[enhancement] Potential QoL Improvement: New Edges for Shares with RCE Potential (WebRoots)

[1r0BIT]

Hi :).

Thought about enhancing the this tool a bit by adding specific edges to writable shares with potential for RCE.
Halfway through the implementation I noticed that the same result might be already achievable by tuning the cyber queries.

So before I work more on this for a PR I'd like to hear your opinion :).

[p0dalirius]

Hey!

I agree with you, this would be a great addition. However I don't think that using an Edge for this would be the good way to go. If we do this for other technologies in the future this would make the graph less readable. For your idea I think it would be better to add a property IsWebRoot on the NetworkShare object to highlight this.

In the future there could be room for an OpenGraph collector for webapps (that reads configurations for IIS, Apache, nginx) with an edge from a share to a webapp:

graph LR
    SRV01[SRV01] -->| HasShare | inetpub[inetpub]
    inetpub[inetpub] -->| IsWebRootOf | www.example.com[www.example.com]

Loading

TL;DR: Good idea, but I think a property is the best way to go

Best regards,

[1r0BIT]

Hey there!
Yeah, figured the same after the first iteration was done. Would you like me to iterate on this idea with a PR?
Adding a new attribute is fairly easy, the heuristics might become a problem though.

If not: Feel free to close the issue :). No hard feelings.

[p0dalirius]

Hey,

Sorry for the delay, yes I would love you to iterate on this idea with a PR.

Best regards,