Generate low-level commands (mainly impacket) to exploit the Active Directory easily: learn and control every steps. Interactive mode available to select scenarios.
You can play with Griffon by installing a vulnerable AD: lab. Write-ups are here on the wiki.
Here is an example of all implemented scenarios for a user (more here):
Installation
You will need the latest version of impacket to use dacledit.py on some scenarios of GriffonAD. The expected commit is fortra/impacket@bf2d749f49588183b7aee732276440fe018a417d.
python3 -m venv venv
source venv/bin/activate
git clone https://github.com/shellinvictus/GriffonAD
git clone https://github.com/fortra/impacket
cd impacket
pip install -r requirements.txt
python3 setup.py install
cd ../GriffonAD
pip install -r requirements.txt
Make sure your current working directory is inside GriffonAD then run:
pipx install .
griffon --help
pipx uninstall griffon
Retrieve Bloodhound json files with a collector (untested with SharpHound):
./bloodhound.py -u USER -d DOMAIN -p PASSWORD -ns DNS_IP -c DCOnly
Only interesting users are kept. If you have underlined yellowed users, that sounds good!
griffon *.json
or
griffon bloodhound.zip
- yellow user = a path to domain admin exists
- red user = an admin
Other options:
--select FILTER: display only targets where the name starts with FILTER--groups: display all groups with their rights (+--members)--ous: display all ous with their gpo links (+--members)--graph: open a js graph to view relations between objects--sysvol PATH: search for local members (Backup Operators and Administrators) and local privileges--desc: display object descriptions
More on --sysvol
[!NOTE] Example on how Griffon displays the information with
--sysvol:If there is a GPO applied on the OU
MY_OUwhere Alice is defined as a member of Administrators (Policies / Windows Settings / Restricted Groups) and Alice has the privilege SeDebug, then new rights will be available:Alice (RestrictedGroups, [Administrators] -> [email protected]) (AdminTo, [email protected]) (SeDebugPrivilege, [email protected])To retrieve SYSVOL, you can use this command:
echo -e "recurse\nprompt\nmget *" | smbclient -U 'DOMAIN/USER%PASSWORD' '\\IP\SYSVOL'
More on the `many` target
[!NOTE] About the
manytarget: it means that you can have multiple targets. It depends of the right you have:
GenericAll= user is in the Account Operators groupAddKeyCredentialLink: user is in the Key Admins groupSeBackupPrivilege: user is in the Backup Operators groupAllowedToDelegate: unconstrained delegation
From owned users, it reads the text file owned.
Tip
Line format is:
SAMACCOUNTNAME:TYPE:SECRET
SAMACCOUNTNAME: insensitive case, a computer ends with a$TYPE=password|aes|nt
A password for a computer MUST BE set in hex (it will be then converted to an aesKey).
The separator can be changed with the option --sep (you can put a string with more
than one character).
# Warning: if you put multiple secrets for one user, only the last one will be kept!
cat owned
WORKSTATION$:password:0d3c811f9c817a0cf3...
Tracy:aes:1D5A2C4E52584F0A699D0853D2EBF8EBDB6713183D9A303AB8AAACB87818BDEE
Tracy:aes:6AD07E6F0F25DE8906D444EEC50BD83C
Tracy:nt:4869b177d39962457ff9fb185b35c5ba
Tracy:password:Spring2025
griffon lab/json/* --fromo
Other options:
--fromv: from vulnerable users (NP users (only for unprotected users), blank passwords, and kerberoastable users)--from USER: test paths from an arbitrary user--rights: view ACE names instead of actions--da: display only paths to domain admin (prefixed by+)--to: display paths to the object.
Example with --to:
griffon lab/json/* --to CORP.LOCAL
...
★PREPROD_USER —> ★PREPROD$ —> ★DATABASE$ —> ♦CORP.LOCAL
★DEXY —> ★SVC$ —> ★PROD$ —> ★DATABASE$ —> ♦CORP.LOCAL
★KELLY —> ★MAINTENERS —> ★SVC$ —> ★PROD$ —> ★DATABASE$ —> ♦CORP.LOCAL
★SYS —> ★MAINTENERS —> ★SVC$ —> ★PROD$ —> ★DATABASE$ —> ♦CORP.LOCAL
...
Path explanation
[!NOTE] A path is a succession of action(s) to exploit one or many ACEs. The format is:
OWNED -> [REQUIRED_TARGET]::ACTION[REQUIRED_OBJECT](TARGET):RESULT_OBJECT
OWNED: initialially from theownedfile (or the user sets with--from)REQUIRED_TARGET(optional): in some rare cases, Griffon choose a new target (check require_targets in config.ml)::ACTION: one or many successive actions to exploit the ACEREQUIRED_OBJECT(optional): sometimes the action needs another object to exploit the ACETARGET: the object we wan't to ownRESULT_OBJECT: it's often the same asTARGET, it means that nowTARGETis owned
Use the line number to generate the script and run the commands!
griffon lab/json/* --fromo -s0 --dc-ip 10.0.0.2
Or use the interactive mode (only with --from):
griffon lab/json/* --from TARGET -i --dc-ip 10.0.0.2
griffonad/tools/attr.py: generic script to modify one ldap attributegriffonad/tools/addGMSAReader.py: add a user to read a GMSA passwordgriffonad/tools/aesKrbKeyGen.py: login parameters uniformizationgriffonad/tools/addmember.py: modify the attribute membergriffonad/tools/addspn.py: modify the attribute servicePrincipalNamegriffonad/tools/getbyname.py: get all attributes of one objectgriffonad/tools/gpttmpl.py: re-format a GptTmpl.inf with correct encodinggriffonad/tools/logonscript.py: modify the attribute msTSInitialProgramgriffonad/tools/readpol.py: export Registry.pol to json and rewrite the pol filegriffonad/tools/readgmsa.py(from gMSADumper.py): simplified and login parameters uniformizationgriffonad/tools/scriptsini.py: re-format a scripts.ini with correct encodinggriffonad/tools/toggleNP.py: enable or disable the donotpreauth flaggriffonad/tools/toggleDisable.py: toggle the flag ACCOUNTDISABLEgriffonad/tools/xmltask.py: generate an xml for schedule task (mimic a real xml)
- badblood: 10000 users, 3000 computers, 100 groups
- Json parsing + analysis = 2 seconds (4 cores, 8 threads, 1.6GHz)
- Memory consumption peak = 150 MiB
- the js graph is very slow when permissions are too random
- bloodhound-python
- rusthound
- Impacket (the kerberos login function inside griffonad/tools/ldap_auth.py is a copy)
- https://github.com/Tw1sm/aesKrbKeyGen
- https://github.com/micahvandeusen/gMSADumper
- Bloodhound for the opsec comments
Caution
GRIFFON IS FOR EDUCATIONAL OR RESEARCH PURPOSES ONLY. THE AUTHOR IS NOT RESPONSIBLE FOR ANY ILLEGAL ACTIVITIES AND DAMAGES.