing stealth enumeration for sessions"); foreach (var path in SessionHelpers.CollectStealthTargets(domainName)) { var sessions = SessionHelpers.GetNetSessions(path, domainName); foreach (var s in sessions) { output.Add(new Wrapper <OutputBase> { Item = s }); } } break; case CollectionMethod.ComputerOnly: Console.WriteLine("Doing stealth enumeration for sessions"); foreach (var path in SessionHelpers.CollectStealthTargets(domainName)) { var sessions = SessionHelpers.GetNetSessions(path, domainName); foreach (var s in sessions) { output.Add(new Wrapper <OutputBase> { Item = s }); } } Console.WriteLine("Doing stealth enumeration for admins"); foreach (var entry in _utils.DoSearch( data.Filter, SearchScope.Subtree, data.Properties, domainName)) { foreach (var admin in LocalAdminHelpers.GetGpoAdmins(entry, domainName)) { output.Add(new Wrapper <OutputBase> { Item = admin }); } } break; case CollectionMethod.Default: Console.WriteLine("Doing stealth enumeration for sessions"); foreach (var path in SessionHelpers.CollectStealthTargets(domainName)) { var sessions = SessionHelpers.GetNetSessions(path, domainName); foreach (var s in sessions) { output.Add(new Wrapper <OutputBase> { Item = s }); } } Console.WriteLine("Doing stealth enumeration for admins"); foreach (var entry in _utils.DoSearch( "(&(objectCategory=groupPolicyContainer)(name=*)(gpcfilesyspath=*))", SearchScope.Subtree, new[] { "displayname", "name", "gpcfilesyspath" }, domainName)) { foreach (var admin in LocalAdminHelpers.GetGpoAdmins(entry, domainName)) { output.Add(new Wrapper <OutputBase> { Item = admin }); } } Console.WriteLine("Doing stealth enumeration for groups"); foreach (var entry in _utils.DoSearch("(|(memberof=*)(primarygroupid=*))", SearchScope.Subtree, new[] { "samaccountname", "distinguishedname", "dnshostname", "samaccounttype", "primarygroupid", "memberof", "serviceprincipalname" }, domainName)) { var resolvedEntry = entry.ResolveAdEntry(); foreach (var group in GroupHelpers.ProcessAdObject(entry, resolvedEntry, domainSid)) { output.Add(new Wrapper <OutputBase> { Item = group }); } } break; case CollectionMethod.SessionLoop: Console.WriteLine("Doing stealth enumeration for sessions"); foreach (var path in SessionHelpers.CollectStealthTargets(domainName)) { var sessions = SessionHelpers.GetNetSessions(path, domainName); foreach (var s in sessions) { output.Add(new Wrapper <OutputBase> { Item = s }); } } break; case CollectionMethod.LoggedOn: Console.WriteLine("Doing LoggedOn enumeration for stealth targets"); foreach (var path in SessionHelpers.CollectStealthTargets(domainName)) { var sessions = SessionHelpers.GetNetLoggedOn(path, domainName); foreach (var s in sessions) { output.Add(new Wrapper <OutputBase> { Item = s }); } sessions = SessionHelpers.GetRegistryLoggedOn(path); foreach (var s in sessions) { output.Add(new Wrapper <OutputBase> { Item = s }); } } break; case CollectionMethod.Group: Console.WriteLine("Doing stealth enumeration for groups"); foreach (var entry in _utils.DoSearch(data.Filter, SearchScope.Subtree, data.Properties, domainName)) { var resolvedEntry = entry.ResolveAdEntry(); foreach (var group in GroupHelpers.ProcessAdObject(entry, resolvedEntry, domainSid)) { output.Add(new Wrapper <OutputBase> { Item = group }); } } break; case CollectionMethod.LocalGroup: //This case will never happen break; case CollectionMethod.GPOLocalGroup: Console.WriteLine("Doing stealth enumeration for admins"); foreach (var entry in _utils.DoSearch( data.Filter, SearchScope.Subtree, data.Properties, domainName)) { foreach (var admin in LocalAdminHelpers.GetGpoAdmins(entry, domainName)) { output.Add(new Wrapper <OutputBase> { Item = admin }); } } break; case CollectionMethod.Trusts: var trusts = DomainTrustEnumeration.DoTrustEnumeration(domainName); foreach (var trust in trusts) { output.Add(new Wrapper <OutputBase> { Item = trust }); } break; case CollectionMethod.ACL: Console.WriteLine("Doing stealth enumeration for ACLs"); foreach (var entry in _utils.DoSearch( data.Filter, SearchScope.Subtree, data.Properties, domainName)) { foreach (var acl in AclHelpers.ProcessAdObject(entry, domainName)) { output.Add(new Wrapper <OutputBase> { Item = acl }); } } break; default: throw new ArgumentOutOfRangeException(); } output.CompleteAdding(); writer.Wait(); Console.WriteLine($"Finished stealth enumeration for {domainName}"); } if (!_options.CollectMethod.Equals(CollectionMethod.SessionLoop)) { return; } if (_options.MaxLoopTime != null) { if (DateTime.Now > _options.LoopEnd) { Console.WriteLine("Exiting session loop as LoopEndTime as passed"); return; } } Console.WriteLine($"Starting next session run in {_options.LoopTime} minutes"); new ManualResetEvent(false).WaitOne(_options.LoopTime * 60 * 1000); if (_options.MaxLoopTime != null) { if (DateTime.Now > _options.LoopEnd) { Console.WriteLine("Exiting session loop as LoopEndTime as passed"); return; } } Console.WriteLine("Starting next enumeration loop"); StartStealthEnumeration(); }
internal void StartListSessionLoopEnumeration() { var output = new BlockingCollection <Wrapper <JsonBase> >(); var writer = StartOutputWriter(output); while (true) { foreach (var domain in _utils.GetDomainList()) { Extensions.SetPrimaryDomain(domain); _noPing = 0; _timeouts = 0; _currentCount = 0; Console.WriteLine($"Starting Enumeration for {domain}"); _watch = Stopwatch.StartNew(); var input = new BlockingCollection <Wrapper <SearchResultEntry> >(1000); var taskHandles = new Task[_options.Threads]; var ldapData = LdapFilter.BuildLdapData(_options.ResolvedCollMethods, _options.ExcludeDC, _options.LdapFilter); ContainerHelpers.BuildGpoCache(domain); for (var i = 0; i < _options.Threads; i++) { taskHandles[i] = StartRunner(input, output); } _statusTimer.Start(); foreach (var item in _utils.DoWrappedSearch(ldapData.Filter, SearchScope.Subtree, ldapData.Properties, domain, _options.Ou)) { input.Add(item); } input.CompleteAdding(); Utils.Verbose("Waiting for enumeration threads to finish"); Task.WaitAll(taskHandles); _statusTimer.Stop(); PrintStatus(); output.CompleteAdding(); _watch.Stop(); Console.WriteLine($"Finished enumeration for {domain} in {_watch.Elapsed}"); Console.WriteLine($"{_noPing} hosts failed ping. {_timeouts} hosts timedout."); _watch = null; } if (Console.KeyAvailable && Console.ReadKey(true).Key == ConsoleKey.Escape) { Console.WriteLine("User pressed escape, exiting session loop"); output.CompleteAdding(); writer.Wait(); break; } if (_options.MaxLoopTime != null) { if (DateTime.Now > _options.LoopEnd) { Console.WriteLine("Exiting session loop as LoopEndTime has passed."); output.CompleteAdding(); writer.Wait(); break; } } Console.WriteLine($"Starting next session run in {_options.LoopDelay} seconds"); new ManualResetEvent(false).WaitOne(_options.LoopDelay * 1000); if (_options.MaxLoopTime != null) { if (DateTime.Now > _options.LoopEnd) { Console.WriteLine("Exiting session loop as LoopEndTime has passed."); output.CompleteAdding(); writer.Wait(); break; } } if (Console.KeyAvailable && Console.ReadKey(true).Key == ConsoleKey.Escape) { Console.WriteLine("User pressed escape, exiting session loop"); output.CompleteAdding(); writer.Wait(); break; } Console.WriteLine("Starting next session loop"); } }
public void StartEnumeration() { //Let's determine what LDAP filter we need first var data = LdapFilter.GetLdapFilter(_options.CollectMethod, _options.ExcludeDC, _options.Stealth); var ldapFilter = data.Filter; var props = data.Properties; var c = _options.CollectMethod; foreach (var domainName in _utils.GetDomainList()) { _noPing = 0; _timeouts = 0; Console.WriteLine($"Starting enumeration for {domainName}"); _watch = Stopwatch.StartNew(); _currentDomain = domainName; _currentDomainSid = _utils.GetDomainSid(domainName); _currentCount = 0; var outputQueue = new BlockingCollection <Wrapper <OutputBase> >(); if (_options.ComputerFile == null) { var inputQueue = new BlockingCollection <Wrapper <SearchResultEntry> >(1000); var taskhandles = new Task[_options.Threads]; var writer = _options.Uri == null ? StartOutputWriter(outputQueue) : StartRestWriter(outputQueue); if (c.Equals(CollectionMethod.Trusts) || c.Equals(CollectionMethod.Default)) { foreach (var domain in DomainTrustEnumeration.DoTrustEnumeration(domainName)) { outputQueue.Add(new Wrapper <OutputBase> { Item = domain }); } if (_options.CollectMethod.Equals(CollectionMethod.Trusts)) { outputQueue.CompleteAdding(); writer.Wait(); continue; } } if (c.Equals(CollectionMethod.Container)) { foreach (var container in ContainerHelpers.GetContainersForDomain(domainName)) { outputQueue.Add(new Wrapper <OutputBase> { Item = container }); } if (_options.CollectMethod.Equals(CollectionMethod.Container)) { outputQueue.CompleteAdding(); writer.Wait(); continue; } } for (var i = 0; i < _options.Threads; i++) { taskhandles[i] = StartRunner(inputQueue, outputQueue); } _statusTimer.Start(); IEnumerable <Wrapper <SearchResultEntry> > items; if ((c.Equals(CollectionMethod.ComputerOnly) || c.Equals(CollectionMethod.Session) || c.Equals(CollectionMethod.LocalGroup) || c.Equals(CollectionMethod.LoggedOn)) && _options.Ou != null) { items = _utils.DoWrappedSearch(ldapFilter, SearchScope.Subtree, props, domainName, _options.Ou); } else { items = _utils.DoWrappedSearch(ldapFilter, SearchScope.Subtree, props, domainName); } foreach (var item in items) { inputQueue.Add(item); } inputQueue.CompleteAdding(); Utils.Verbose("Waiting for enumeration threads to finish"); Task.WaitAll(taskhandles); _statusTimer.Stop(); if (_options.CollectMethod.Equals(CollectionMethod.ACL)) { foreach (var a in AclHelpers.GetSyncers()) { outputQueue.Add(new Wrapper <OutputBase> { Item = a }); } AclHelpers.ClearSyncers(); } PrintStatus(); outputQueue.CompleteAdding(); Utils.Verbose("Waiting for writer thread to finish"); writer.Wait(); _watch.Stop(); Console.WriteLine($"Finished enumeration for {domainName} in {_watch.Elapsed}"); Console.WriteLine($"{_noPing} hosts failed ping. {_timeouts} hosts timedout."); _watch = null; } else { var inputQueue = new BlockingCollection <Wrapper <string> >(1000); var taskhandles = new Task[_options.Threads]; var writer = _options.Uri == null?StartOutputWriter(outputQueue) : StartRestWriter(outputQueue); for (var i = 0; i < _options.Threads; i++) { taskhandles[i] = StartCompListRunner(inputQueue, outputQueue); } _statusTimer.Start(); using (var reader = new StreamReader(_options.ComputerFile)) { string line; while ((line = reader.ReadLine()) != null) { inputQueue.Add(new Wrapper <string> { Item = line }); } inputQueue.CompleteAdding(); } Utils.Verbose("Waiting for enumeration threads to finish"); Task.WaitAll(taskhandles); _statusTimer.Stop(); PrintStatus(); outputQueue.CompleteAdding(); Utils.Verbose("Waiting for writer thread to finish"); writer.Wait(); _watch.Stop(); Console.WriteLine($"Finished enumeration for {domainName} in {_watch.Elapsed}"); Console.WriteLine($"{_noPing} hosts failed ping. {_timeouts} hosts timedout."); _watch = null; } } if (!_options.CollectMethod.Equals(CollectionMethod.SessionLoop)) { return; } if (_options.MaxLoopTime != null) { if (DateTime.Now > _options.LoopEnd) { Console.WriteLine("Exiting session loop as LoopEndTime as passed"); return; } } Console.WriteLine($"Starting next session run in {_options.LoopTime} minutes"); new ManualResetEvent(false).WaitOne(_options.LoopTime * 60 * 1000); if (_options.MaxLoopTime != null) { if (DateTime.Now > _options.LoopEnd) { Console.WriteLine("Exiting session loop as LoopEndTime as passed"); return; } } Console.WriteLine("Starting next enumeration loop"); StartEnumeration(); }