BloodHound MCP

執行Cypher查詢並返回結果

Args: query: Cypher查詢字符串 parameters: 查詢參數字典

Returns: 查詢結果列表

[WIP] Users with Most Local Admin Rights

[WIP] Computers with Most Sessions [Required: sessions]

[WIP] Users with Most Sessions [Required: sessions]

List non-privileged user(s) with dangerous permissions to any node type

Route non-privileged user(s) with dangerous permissions to any node type

[WIP] Users with most cross-domain sessions [Required: sessions]

List high value target(s)

List domain(s)

List domain trust(s)

List enabled user(s)

List enabled user(s) with an email address

List non-managed service account(s)

List enabled principal(s) with "Unconstrained Delegation"

List enabled principal(s) with "Constrained Delegation"

List domain controller(s)

List domain computer(s)

List Certificate Authority server(s) [Required: Certipy]

[WIP] List privileges for Certificate Authority server(s) [Required: Certipy]

List all Certificate Template(s) [Required: Certipy]

Find enabled Certificate Template(s) [Required: Certipy]

[WIP] List all Enrollment Right(s) for Certificate Template(s)

List computer(s) WITHOUT LAPS

List network share(s), ignoring SYSVOL

List all group(s)

List all GPO(s)

List all principal(s) with "Local Admin" permission

List all principal(s) with "RDP" permission

List all principal(s) with "SQLAdmin" permission

List all user session(s) [Required: sessions]

List all user(s) with description field

List all enabled user(s) with "userpassword" attribute

List all enabled user(s) with "password never expires" attribute

List all enabled user(s) with "password never expires" attribute and not changed in last year

List all enabled user(s) with "don't require passwords" attribute

List all enabled user(s) but never logged in

List all enabled user(s) that logged in within the last 90 days

List all enabled user(s) that set password within the last 90 days

List all enabled user(s) with foreign group membership

List all owned user(s)

List all owned & enabled user(s)

List all owned & enabled user(s) with an email address

List all owned & enabled user(s) with "Local Admin" permission, and any active sessions and their group membership(s)

List all owned & enabled user(s) with "RDP" permission, and any active sessions and their group membership(s)

List all owned & enabled user(s) with "SQLAdmin" permission

List all owned computer(s)

Route all owned & enabled group membership(s)

Route all owned & enabled non-privileged group(s) membership

Route all owned & enabled privileged group(s) membership

Route all owned & enabled user(s) with Dangerous Rights to any node type

Route all owned & enabled user(s) with Dangerous Rights to group(s)

Route all owned & enabled user(s) with Dangerous Rights to user(s)

Route from owned & enabled user(s) to all principals with "Unconstrained Delegation"

Route from owned & enabled principals to high value target(s)

Owned: [WIP] Find all owned user with privileged access to Azure Tenancy (Required: azurehound)

Owned: [WIP] Find all owned user where group membership grants privileged access to Azure Tenancy (Required: azurehound)

Owned: [WIP] Find all Owners of Azure Applications with Owners to Service Principals with Dangerous Rights (Required: azurehound)

Find all owned groups that grant access to network shares

Route all sessions to computers WITHOUT LAPS (Required: sessions)

Route all sessions to computers (Required: sessions)

List enabled non-privileged user(s) with "Local Admin" permission

List enabled non-privileged user(s) with "Local Admin" permission, and any active sessions and their group membership(s)

List enabled non-privileged user(s) with "RDP" permission

List enabled non-privileged user(s) with "RDP" permission, and any active sessions and their group membership(s)

List enabled non-privileged user(s) with "SQLAdmin" permission

List all "Domain Users" group membership(s)

List all "Authenticated Users" group membership(s)

Find all enabled AS-REP roastable user(s)

Find all enabled kerberoastable user(s)

Route non-privileged user(s) with dangerous rights to user(s) [HIGH RAM]

Route non-privileged user(s) with dangerous rights to group(s) [HIGH RAM]

Route non-privileged user(s) with dangerous rights to computer(s) [HIGH RAM]

Route non-privileged user(s) with dangerous rights to GPO(s) [HIGH RAM]

Route non-privileged user(s) with dangerous rights to privileged node(s) [HIGH RAM]

Route non-privileged computer(s) with dangerous rights to user(s) [HIGH RAM]

Route non-privileged computer(s) with dangerous rights to group(s) [HIGH RAM]

Route non-privileged computer(s) with dangerous rights to computer(s) [HIGH RAM]

Route non-privileged computer(s) with dangerous rights to GPO(s) [HIGH RAM]

Route non-privileged computer(s) with dangerous rights to privileged node(s) [HIGH RAM]

List ESC1 vulnerable Certificate Template(s) [Required: Certipy]

List ESC2 vulnerable Certificate Template(s) [Required: Certipy]

List ESC3 vulnerable Certificate Template(s) [Required: Certipy]

List ESC4 vulnerable Certificate Template(s) [Required: Certipy]

List ESC6 vulnerable Certificate Template(s) [Required: Certipy]

List ESC7 vulnerable Certificate Template(s) [Required: Certipy]

List ESC8 vulnerable Certificate Template(s) [Required: Certipy]

List all cross-domain user session(s) and user group membership(s)

List privileged user(s) without "Protected Users" group membership

List custom privileged group(s)

List all enabled SVC account(s) with privileged group membership(s)

Route all privileged user(s) with sessions to non-privileged computer(s) [Required: sessions]

Find allshortestpaths with dangerous rights to AdminSDHolder object

Find allshortestpaths with DCSync to domain object

Find allshortestpaths with Shadow Credential permission to principal(s)

List all Tenancy (Required: azurehound)

[WIP] List all AAD Group(s) that are synchronized with AD (Required: azurehound)

[WIP] List all principal(s) used for syncing AD and AAD

List all enabled Azure User(s) (Required: azurehound)

List all enabled Azure User(s) Azure Group membership(s) (Required: azurehound)

[WIP] List all AD principal(s) with edge(s) to Azure principal(s) (Required: azurehound)