cypher.cna

# Cypher.cna
# Generates Cypher query to get ANGRYPUPPY attack path.
#
# Authors: Calvin Hedler (@001SPARTaN) and Vincent Yiu (@vysecurity)

alias cypher{
    generateCypher();
    blog($1, "[*] Sent Cypher queries to Event Log");
}

beacon_command_register("cypher", "Obtains a set of cypher queries for visualisations from current active beacons",
                        "Synopsis: cypher\n\n" .
                        "Obtains a set of cypher queries for visualisations from current active beacons\nOutputs to event log");

sub generateCypher {
	# check in every beacon
	@items = @();
	foreach $session (beacons()){

		$user = $session["user"];
		$computer = $session["computer"];

		if ("*" isin $user){
			$user = substr($user, 0, -2);
		}

		if ((uc($user) !isin @items)){
			if ($user ne "SYSTEM"){
				# if user is not in items

				push(@items, uc($user));
			}
		}
		if ((uc($computer) !isin @items)){
			# if computer is not items
			if ("*" isin $session["user"]){
				push(@items, uc($computer));
			}
		}
	}

	# QUERY for all nodes we have currently
	elog("");
	elog("\cD==============================================");
	elog("\cD====================CYPHER====================");
	elog("\cD==============================================");

	$query = "MATCH (n) WHERE (";
	foreach $a (@items){
			$query = $query . "n.name =~ \"" . $a . "@.*\") OR ("; 	
	}
	$query = $query . ") RETURN n";

	elog("\cB[*] Show all beacon nodes");
	elog("\c9" . $query);
	elog("");

	# QUERY for ALL paths from Current sessions

	# WITH ['GBARNES','RL-DESKTOP18'] as samAccountNames
	# UNWIND samAccountNames as userNames
	# MATCH (n:User)
	# WHERE n.name STARTS WITH userNames
	# WITH n
	# MATCH (g1:Group)
	# WHERE g1.name STARTS WITH "DOMAIN ADMINS@"
	# MATCH p = allShortestPaths((n)-[r:MemberOf|AdminTo|HasSession*1..]->(g1))
	# RETURN p

	$query = "WITH [";
	foreach $a (@items){
		$query = $query . "'" . $a . "',"; 
	}
	$query = substr($query, 0, -1);

	$query = $query . "] as samAccountNames UNWIND samAccountNames as userNames MATCH (n) WHERE n.name STARTS WITH userNames WITH n MATCH (g1:Group) WHERE g1.name STARTS WITH \"DOMAIN ADMINS@\" MATCH p = allShortestPaths((n)-[r:MemberOf|AdminTo|HasSession*1..]->(g1)) RETURN p";

	elog("\cB[*] (B->DA - No ACL) Query all beacon nodes to Domain Admins");
	elog("\c9" . $query);
	elog("");

	# QUERY FOR SHORTEST PATH for ANGRYPUPPY

	# WITH ['GBARNES','RL-DESKTOP18'] as samAccountNames
	# UNWIND samAccountNames as userNames
	# MATCH (n:User)
	# WHERE n.name STARTS WITH userNames
	# WITH n
	# MATCH (g1:Group)
	# WHERE g1.name STARTS WITH "DOMAIN ADMINS@"
	# MATCH p = allShortestPaths((n)-[r:MemberOf|AdminTo|HasSession*1..]->(g1))
	# RETURN p
	# ORDER BY LENGTH(p) ASC
	# LIMIT 1

	$query = "WITH [";
	foreach $a (@items){
		$query = $query . "'" . $a . "',"; 
	}
	$query = substr($query, 0, -1);

	$query = $query . "] as samAccountNames UNWIND samAccountNames as userNames MATCH (n) WHERE n.name STARTS WITH userNames WITH n MATCH (g1:Group) WHERE g1.name STARTS WITH \"DOMAIN ADMINS@\" MATCH p = allShortestPaths((n)-[r:MemberOf|AdminTo|HasSession*1..]->(g1)) RETURN p ORDER BY LENGTH(p) ASC LIMIT 1";

	elog("\cB[*] (B->DA - No ACL) Query all beacon nodes to generate ANGRYPUPPY path");
	elog("\c9" . $query);
	elog("");

	############################
	############################
	######### A C L ############
	############################
	############################

	$query = "WITH [";
	foreach $a (@items){
		$query = $query . "'" . $a . "',"; 
	}
	$query = substr($query, 0, -1);

	$query = $query . "] as samAccountNames UNWIND samAccountNames as userNames MATCH (n) WHERE n.name STARTS WITH userNames WITH n MATCH (g1:Group) WHERE g1.name STARTS WITH \"DOMAIN ADMINS@\" MATCH p = allShortestPaths((n)-[r*1..]->(g1)) RETURN p";

	elog("\cB[*] (B->DA - ACL) Query all beacon nodes to Domain Admins");
	elog("\c9" . $query);
	elog("");

	# QUERY FOR SHORTEST PATH for ANGRYPUPPY ACL

	$query = "WITH [";
	foreach $a (@items){
		$query = $query . "'" . $a . "',"; 
	}
	$query = substr($query, 0, -1);

	$query = $query . "] as samAccountNames UNWIND samAccountNames as userNames MATCH (n) WHERE n.name STARTS WITH userNames WITH n MATCH (g1:Group) WHERE g1.name STARTS WITH \"DOMAIN ADMINS@\" MATCH p = allShortestPaths((n)-[r*1..]->(g1)) RETURN p ORDER BY LENGTH(p) ASC LIMIT 1";

	elog("\cB[*] (B->DA - ACL) Query all beacon nodes to generate ANGRYPUPPY path");
	elog("\c9" . $query);


	return $query;
}

sub init {
	# Initialise
}

init()