OPSECTLAS you are here: Low-priv domain creds
next-move engine

You have Low-priv domain creds

6 high-yield moves from here, ordered the way the engagement runs. Open any move to see the exact commands.

  1. toolsbloodhoundsharphound
    Data Collection
    Option A: bloodhound-python (from Kali · no need to be on-target)
    pip3 install bloodhound
    bloodhound-python -u <USER> -p <PASS> -d <DOMAIN> -dc <DC-IP> -c All --zip

    Output: <TIMESTAMP>_BloodHound.zip

    Option B: SharpHound (from Windows target · more data, more stealthy options)

    Upload SharpHound.exe or SharpHound.ps1 to target

    .\SharpHound.exe -c All --zipfilename bh_data.zip

    Or PowerShell version:

    Import-Module .\SharpHound.ps1
    Invoke-BloodHound -CollectionMethod All -ZipFileName bh_data.zip
    Import & Start BloodHound

    Start Neo4j database

    neo4j start    # or: sudo neo4j console

    Launch BloodHound

    bloodhound &

    Default creds: neo4j:neo4j (change on first login)

    Import: drag and drop the .zip into BloodHound interface

    Key Queries to Run Immediately
    1. 01"Find all Domain Admins"
    2. 02"Shortest Paths to Domain Admins"
    3. 03"Shortest Paths from Owned Principals" (mark your user as Owned first)
    4. 04"Find Principals with DCSync Rights"
    5. 05"Shortest Paths to High Value Targets"
    6. 06"Find Computers where Domain Users are Local Admin"
    7. 07"List all Kerberoastable Accounts"
    8. 08"Find AS-REP Roastable Users"
    9. 09"Find Computers with Unconstrained Delegation"
    10. 10"Find Shortest Paths to Unconstrained Delegation Systems"
    Mark nodes as Owned

    Right-click any node → Mark User as Owned → Re-run "Shortest Paths from Owned"