SpecterOps / SpecterOps/BloodHound
Feature: Collect local user privileges on machines
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 3.4k
- Forks
- 376
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 97
Description
Feature Description
Currently, only the "SeRemoteInteractiveLogonRight" access token privilege is collected and displayed in the UI. It would be cool to have other rights of interest.
Are you intending to implement this feature?
yes
Current Behavior
It only supports the "SeRemoteInteractiveLogonRight" privilege.
Desired Behavior
It would support more local privileges edges allowing you to quickly identity Local Privilege Escalation vectors related to access tokens.
Use Case
This feature would allow BloodHound-CE users to quickly identify users that have high impact local privileges on computers.
Implementation Suggestions
Additional Information
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how SeRemoteInteractiveLogonRight is currently collected and displayed in the UI. Determine which additional local privilege rights are in scope and how they should be represented as privilege edges, then verify the resulting data and UI behavior against the local privilege escalation use case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100