Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Fix] Updated queries for bloodhound 4.3.1 #17

Open
scmanjarrez opened this issue Jul 25, 2024 · 1 comment
Open

[Fix] Updated queries for bloodhound 4.3.1 #17

scmanjarrez opened this issue Jul 25, 2024 · 1 comment

Comments

@scmanjarrez
Copy link

scmanjarrez commented Jul 25, 2024

I'll leave here some fixes to the customqueries.json, just in case someone stumble upon these errors

Query:

  • Find all sessions a user in a specific domain has
  • Find an object from domain 'A' that can do anything to a foreign object

Fix:

  • Change {domain:{result}} for {domain: $result}

Query:

  • Find Kerberoastable users and where they are AdminTo

Fix:

  • Change RETURN u for RETURN u1

Query:

  • Find All Users with an SPN/Find all Kerberoastable Users with passwords last set > 5 years ago

Fix:

  • Remove WHERE keyword in AND WHERE u.pwdlastset
  • Change n.hasspn for u.hasspn

Query:

  • Find all computers with unsupported operating systems

Fix:

  • Change to query to be MATCH (H:Computer) WHERE H.operatingsystem =~ '(?i).(2000|2003|2008|xp|vista|7|me).' RETURN H

This update is based on a comment in the original blog

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants
@scmanjarrez and others