MacHound: collecting and ingesting of Active Directory relationships on MacOS hosts

What is MacHound

MacHound is an extension to the Bloodhound auditing tool allowing collecting and ingesting of Active Directory relationships on MacOS hosts. It collects information about logged-in users, and administrative group members on Mac machines and ingests the information into the Bloodhound database. In addition to using the HasSession and AdminTo edges, MacHound adds three new edges to the Bloodhound database:

• CanSSH – entity allowed to SSH to host
• CanVNC – entity allowed to VNC to host
• CanAE – entity allowed to execute AppleEvent scripts on the host

Data Collection

Logged-in users (HasSession)

MacHound uses the utmpx API to query currently active users and OpenDirectory and membership API to validate Active Directory users.

Administrative Groups

MacHound collects Active Directory members of the following local administrative groups:

admin

The local administrative groups, allowing for root operations.

com.apple.access_ssh

Members of this local group are allowed to access the remote login service (SSH).

com.apple.remote_ae

Members of this local group are allowed to remotely execute AppleEvent scripts.

com.apple.access_screensharing

Members of this local group are allowed to access the screen sharing service (VNC)

Components

MacHound is split into two main components: the collector and the ingestor.

Collector

The MacHound collector is a Python3.7 script that runs locally on Active Directory joined MacOS hosts. The collector queries the local OpenDirectory and the Active Directory for information about privileged users and groups. The output of the execution is a JSON file that contains all the collected information.

Ingestor

The MacHound ingestor is a Python3.7 script that parses the output JSON files (one per host), connects to the neo4j database, and inserts the edges to the database. The ingestor uses the neo4j library for Python to query information to and from the neo4j database. The ingestor must be executed on a host that has TCP access to the neo4j database.

To read more about MacHound, refer to the introduction post

Install & Use

Copyright (C) 2021 XMCyber