From 218bb0fb7d704ac1a08487d0cdde6dab4008f389 Mon Sep 17 00:00:00 2001 From: mgeeky Date: Tue, 10 Mar 2020 23:30:42 +0100 Subject: [PATCH] Added Handy-BloodHound-Cypher-Queries.md --- red-teaming/Handy-BloodHound-Cypher-Queries.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/red-teaming/Handy-BloodHound-Cypher-Queries.md b/red-teaming/Handy-BloodHound-Cypher-Queries.md index 0440d15..c4a097f 100644 --- a/red-teaming/Handy-BloodHound-Cypher-Queries.md +++ b/red-teaming/Handy-BloodHound-Cypher-Queries.md @@ -100,7 +100,7 @@ MATCH (n) WHERE n.description CONTAINS '\\\\' RETURN n.name, n.description RETURN shortestPath((O:{owned:True})-[*1..]->(H {highvalue: True})) ``` -- Riccardo Ancarani's cypher queries (src: [GPOPowerParser](https://github.com/RiccardoAncarani/GPOPowerParser)) useful for any lateral movement insights: +- [Riccardo Ancarani's](https://github.com/RiccardoAncarani) cypher queries (src: [GPOPowerParser](https://github.com/RiccardoAncarani/GPOPowerParser)) useful for any lateral movement insights: - Find all the NTLM relay opportunities for computer accounts: ``` MATCH (u1:Computer)-[:AdminTo]->(c1:Computer {signing: false}) RETURN u1.name, c1.name @@ -112,4 +112,4 @@ MATCH (u2)-[:MemberOf*1..]->(g:Group)-[:AdminTo]->(c2 {signing: false}) RETURN u MATCH (u:User)-[:CanRDP]->(c:Computer) WITH u,c OPTIONAL MATCH (u)-[:MemberOf*1..]->(g:Group)-[:CanRDP]->(c) WITH u,c MATCH (u)-[:CanPrivesc]->(c) RETURN u.name, c.name -``` \ No newline at end of file +```