trustedsec / CS-Situational-Awareness-BOF

Situational Awareness commands implemented using Beacon Object Files
GNU General Public License v2.0
1.28k stars 221 forks source link

Add Secondary localgroup/session BOFs Supported by BOFHound #114

Closed Tw1sm closed 10 months ago

Tw1sm commented 10 months ago

External tool BOFHound (now here) has supported parsing ldapsearch results out of C2 logs to produce JSON for BloodHound. This PR adds several secondary versions of existing BOFs that allow parsing of session data and local group memberships from log files. This allows for BloodHound's HasSession, AdminTo and other edges that rely on local group data.

This PR includes secondary versions of the following BOFs (mostly modified for ease of output parsing, but there are some other modifications such as structures returned by API calls):

One "new" BOF to pull sessions from the registry:

I opted for separate secondary BOFs since the changes aren't really upgrades/bugfixes for the original BOFs, and in some cases might clutter the output with data some users don't care for. With that said, if you'd like these changes merged into the original BOFs, I can make the necessary edits. Conversely, if you don't want to accept this PR, I am happy to move these BOFs to their own dedicated repo.

Additional details here: https://posts.specterops.io/bofhound-session-integration-7b88b6f18423

Tw1sm commented 10 months ago

@freefirex thank you for providing recommended fixes for the issues - huge help. I think I've made the changes as requested, but if any issues are still lingering, please let me know and I'll take another pass

freefirex commented 10 months ago

Merged, thanks again!