Workflow
Here's how we've been going about it:
- Harvest raw data from a network
- OWNR (wrapped in perl) to gather account and system information
- Nessus to gather vulnerability information
- fgdump to gather password information
- medusa to see of that password information works anyplace else...
(yeah, that's right! medusa supports hash-passing and Win2K
native mode grinding
- Initial cleanup: prune out multiple domain controllers, etc...
- Mine adjacency information out of the raw data
- pwdumpToMatrix.pl reads a list of pwdump files
-
- Any time a user account and NTLM hash match between two systems,
that's an adjacency
- Render those adjacencies in a comma-separated file
- Convert the adjacencies to dot language using Afterglow
- Minor adjustments and decorations (domain controllers, etc.)
- Convert the dot language file to an image using "neato" from the Graphviz
toolkit.
This page is by Foofus; send your praise and/or complaints to
Foofus at Foofus d0t Net.