leeberg / bluehive

PowerShell based Active Directory Honey User Account Management with Universal Dashboards

BlueHive

Active Directory Honey User Account Management

BlueHive is HoneyPot User management tool built with the free open source community edition of Universal Dashboard by Ironman Software. This utility can be used to create and manage Honeypot user and service accounts via an interactive web dashboard.

WARNING: This project is intended to be used as a teaching tool for learning Universal Dashboard and the basic concepts of Active Directory Honey Pot Users - don't use this in your production :) 🖥 🔥

NOTE : Uses Names files from Seclists as data for the random user / account creation process.

Screenshots

Home Page

Management Page

Modify Honey Account

Creating Honey Accounts

Features

• Create "Honey Pot" Users with randomized names / properties
  • Users
  • Service Accounts (with SPN)
• Target creation of an account on a specific domain / controller
• Dashboards showing status of deployed HoneyPot users
• Management of Honey Pot User (Add/Remove/Modify)
• Track History of Honey User Deployments
• One Click to Remove Honey Users from Active Directory
• Scheduling of Automatic Login for Accounts so they have AD login properties update to avoid obvious honeypot busting

Drawbacks / Issues

• Service Accounts will be BUSTED by HoneyPot Buster - I have not yet implemented a good way to update values like "lastlogontimestamp" to reduce the Fank Rank. NOTE - Currently working on implementing a Scheduled Endpoint, that will "Login" with specified accounts on a schedule.
• Data storage via json files on disk 🤷
• Only "half-way" supports multiple domains, needs some data management work needs to be completed
• "OtherName" of created token objects have value of 1337 - this is the identifier for a honey object used by this. Ideally accounts would be independently tracked outside of such a value.
• Many more values in the Ad Objects COULD be populated but are not.
• Some... LESS THAN efficient powershell scripting ;)

Usage

1. SETUP - Populate your own environmental variables in the "start.ps1" script. Specifically the folowing variables:
   • $DomainControllerFQDN - FQDN of the domain controller bluehive will interact with.
   • $BlueHiveFolder EX: 'C:\Users\lee\git\BlueHive' - Data Storage for Bluehive MAKE SURE YOU HAVE THE "GENERATED" FOLDER to ensure proper account/name creation.
   • $AutoLoginServer FQDN of servce where new powershell sessions will login with honey accounts (Honey accoutns must have login rights).
2. Use the start script to connect to active directory and startup the dashboard - You may have to start your powershell as an Administrator.
3. Open the "Domain Connection" page and initiate a new domain sync by specifying your domain name and clicking the "Sync" button.
4. Verify Domain Information in the "Existing Domain Connection" Pane. **Note - at this point you should have domain data populated in your Data\Retrieved\Domains folder
5. Use Deployment Page to deploy new Honey Account
6. Use the Management Page to delete / edit Honey Accounts that have been deployed.
7. Use the dashboard pages to management honey accounts and don't forget to check out the Logs folder for a good old fashion log file.

bluehive's Issues

Account Creation - Advanced Options

Describe the solution you'd like
An "Advanced Options" picker would be ideal for customizing the accounts being created. The default (basic) behavior would ask as it currently does but an advanced option should allow me to do much more specific customizations for the accounts I would like create.

User Accounts
Populate: Phone Numbers, Addresses, etc.
Set Password

Service Accounts
Allow Specification of SPN Format - Select a Host
Set Password

Audit Log Error On Start

Describe the bug
This one is nasty and was becuase of laziness in my logging design

It can be difficult to get started as bluhive will complain about log locations.

FIXING ASAP

ALSO DATA FOLDER BUG

 Cannot find path 'C:\Users\da.LEELABS\Desktop\Logs\Data\Retrieved\Domains\' because it does not exist.

having a missing data folder can also cause issues with seclists

Sync AD Computers

Describe the solution you'd like
By syncing AD Computers we could generate much more realistic SPNs for service accounts. This data could also be utilized in other areas.

Documentation for Auto Login Configuration

Add Documentation for requirements/setup of Honey User Auto Login Feature!

ACTUALLY Support Multiple Domains

Description

Currently, there are likely many UI / Data Elements that rely on a single domain, this should be cleaned up and full multi-domain management should be supported.

Messy / Not fun but would really clean up the script and make this a better project

Scheduled Auto Login for Service Accounts / User

This will help with honey pot buster...

Once I create a User / Service Account - I should be able to us:

1. Use a Scheduled UD Endpoint to RESET The Password and Login to the account
2. The login will be a session to the local machine, or perhaps a honey login box
3. Close the session.
4. This should update the various internal AD properties.

Will likely need to track auto logins on a seperate flat file to avoid overwrite.

Should be able to configure things like "AutoLoginServer" and other vars IN APP

Less Powershell - More Clickey Clickey