[Query Issue]: Users which do not require password to authenticate

[johnmccash]

Query GUID

23bdc2ad-6739-4b2b-85d3-258e3f424eb2

Query content

MATCH (u:User)
WHERE u.passwordnotreqd = true
RETURN u
LIMIT 100

Issue description

2 suggestions...

1 - This should exclude disabled accounts, particularly guest accounts
2 - it should also exclude domain Trusts accounts. That's a little more difficult to do, though. You could probably Enumerate all Trusts, and then figure out the associated trust account names to exclude from that.

BloodHound version

BHE

BloodHound DB

Postgres

[martinsohn]

Thank you for reporting! I am fixing this in an upcomig release.

Trust accounts can be found via UAC, so my suggestion is:

  MATCH (u:User)
  WHERE u.passwordnotreqd = true
  AND u.enabled = true
  // Exclude interdomain trust accounts via UAC bit (0x0800 = 2048)
  AND NOT u.useraccountcontrol % 4096 < 2048  RETURN u
  LIMIT 100