RedXploit | Dev/Sec Blog

Django REST framework Tutorial - 2

Fri, 13 Mar 2020 13:00:00 +0100

Intro and Definitions

Request object: The REST framework Request is an extension of Django’s Request.
The feature of REST Request that should be noted is in request.data, which is Django’s request.POST, but REST is easier to use.

Differences:

Django - Only form data can be processed. - Only POST method is supported.
REST - Can handle any data in the request. - It supports POST, PUT, and PATCH.

Response object: Returns data in the content type requested by the client.

Status Codes:

200 : Success
400 : Bad Request

More Reference for Status codes :

API view wrapping (views.py)

Example 1 :

from rest_framework import api_view
from rest_framework.decorators import api_view
from rest_framework.response import Response
from snippets.models import Snippet
from snippets.serializers import SnippetSerializer
@api_view(['GET', 'POST'])
def snippet_list(request):
    """
    List all code snippets, or create a new snippet. """
    if request.method == 'GET':
        snippets = Snippet.objects.all()
        serializer = SnippetSerializer(snippets, many=True)
        return Response(serializer.data)
    elif request.method == 'POST':
        serializer = SnippetSerializer(data=request.data)
        if serializer.is_valid():
            serializer.save()
            return Response(serializer.data, status=status.HTTP_201_CREATED)
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

Example 2 :

@api_view(['GET', 'PUT', 'DELETE'])
def snippet_detail(request, pk): """
    Retrieve, update or delete a code snippet.
    """
    try:
        snippet = Snippet.objects.get(pk=pk)
    except Snippet.DoesNotExist:
        return Response(status=status.HTTP_404_NOT_FOUND)
    if request.method == 'GET':
        serializer = SnippetSerializer(snippet)
        return Response(serializer.data)
    elif request.method == 'PUT':
        serializer = SnippetSerializer(snippet, data=request.data)
        if serializer.is_valid():
            serializer.save()
            return Response(serializer.data)
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
    elif request.method == 'DELETE':
        snippet.delete()
        return Response(status=status.HTTP_204_NO_CONTENT)

The difference from ordinary Django is that rest_framework is added.

Url Defenitions

urls.py

from django.urls import path
from rest_framework.urlpatterns import format_suffix_patterns
from snippets import views
urlpattern = [
    path('snippets/', views.snippet_list),
    path('snippets/<int:pk>', views.snippet_detail),
]
urlpatterns = format_suffix_patterns(urlpatterns)

Migration is done because the model was created.

Analysis of Windows Active Directory environment using BloodHound

Fri, 13 Mar 2020 01:00:00 +0100

INTRODUCTION

This article examines the analysis of a Windows Active Directory environment using BloodHound .

BloodHound ( https://github.com/BloodHoundAD/BloodHound ) is a tool for clarifying unintended relationships in the Active Directory environment based on graph theory. This allows you Domain Adminsto discover paths for migrating to other users or groups, such as elevating privileges to low-privileged users .

Installation of BloodHound

Here, Kali Linux 2020.1with respect to BloodHound Version: 3.0.2you through the installation of apt BloodHound can be installed using the package management command . The command syntax is, apt-get install bloodhoundis. In advance, apt-get updateand apt-get dist-upgraderun the command, you must have the system up-to-date state.

root@kali:~$ sudo apt-get install bloodhound
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following additional packages will be installed:
  neo4j
The following NEW packages will be installed:
  bloodhound neo4j
0 upgraded, 2 newly installed, 0 to remove and 501 not upgraded.
Need to get 154 MB of archives.
After this operation, 350 MB of additional disk space will be used.
Do you want to continue? [Y/n] Y
Get:1 http://ftp.jaist.ac.jp/pub/Linux/kali kali-rolling/main amd64 neo4j all 3.5.3-0kali1 [98.1 MB]
Get:2 http://linux3.yz.yamagata-u.ac.jp/pub/linux/kali kali-rolling/main amd64 bloodhound amd64 3.0.2-0kali1 [55.5 MB]
Fetched 154 MB in 18s (8,640 kB/s)                                                            
Selecting previously unselected package neo4j.
(Reading database ... 255564 files and directories currently installed.)
Preparing to unpack .../neo4j_3.5.3-0kali1_all.deb ...
Unpacking neo4j (3.5.3-0kali1) ...
Selecting previously unselected package bloodhound.
Preparing to unpack .../bloodhound_3.0.2-0kali1_amd64.deb ...
Unpacking bloodhound (3.0.2-0kali1) ...
Setting up neo4j (3.5.3-0kali1) ...
Setting up bloodhound (3.0.2-0kali1) ...
Processing triggers for kali-menu (2020.1.7) ...

BloodHound settings

BloodHound relies on Neo4j ( https://neo4j.com/ ). Neo4j is a graph database management system. Is installed with apt-get install bloodhound command syntax . After the installation with the command is completed, configure Neo4j. First, at the command syntax, to start the Neo4j.BloodHound Version: 3.0.2neo4j 3.5.3 aptsudo neo4j console

times @ times: ~ $ sudo neo4j console
Active database: graph.db
Directories in use:
  home:         /usr/share/neo4j
  config:       /usr/share/neo4j/conf
  logs:         /usr/share/neo4j/logs
  plugins:      /usr/share/neo4j/plugins
  import:       /usr/share/neo4j/import
  data:         /usr/share/neo4j/data
  certificates: /usr/share/neo4j/certificates
  run:          /usr/share/neo4j/run
Starting Neo4j.
WARNING: Max 1024 open files allowed, minimum of 40000 recommended. See the Neo4j manual.
2020-02-29 12: 39: 25,465 + 0000 INFO ======== Neo4j 3.5.3 ========
2020-02-29 12:39:25.538+0000 INFO  Starting...
2020-02-29 12:39:34.831+0000 INFO  Bolt enabled on 127.0.0.1:7687.
2020-02-29 12:39:40.123+0000 INFO  Started.
2020-02-29 12:39:44.086+0000 INFO  Remote interface available at http://localhost:7474/

Next, access http://localhost:7474/ with a browser. After entering the default password ( neo4j / neo4j ), you will be prompted to change the password. Follow the instructions to enter a new password. The account entered here will also be used to log in to BloodHound.

This section uses the following settings.

Database URL： bolt：//localhost：7687 DB Username： neo4j DB Password： blood

Launch Bloodhound

From a terminal, bloodhoundexecute a command and launch it (must be open in the background).

times @ times: ~ $ bloodhound

BloodHound operation check

A DBCreator.pyscript to create random test data is provided to confirm the operation of BloodHound ( https://github.com/BloodHoundAD/BloodHound-Tools/tree/master/DBCreator ).

Use the following command syntax to duplicate a repository.

times @ times: ~ $ git clone https://github.com/BloodHoundAD/BloodHound-Tools
Cloning into 'BloodHound-Tools'...
remote: Enumerating objects: 1, done.
remote: Counting objects: 100% (1/1), done.
remote: Total 111 (delta 0), reused 0 (delta 0), pack-reused 110
Receiving objects: 100% (111/111), 1.59 MiB | 552.00 KiB/s, done.
Resolving deltas: 100% (46/46), done.

pip In command, neo4j-driverto install.

$ sudo apt install python-pip
$ pip -V
pip 18.1 from /usr/lib/python2.7/dist-packages/pip (python 2.7)

$ pip install neo4j-driver
Collecting neo4j-driver
  Downloading https://files.pythonhosted.org/packages/0e/96/bc81664d87975948713f7e4d3d4c3a21a3a6a813d03a161637573a587817/neo4j-driver-1.7.6.tar.gz
Collecting neobolt~=1.7.15 (from neo4j-driver)
  Downloading https://files.pythonhosted.org/packages/0d/b2/eb7c33e1f02cd7bbaf4c237619dd8dc43fa6081f331c2d35b28deb78e259/neobolt-1.7.16.tar.gz (183kB)
    100% |████████████████████████████████| 184kB 1.2MB/s 
Collecting neotime~=1.7.1 (from neo4j-driver)
.
.
.
Successfully built neo4j-driver neobolt neotime
Installing collected packages: neobolt, pytz, neotime, neo4j-driver
Successfully installed neo4j-driver-1.7.6 neobolt-1.7.16 neotime-1.7.4 pytz-2019.3

DBCreator.py The script is python2 described in. Therefore, specify python2 and execute explicitly .

kali@kali:~$ cd BloodHound-Tools/
kali@kali:~/BloodHound-Tools$ ls
bloodhoundanalytics.pbix  bloodhoundanalytics.py  DBCreator  LICENSE  README.md
kali@kali:~/BloodHound-Tools$ cd DBCreator/
kali@kali:~/BloodHound-Tools/DBCreator$ python2 DBCreator.py
================================================================
BloodHound Sample Database Creator
================================================================

Documented commands (type help <topic>):
========================================
clear_and_generate  connect   exit      help       setnodes
cleardb             dbconfig  generate  setdomain

(Cmd)

DBCreator.py dbconfig Executes commands according to the script’s user interface . neo4jEnter your credentials.

(Cmd) dbconfig
Current Settings:
DB Url: bolt://localhost:7687
DB Username: neo4j
DB Password: neo4jj

Enter DB URL [bolt://localhost:7687] 
Enter DB Username [neo4j] 
Enter DB Password [neo4jj] blood

New Settings:
DB Url: bolt://localhost:7687
DB Username: neo4j
DB Password: blood

Testing DB Connection
Database Connection Successful!

**DBCreator.py generate ** Executes commands according to the script’s user interface . Generate test data.

(Cmd) generate
Starting data generation with nodes=500
Populating Standard Nodes
Adding Standard Edges
Generating Computer Nodes
Creating Domain Controllers
Generating User Nodes
Generating Group Nodes
Adding Domain Admins to Local Admins of Computers
Creating 25 Domain Admins (5% of users capped at 30)
Applying random group nesting
Adding users to groups
Calculated 7 groups per user with a variance of - 6
Adding local admin rights
Adding RDP/ExecuteDCOM/AllowedToDelegateTo
Adding sessions
Adding Domain Admin ACEs
Creating OUs
Creating GPOs
Adding outbound ACLs to 3 objects
Marking some users as Kerberoastable
Adding unconstrained delegation to a few computers
Database Generation Finished!

After Bloodhound you create the test data and log on, BloodHound draws a group named “Domain Admins” and shows the valid users belonging to that group.

In the* [Database Info]* tab on the left corner, you can see the statistics of the registered data. The information that can be confirmed on the tab is as follows.

[Database Info]

Users – Users on the network extracted from Active Directory
Computers – various endpoints on networks, servers, workstations and other devices
Groups- Various AD groups extracted from Active Directory
Sessions- The amount of user sessions on computers on the network extracted by Ingestors
ACL -access control list, various permissions and access for users and groups
Relationships -Group memberships, users, user sessions, other relevant information, etc.

In the [Queries] tab in the left corner, you can see the display with some prepared analytic queries.

[Queries] > [Pre-Built Analytics Queries] > [Shortest Paths to High Value Targets] Screen when a query is selected.

Data collection with Ingestors

So far, BloodHound and neo4j have been installed and configured. From here, we will use BloodHound to analyze the data of the target network.

Use “ Ingestors “ on the target system or domain . Ingestors queries the domain controller and Active Directory to retrieve all trust relationships, group policy settings, and Active Directory objects.

The BloodHound git repository ( https://github.com/BloodHoundAD/BloodHound/tree/master/Ingestors ) contains two different Ingestors.

SharpHound.exe: A program written in C #
Invoke-BloodHound: PowerShell script that loads C # binaries by reflection

SharpHound

SharpHound.exe Data is collected using a program that is BloodHound’s Ingestors . Here, Https://Github.Com/BloodHoundAD/BloodHound/tree/master/Ingestors

SharpHound.exe Use to collect data from Active Directory. First, powershell launch Then, SharpHound.exe run :)

The collected data is compressed in ZIP format ( 20200306061240_BloodHound.zip) SharpHound.exeand created in the folder where the was executed.

PS C:\Tools> .\SharpHound.exe -c all -d active.htb --domaincontroller 10.10.10.100
----------------------------------------------
Initializing SharpHound at 6:12 AM on 3/6/2020
----------------------------------------------

Resolved Collection Methods: Group, Sessions, LoggedOn, Trusts, ACL, ObjectProps, LocalGroups, SPNTargets, Container

[+] Creating Schema map for domain ACTIVE.HTB using path CN=Schema,CN=Configuration,DC=ACTIVE,DC=HTB
[+] Cache File not Found: 0 Objects in cache

[+] Pre-populating Domain Controller SIDS
Status: 0 objects finished (+0) -- Using 19 MB RAM
Enumeration finished in 00:02:52.3983535
Compressing data to .\20200306061240_BloodHound.zip
You can upload this file directly to the UI

SharpHound Enumeration Completed at 6:16 AM on 3/6/2020! Happy Graphing!

*20200306061240_BloodHound.zip Load the collected data ( ) with BloodHound. From the BloodHound GUI screen [Upload Data], select the menu on the right and load the generated ZIP file. Data can also be read by dragging and dropping a ZIP file onto the BloodHound GUI screen.

Utilities that use BloodHound data

CypherDog, https://github.com/SadProcessor/CypherDog
GoFetch, https://github.com/GoFetchAD/GoFetch
ANGRYPUPPY, https://github.com/vysecurity/ANGRYPUPPY
gt-generator, https://github.com/audrummer15/gt-generator

Django REST framework Tutorial - 1

Sun, 08 Mar 2020 13:00:00 +0100

Install the required packages.

pip install django
pip install djangorestframework
pip install pygments

Create a project.

django-admin startproject tutorial

Create an app.

cd tutorial
python manage.py startapp snippets

Add settings to INSTALLED_APP.

#tutorial/settings.py

INSTALLED_APPS = [
...
'rest_framework',
'snippets.apps.SnippetsConfig', ]

The difference from ordinary Django is that rest_framework is added.

Create a model to store code snippets.

#snippets/models.py

from django.db import models
from pygments.lexers import get_all_lexers
from pygments.styles import get_all_styles

LEXERS = [item for item in get_all_lexers() if item[1]]
LANGUAGE_CHOICES = sorted([item[1][0], item[0]) for item in LEXERS])
STYLE_CHOICES = sorted([item, item) for item in get_all_styles()])

class Snippet(models.Model):
    created = models.DateTimeField(auto_now_add=True)
    title = models.CharField(max_length=100, blank=True, default='')
    code = models.TextField()
    linenos = models.BooleanField(default=False)
    language = models.CharField(choices=LANGUAGE_CHOICES,
            default='python', max_length=100)
    style = models.CharField(choices=STYLE_CHOICES, 
            default='friendly', max_length=100)

    class Meta:
        ordering = ['created']

Migration is done because the model was created.

Make DataBase Migrations and Migrate

python manage.py makemigrations snippets
python manage.py migrate

Creating a serializer

#snippets/serializers.py

The serializer converts a python instance to JSON format and vice versa. Something like the API version of Form.

from rest_framework import serializers
from snippets.models import Snippet, LANGUAGE_CHOICES, STYLE_CHOICES

class SnippetSerializer(serializers.Serializer):
    id = serializers.IntegerField(read_only=True)
    title = serializers.CharField(required=False, allow_blank=True, max_length=100)
    code = serializers.CharField(style={'base_template': 'textarea.html'})
    linenos = serializers.BooleanField(required=False)
    language = serializers.ChoiceField(choices=LANGUAGE_CHOICES, default='python')
    style = serializers.ChoiceField(choices=STYLE_CHOICES, default='friendly')

    def create(self, validate_data):
        """
        Create and return a new 'Snippet' instance, given validated data.
        """
        return Snippet.objects.create(**validate_data)

    def update(self, instance, validated_data):
        """
        Update and return an existing 'Snippet' instance, given the validated data.
        """
        instance.title = validated_data.get('title', instance.title)
        instance.code = validated_data.get('code', instance.code)
        instance.linenos = validated_data.get('linenos', instance.language)
        instance.language = validated_data.get('language', instance.language)
        instance.style = validated_data.get('style', instance.style)
        instance.save()
        return instance

The serializer defines the fields to be serialized with serialization. It defines what to do at the time of save with create and update. serializer.HogeField has many validation flags as well as forms. You can also change the display to suit your specific situation. {‘base_template’: ‘textarea.html’} does the same thing as widget = wigets.Texarea.

Using a serializer

#snippets/serializers.py

rom snippets.serializers import SnippetSerializer
from rest_framework.renderers import JSONRenderer
from rest_framework.parsers import JSONParser

snippet = Snippet(code='foo = "bar"\n')
snippet.save()
serializer = SnippetSerializer(snippet)
serializer.data
serializer = SnippetSerializer(snippet)
serializer.data
=> {'id': 2, 'title': '', 'code': 'print("hello, world")\n', 'linenos': False, 'language': 'python', 'style': 'friendly'}
content = JSONRenderer().render(serializer.data)
content
=> b'{"id": 2, "title": "", "code": "print(\\"hello, world\\")\\n", "linenos": false, "language": "python", "style": "friendly"}'

import me
stream = io.BytesIO(content)
data = JSONParser().parse(stream)

serializer = SnippetSerializer(data=data)
serializer.is_valid()
=> True
serializer.validated_data
=> OrderedDict([('title', ''), ('code', 'print("hello, world")\n'), ('linenos', False), ('language', 'python'), ('style', 'friendly')])
serializer.save()
serializer = SnippetSerializer(Snippet.onjects.all(), many=True)
serializer.data
=> [OrderedDict([('id', 1), ('title', ''), ('code', 'foo = "bar"\n'), ('linenos', False), ('language', 'python'), ('style', 'friendly')]), OrderedDict([('id', 2), ('title', ''), ('code', 'print("hello, world")\n'), ('linenos', False), ('language', 'python'), ('style', 'friendly')]), OrderedDict([('id', 3), ('title', ''), ('code', 'print("hello, world")'), ('linenos', False), ('language', 'python'), ('style', 'friendly')])]

Create a model serializer.

Using a model serializer makes the code more verbose and functional.

#snippets/views.py

class SnippetSerializer(serializers.ModelSerializer):
    class Meta:
        model = Snippet
        fields = ['id, 'title', 'code', 'linenos', 'language', 'style']

Create a normal view using Serializer.

from django.http import HttpResponse, JsonResponse
from django.views.decorators.csrf import csrf_exempt
from rest_framework.parsers import JSONParser
form snippets.models import Snippet
from snippets.serializers import SnippetSerializer

@csrf_exempt
def snippet_list(request):
    """
    List all code snippets, or create a new snippet.
    """
    if request.method == 'GET':
        snippets = Snippet.objects.all()
        serializer = SnippetSerializer(snippets, many=True)
        return JsonResponse(serializer.data, safe=False)

    elif request.method == 'POST':
        data = JSONParser().parse(request)
        serializer = SnippetSerializer(data=data)
        if serializer.is_valid()
            serializer.save()
            return JsonResponse(serializer.data, status=200)
        return JsonResponse(serializer.errors, status=400)

@csrf_exempt is not used originally because it is attached so that it can be posted without a csrf token.

@csrf_token(request, pk):
    """
    Retrieve, update or delete a code snippet.
    """
    try:
        snippet = Snippet.objects.get(pk=pk)
    except Snippet.DoesNotExist:
        return HttpResponse(status=404)

    if request.method == 'GET':
        serializer = SnippetSerializer(snippet)
        return JsonResponse(serializer.data)

    elif request.method == 'PUT':
        data = JSONParser().parse(request)
        serializer = SnippetSerializer(snippet, data=data)
        if serializer.is_valid():
            serializer.save()
            return JsonResponse(serialzer.data)
        return JsonResponse(serializer.errors, status=400)

   elif request.method == 'DELETE':
       snippet.delete()
       return HttpResponse(status=204)

from django.urls import path
from snippets import views

urlpatterns = [
    path('snippets/', views.snippet_list),
    path('snippets/<int:pk>/', views.snippet_detail),
]

from django.urls import path, include

urlpatterns = [ path(‘’, include(‘snippets.urls’), ]

Linking url

#snippets/urls.py

from django.urls import path
from snippets import views

urlpatterns = [
    path('snippets/', views.snippet_list),
    path('snippets/<int:pk>/', views.snippet_detail),
]

#snippets/urls.py

from django.urls import path, include

urlpatterns = [
    path('', include('snippets.urls'),
]

Test APP

python manage.py runserver