OPSECTLAS you are here: Active Directory
Active Directory

BloodHound

reference 7 commands 2 tools

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex

reached from Low-priv domain creds

toolsbloodhoundsharphound
Data Collection
Option A: bloodhound-python (from Kali · no need to be on-target)
pip3 install bloodhound
bloodhound-python -u <USER> -p <PASS> -d <DOMAIN> -dc <DC-IP> -c All --zip

Output: <TIMESTAMP>_BloodHound.zip

Option B: SharpHound (from Windows target · more data, more stealthy options)

Upload SharpHound.exe or SharpHound.ps1 to target

.\SharpHound.exe -c All --zipfilename bh_data.zip

Or PowerShell version:

Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -ZipFileName bh_data.zip
Import & Start BloodHound

Start Neo4j database

neo4j start    # or: sudo neo4j console

Launch BloodHound

bloodhound &

Default creds: neo4j:neo4j (change on first login)

Import: drag and drop the .zip into BloodHound interface

Key Queries to Run Immediately
  1. 01"Find all Domain Admins"
  2. 02"Shortest Paths to Domain Admins"
  3. 03"Shortest Paths from Owned Principals" (mark your user as Owned first)
  4. 04"Find Principals with DCSync Rights"
  5. 05"Shortest Paths to High Value Targets"
  6. 06"Find Computers where Domain Users are Local Admin"
  7. 07"List all Kerberoastable Accounts"
  8. 08"Find AS-REP Roastable Users"
  9. 09"Find Computers with Unconstrained Delegation"
  10. 10"Find Shortest Paths to Unconstrained Delegation Systems"
Mark nodes as Owned

Right-click any node → Mark User as Owned → Re-run "Shortest Paths from Owned"