{
    "user": "neo4j",
    "pwd": "password",
    "database": "neo4j"
}

queries:
- group: general
  desc: List all AddKeyCredentialLink privileges for owned principals
  cypher: |-
    MATCH (n {owned: true})-[r:AddKeyCredentialLink]->(m)
    RETURN n.name AS n_name, m.name AS m_name, labels(m) AS labels_m, labels(n) AS labels_n
    ORDER BY n.name
  msg_template: |-
    {{ n_name }} ({{ labels_n[0] }}/{{ labels_n[1] }}) has AddKeyCredentialLink over {{ m_name }} ({{
    labels_m[0] }}/{{ labels_m[1] }})

set <键> <值...> # 例如：set user [email protected]
unset <键> # 可选
show # 可选

- group: user
  desc: List all privileges for this user
  cypher: |-
    MATCH (n:User)-[r]->(m)
    WHERE n.name =~ '((?i){{ params.user }})'
    RETURN n.name AS n_name, TYPE(r) AS rel_type, labels(m) AS labels_m, m.name AS m_name
    ORDER BY TYPE(r)
  msg_template: |-
    User {{ n_name }} has {{ rel_type }} over {{ m_name }} ({{ labels_m[0] }}/{{ labels_m[1] }})

{
  "queries": [
    {
      "name": "List all AddKeyCredentialLink privileges for owned principals",
      "description": "List all AddKeyCredentialLink privileges for owned principals - General",
      "query": "MATCH p=(n {owned: true})-[r:AddKeyCredentialLink]->(m)\nRETURN p\nORDER BY n.name"
    },
    {
      "name": "List all AddKeyCredentialLink privileges for Users, Domain Users, Authenticated Users, and Everyone groups",
      "description": "List all AddKeyCredentialLink privileges for Users, Domain Users, Authenticated Users, and Everyone groups - General",
      "query": "MATCH p=(n:Group)-[r:AddKeyCredentialLink]->(m)\nWHERE (n.objectid =~ \"(?i)S-1-5-21-.*-513\" OR n.objectid =~ \"(?i).*-S-1-5-11\" OR n.objectid =~ \"(?i).*-S-1-1-0\" OR n.objectid =~ \"(?i).*-S-1-5-32-545\")\nRETURN p\nORDER BY n.name"
    }
  ]
}

Documented commands (use 'help -v' for verbose/'help <topic>' for details):
======================================================================================================
alias                 Manage aliases
clear                 Clear the terminal.
cls                   Clear the terminal.
edit                  Run a text editor and optionally open a file with it
export                Run a query and save its results
help                  List available commands or provide detailed help for a specific command
history               View, run, edit, save, or clear previously entered commands
list                  List queries by group.
macro                 Manage macros
report                Run multiple queries and generate a HTML report
run                   Execute a query
run_pyscript          Run a Python script file inside the console
run_script            Run commands in script file that is encoded as either ASCII or UTF-8 text
search                Full-text search through stored queries.
set                   Set a dynamic search parameter (set <TARGET> <VALUE...>)
shell                 Execute a command as if at the OS prompt
shortcuts             List available shortcuts
show                  Show dynamic search parameters
unset                 Unset a dynamic search parameter (unset <TARGET>)

Undocumented commands:
======================
exit  q  quit  stop

  -h, --help            显示此帮助信息并退出
  -c CONFIG, --config CONFIG
                        配置文件
  -l LIST, --list LIST  节点名称列表
  -o, --owned           将目标节点标记为owned
  -v, --high-value      将目标节点标记为high-value

python3 scripts/bhql/query-importer.py \
  --token-id "<TOKEN_ID>" \
  --token-key "<TOKEN_KEY>" \
  --queries-file "/path/to/Queries.json" \
  --base-url "http://127.0.0.1:8080"

python3 scripts/bhql/query-importer.py \
  --token-id "<TOKEN_ID>" \
  --token-key "<TOKEN_KEY>" \
  --queries-url "https://github.com/SpecterOps/BloodHoundQueryLibrary/releases/latest/download/Queries.json" \
  --base-url "http://127.0.0.1:8080"

python3 scripts/bhql/query-importer.py \
  --token-id "<TOKEN_ID>" \
  --token-key "<TOKEN_KEY>" \
  --bhql-latest \
  --base-url "http://127.0.0.1:8080"

# 仅导入支持Active Directory的查询
python3 scripts/bhql/query-importer.py \
  --token-id "<TOKEN_ID>" \
  --token-key "<TOKEN_KEY>" \
  --bhql-latest \
  --platforms "Active Directory" \
  --base-url "http://127.0.0.1:8080"

# 导入多个平台的查询（任意匹配）
python3 scripts/bhql/query-importer.py \
  --token-id "<TOKEN_ID>" \
  --token-key "<TOKEN_KEY>" \
  --bhql-latest \
  --platforms "Active Directory" "Azure" \
  --base-url "http://127.0.0.1:8080"

usage: parse-memberships.py [-m MEMBERSHIPS_FILE] [-d DOMAIN] [-n NTDS_FILE] [-o OUTPUT_DIR] [--netbios NETBIOS] [--encoding ENCODING]
                            [--debug] [--no-index] [-h]

从成员关系文件映射用户到组，并与NTDS转储匹配。

options:
  -m, --memberships-file MEMBERSHIPS_FILE
                        成员关系文件路径（BloodHound风格行）（默认：None）
  -d, --domain DOMAIN   FQDN域名（例如EXAMPLE.COM），用于成员关系正则匹配（默认：None）
  -n, --ntds-file NTDS_FILE
                        NTDS转储文件路径（DOMAIN\user:hash 或 pwdump风格）（默认：None）
  -o, --output-dir OUTPUT_DIR
                        写入每组输出文件的目录（默认：None）
  --netbios NETBIOS     NETBIOS/短域名，当NTDS行缺少域名（pwdump）时使用（默认：None）
  --encoding ENCODING   输入文件的编码（默认：cp1252）
  --debug               启用详细调试输出（默认：False）
  --no-index            按组名命名组文件，而不是编号文件（不安全字符将被替换）（默认：False）
  -h, --help            显示此帮助信息并退出

usage: parse-kerberoastable.py [-k KERB_FILE] [-n NTDS_FILE] [-d DOMAIN] [-o OUTPUT] [--encoding ENCODING] [--debug] [-h]

将可Kerberoast用户名与NTDS.dit转储文件匹配

options:
  -k, --kerb-file KERB_FILE
                        Kerberoast输出文件路径（默认：None）
  -n, --ntds-file NTDS_FILE
                        NTDS转储文件路径（默认：None）
  -d, --domain DOMAIN   域名（例如EXAMPLE.COM），用于正则匹配（默认：None）
  -o, --output OUTPUT   写入匹配结果的路径（默认：None）
  --encoding ENCODING   读取输入文件时使用的文件编码（默认：cp1252）
  --debug               启用详细调试输出（默认：False）
  -h, --help            显示此帮助信息并退出