Package: knowsmore
Knows MoreKnowsMore officially supports Python 3.8+.Main featuresImport NTLM Hashes from .ntds output txt file (generated by CrackMapExec or secretsdump.py)Import NTLM Hashes from NTDS.dit and SYSTEMImport Cracked NTLM hashes from hashcat output fileImport BloodHound ZIP or JSON fileBloodHound importer (import JSON to Neo4J without BloodHound UI)Analyse the quality of password (length , lower case, upper case, digit, special and latin)Analyse similarity of password with company and user nameSearch for users, passwords and hashesExport all cracked credentials direct to BloodHound Neo4j Database as 'owned object'Other amazing features...Getting statsknowsmore--statsThis command will produce several statistics about the passwords like the output bellowKnowsMorev0.1.4byHelvioJunior
ActiveDirectory,BloodHound,NTDShashesandPasswordCrackscorrelationtool
https://github.com/helviojunior/knowsmore[+]Startupparameterscommandline:knowsmore--statsmodule:statsdatabasefile:knowsmore.db[+]starttime2023-01-1103:59:20[?]GeneralStatistics
+-------+----------------+-------+|top|description|qty||-------+----------------+-------||1|TotalUsers|95369||2|UniqueHashes|74299||3|CrackedHashes|23177||4|CrackedUsers|35078|+-------+----------------+-------+[?]GeneralTop10passwords
+-------+-------------+-------+|top|password|qty||-------+-------------+-------||1|password|1111||2|123456|824||3|123456789|815||4|guest|553||5|qwerty|329||6|12345678|277||7|111111|268||8|12345|202||9|secret|170||10|sec4us|165|+-------+-------------+-------+[?]Top10weakpasswordsbycompanynamesimilarity
+-------+--------------+---------+----------------------+-------+|top|password|score|company_similarity|qty||-------+--------------+---------+----------------------+-------||1|company123|7024|80|1111||2|Company123|5209|80|824||3|company|3674|100|553||4|Company@10|2080|80|329||5|company10|1722|86|268||6|Company@2022|1242|71|202||7|Company@2024|1015|71|165||8|Company2022|978|75|157||9|Company10|745|86|116||10|Company21|707|86|110|+-------+--------------+---------+----------------------+-------+InstallationSimplepip3install--upgradeknowsmoreNote:If you face problem with dependency versionCheck the Virtual ENV fileExecution FlowThere is no an obligation order to import data, but to get better correlation data we suggest the following execution flow:Create database fileImport BloodHound filesDomainsGPOsOUsGroupsComputersUsersImport NTDS fileImport cracked hashesCreate database fileAll data are stored in a SQLite Databaseknowsmore--create-dbImporting BloodHound filesWe can import all full BloodHound files into KnowsMore, correlate data, and sync it to Neo4J BloodHound Database. So you can use only KnowsMore to import JSON files directly into Neo4j database instead of useextremely slow BloodHound User Interface# Bloodhound ZIP Fileknowsmore--bloodhound--import-data~/Desktop/client.zip# Bloodhound JSON Fileknowsmore--bloodhound--import-data~/Desktop/20220912105336_users.jsonNote:The KnowsMore is capable to import BloodHound ZIP File and JSON files, but we recommend to use ZIP file, because the KnowsMore will automatically order the files to better data correlation.Sync data to Neo4j BloodHound database# Bloodhound ZIP Fileknowsmore--bloodhound--sync10.10.10.10:7687-dneo4j-uneo4j-p12345678Note:The KnowsMore implementation of bloodhount-importer was inpired fromFox-It BloodHound Importimplementation. We implemented several changes to save all data in KnowsMore SQLite database and after that do an incremental sync to Neo4J database. With this strategy we have several benefits such as at least 10x faster them original BloodHound User interface.Importing NTDS fileOption 1Note:Import hashes and clear-text passwords directly from NTDS.dit and SYSTEM registryknowsmore--secrets-dump-targetLOCAL-ntds~/Desktop/ntds.dit-system~/Desktop/SYSTEMOption 2Note:First use the secretsdump to extract ntds hashes with the command bellowsecretsdump.py-ntdsntds.dit-systemsystem.reg-hasheslmhash:ntlmhashLOCAL-outputfile~/Desktop/client_nameAfter that importknowsmore--ntlm-hash--import-ntds~/Desktop/client_name.ntdsGenerating a custom wordlistknowsmore--word-list-o"~/Desktop/Wordlist/my_custom_wordlist.txt"--batch--namecompany_nameImporting cracked hashesCracking hashesIn order to crack the hashes, I usually usehashcatwith the command bellow# Extract NTLM hashes from filecat~/Desktop/client_name.ntds|cut-d':'-f4>ntlm_hashes.txt# Wordlist attackhashcat-m1000-a0-O-o"~/Desktop/cracked.txt"--remove"~/Desktop/ntlm_hash.txt""~/Desktop/Wordlist/*"# Mask attackhashcat-m1000-a3-O--increment--increment-min4-o"~/Desktop/cracked.txt"--remove"~/Desktop/ntlm_hash.txt"?a?a?a?a?a?a?a?aimporting hashcat output fileknowsmore--ntlm-hash--companyclientCompanyName--import-cracked~/Desktop/cracked.txtNote:ChangeclientCompanyNameto name of your companyWipe sensitive dataAs the passwords and his hashes are extremely sensitive data, there is a module to replace the clear text passwords and respective hashes.Note:This command will keep all generated statistics and imported user data.knowsmore--wipeBloodHound Mark as ownedOne UserDuring the assessment you can find (in a several ways) users password, so you can add this to the Knowsmore databaseknowsmore--user-pass--usernameadministrator--passwordSec4US@2023# or adding the company nameknowsmore--user-pass--usernameadministrator--passwordSec4US@2023--companysec4usIntegrate all credentials cracked to Neo4j Bloodhound databaseknowsmore--bloodhound--mark-owned10.10.10.10-dneo4j-uneo4j-p123456To remote connection make sure that Neo4j database server is accepting remote connection.
Change the line bellow at the config file/etc/neo4j/neo4j.confand restart the service.server.bolt.listen_address=0.0.0.0:7687To doCheck the TODO file