#!/usr/bin/env python3
# For authorized penetration testing and educational environments only.
# Usage against targets without prior mutual consent is illegal.
# It is the end user's responsibility to obey all applicable local, state and federal laws.
"""BloodHound CE reconnaissance agent using bloodhound Python ingestor and Neo4j."""

import json
import sys
import argparse
import subprocess
from datetime import datetime

try:
    from neo4j import GraphDatabase
except ImportError:
    print("Install: pip install neo4j")
    sys.exit(1)


def collect_bloodhound_data(domain, username, password, dc_ip, method="all"):
    """Run BloodHound Python ingestor to collect AD data."""
    cmd = [
        "bloodhound-python", "-d", domain, "-u", username, "-p", password,
        "-ns", dc_ip, "-c", method, "--zip",
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
        return {"status": "completed", "output": result.stdout[:1000]}
    except FileNotFoundError:
        return {"status": "error", "message": "Install: pip install bloodhound"}
    except subprocess.TimeoutExpired:
        return {"status": "timeout"}


def query_shortest_path_to_da(driver):
    """Find shortest path to Domain Admins."""
    with driver.session() as session:
        result = session.run(
            "MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name: $group})) "
            "WHERE u.enabled = true RETURN u.name AS user, length(p) AS hops "
            "ORDER BY hops LIMIT 10",
            group="DOMAIN ADMINS@DOMAIN.LOCAL",
        )
        return [{"user": r["user"], "hops": r["hops"]} for r in result]


def query_kerberoastable_users(driver):
    """Find kerberoastable user accounts."""
    with driver.session() as session:
        result = session.run(
            "MATCH (u:User) WHERE u.hasspn = true AND u.enabled = true "
            "RETURN u.name AS user, u.serviceprincipalnames AS spns, "
            "u.admincount AS admin_count ORDER BY u.admincount DESC"
        )
        return [{"user": r["user"], "spns": r["spns"],
                 "admin": r["admin_count"]} for r in result]


def query_unconstrained_delegation(driver):
    """Find computers with unconstrained delegation."""
    with driver.session() as session:
        result = session.run(
            "MATCH (c:Computer) WHERE c.unconstraineddelegation = true "
            "RETURN c.name AS computer, c.operatingsystem AS os"
        )
        return [{"computer": r["computer"], "os": r["os"]} for r in result]


def query_as_rep_roastable(driver):
    """Find AS-REP roastable accounts (no pre-auth required)."""
    with driver.session() as session:
        result = session.run(
            "MATCH (u:User) WHERE u.dontreqpreauth = true AND u.enabled = true "
            "RETURN u.name AS user, u.admincount AS admin_count"
        )
        return [{"user": r["user"], "admin": r["admin_count"]} for r in result]


def run_recon(neo4j_uri, neo4j_user, neo4j_password):
    """Run BloodHound reconnaissance queries."""
    driver = GraphDatabase.driver(neo4j_uri, auth=(neo4j_user, neo4j_password))
    print(f"\n{'='*60}")
    print(f"  BLOODHOUND CE RECONNAISSANCE")
    print(f"  Generated: {datetime.utcnow().isoformat()} UTC")
    print(f"{'='*60}\n")

    paths = query_shortest_path_to_da(driver)
    print(f"--- SHORTEST PATHS TO DOMAIN ADMIN ({len(paths)}) ---")
    for p in paths:
        print(f"  {p['user']}: {p['hops']} hops")

    kerb = query_kerberoastable_users(driver)
    print(f"\n--- KERBEROASTABLE USERS ({len(kerb)}) ---")
    for k in kerb[:10]:
        print(f"  {k['user']} (admin={k['admin']})")

    deleg = query_unconstrained_delegation(driver)
    print(f"\n--- UNCONSTRAINED DELEGATION ({len(deleg)}) ---")
    for d in deleg:
        print(f"  {d['computer']}: {d['os']}")

    asrep = query_as_rep_roastable(driver)
    print(f"\n--- AS-REP ROASTABLE ({len(asrep)}) ---")
    for a in asrep:
        print(f"  {a['user']} (admin={a['admin']})")

    driver.close()
    return {"paths_to_da": paths, "kerberoastable": kerb,
            "unconstrained_delegation": deleg, "asrep_roastable": asrep}


def main():
    parser = argparse.ArgumentParser(description="BloodHound CE Recon Agent")
    parser.add_argument("--neo4j-uri", default="bolt://localhost:7687", help="Neo4j URI")
    parser.add_argument("--neo4j-user", default="neo4j", help="Neo4j username")
    parser.add_argument("--neo4j-password", required=True, help="Neo4j password")
    parser.add_argument("--collect", action="store_true", help="Run data collection first")
    parser.add_argument("--domain", help="AD domain for collection")
    parser.add_argument("--ad-user", help="AD username for collection")
    parser.add_argument("--ad-pass", help="AD password for collection")
    parser.add_argument("--dc-ip", help="Domain controller IP")
    parser.add_argument("--output", help="Save report to JSON file")
    args = parser.parse_args()

    if args.collect and args.domain:
        result = collect_bloodhound_data(args.domain, args.ad_user, args.ad_pass, args.dc_ip)
        print(json.dumps(result, indent=2))

    report = run_recon(args.neo4j_uri, args.neo4j_user, args.neo4j_password)
    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2, default=str)
        print(f"\n[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
BloodHound CE Attack Path Analysis Script

Processes BloodHound CE data exports and generates prioritized
attack path reports. For authorized red team engagements only.
"""

import json
import sys
import os
from datetime import datetime
from collections import defaultdict


def load_bloodhound_data(filepath: str) -> dict:
    """Load BloodHound CE exported JSON data."""
    try:
        with open(filepath, "r") as f:
            return json.load(f)
    except (FileNotFoundError, json.JSONDecodeError) as e:
        print(f"Error loading data: {e}")
        return {}


def analyze_users(data: dict) -> dict:
    """Analyze user objects for attack opportunities."""
    analysis = {
        "total_users": 0,
        "enabled_users": 0,
        "kerberoastable": [],
        "asreproastable": [],
        "dcsync_capable": [],
        "admin_count_set": [],
        "password_not_required": [],
        "unconstrained_delegation": []
    }

    users = data.get("data", data.get("users", []))
    if isinstance(users, list):
        for user in users:
            props = user.get("Properties", user.get("properties", {}))
            name = props.get("name", props.get("samaccountname", "Unknown"))
            analysis["total_users"] += 1

            if props.get("enabled", True):
                analysis["enabled_users"] += 1

            if props.get("hasspn", False):
                analysis["kerberoastable"].append(name)

            if not props.get("dontreqpreauth", True) is False:
                if props.get("dontreqpreauth", False):
                    analysis["asreproastable"].append(name)

            if props.get("admincount", False):
                analysis["admin_count_set"].append(name)

            if props.get("passwordnotreqd", False):
                analysis["password_not_required"].append(name)

    return analysis


def analyze_computers(data: dict) -> dict:
    """Analyze computer objects for attack opportunities."""
    analysis = {
        "total_computers": 0,
        "unconstrained_delegation": [],
        "constrained_delegation": [],
        "laps_enabled": [],
        "laps_disabled": [],
        "unsupported_os": [],
        "domain_controllers": []
    }

    computers = data.get("data", data.get("computers", []))
    if isinstance(computers, list):
        for computer in computers:
            props = computer.get("Properties", computer.get("properties", {}))
            name = props.get("name", "Unknown")
            analysis["total_computers"] += 1

            if props.get("unconstraineddelegation", False):
                analysis["unconstrained_delegation"].append(name)

            if props.get("allowedtodelegate", []):
                analysis["constrained_delegation"].append({
                    "name": name,
                    "delegates_to": props.get("allowedtodelegate", [])
                })

            if props.get("haslaps", False):
                analysis["laps_enabled"].append(name)
            else:
                analysis["laps_disabled"].append(name)

            os_name = props.get("operatingsystem", "").lower()
            unsupported = ["2003", "2008", "xp", "vista", "windows 7"]
            if any(ver in os_name for ver in unsupported):
                analysis["unsupported_os"].append({
                    "name": name,
                    "os": props.get("operatingsystem", "Unknown")
                })

            if props.get("isdc", False):
                analysis["domain_controllers"].append(name)

    return analysis


def generate_report(user_analysis: dict, computer_analysis: dict) -> str:
    """Generate a comprehensive attack path analysis report."""
    report = [
        "=" * 70,
        "BloodHound CE Attack Path Analysis Report",
        f"Generated: {datetime.now().isoformat()}",
        "=" * 70,
        "",
        "[User Analysis]",
        f"  Total Users: {user_analysis['total_users']}",
        f"  Enabled Users: {user_analysis['enabled_users']}",
        f"  Kerberoastable: {len(user_analysis['kerberoastable'])}",
        f"  AS-REP Roastable: {len(user_analysis['asreproastable'])}",
        f"  AdminCount Set: {len(user_analysis['admin_count_set'])}",
        f"  Password Not Required: {len(user_analysis['password_not_required'])}",
        ""
    ]

    if user_analysis["kerberoastable"]:
        report.append("  Kerberoastable Accounts:")
        for acct in user_analysis["kerberoastable"][:20]:
            report.append(f"    - {acct}")

    if user_analysis["asreproastable"]:
        report.append("  AS-REP Roastable Accounts:")
        for acct in user_analysis["asreproastable"][:20]:
            report.append(f"    - {acct}")

    report.extend([
        "",
        "[Computer Analysis]",
        f"  Total Computers: {computer_analysis['total_computers']}",
        f"  Domain Controllers: {len(computer_analysis['domain_controllers'])}",
        f"  Unconstrained Delegation: {len(computer_analysis['unconstrained_delegation'])}",
        f"  Constrained Delegation: {len(computer_analysis['constrained_delegation'])}",
        f"  LAPS Enabled: {len(computer_analysis['laps_enabled'])}",
        f"  LAPS Disabled: {len(computer_analysis['laps_disabled'])}",
        f"  Unsupported OS: {len(computer_analysis['unsupported_os'])}",
        ""
    ])

    if computer_analysis["unconstrained_delegation"]:
        report.append("  Unconstrained Delegation Computers:")
        for comp in computer_analysis["unconstrained_delegation"]:
            report.append(f"    - {comp}")

    if computer_analysis["unsupported_os"]:
        report.append("  Unsupported Operating Systems:")
        for comp in computer_analysis["unsupported_os"]:
            report.append(f"    - {comp['name']}: {comp['os']}")

    report.extend([
        "",
        "[Priority Attack Vectors]",
        "  1. Kerberoastable accounts with path to DA (crack SPN passwords)",
        "  2. AS-REP Roastable accounts (offline password cracking)",
        "  3. Unconstrained delegation abuse (TGT theft via coercion)",
        "  4. ACL-based paths (GenericAll, WriteDACL, ForceChangePassword)",
        "  5. GPO modification paths (code execution on privileged OUs)",
        "  6. Unsupported OS exploitation (unpatched vulnerabilities)",
        "",
        "=" * 70
    ])

    return "\n".join(report)


def main():
    """Main entry point."""
    if len(sys.argv) < 2:
        print("Usage: python process.py <bloodhound_users.json> [bloodhound_computers.json]")
        return

    users_file = sys.argv[1]
    computers_file = sys.argv[2] if len(sys.argv) > 2 else None

    user_data = load_bloodhound_data(users_file)
    user_analysis = analyze_users(user_data)

    computer_analysis = {
        "total_computers": 0, "unconstrained_delegation": [],
        "constrained_delegation": [], "laps_enabled": [], "laps_disabled": [],
        "unsupported_os": [], "domain_controllers": []
    }

    if computers_file:
        computer_data = load_bloodhound_data(computers_file)
        computer_analysis = analyze_computers(computer_data)

    report = generate_report(user_analysis, computer_analysis)
    print(report)

    report_file = f"bloodhound_analysis_{datetime.now().strftime('%Y%m%d_%H%M%S')}.txt"
    with open(report_file, "w") as f:
        f.write(report)
    print(f"\nReport saved to: {report_file}")


if __name__ == "__main__":
    main()