Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

BloodHound

LogoPost-Exploitation BasicsTryHackMe
free room to practice
Logobloodhound | Kali Linux ToolsKali Linux

Intro to BloodHound

Active Directory environments are massive webs of users, computers, groups, and permissions. Before BloodHound, attacking AD meant combing through thousands of rows of access control lists manually. BloodHound fundamentally changed this process by introducing Graph Theory to Active Directory security.

Originally created by Rohan Vazarkar, Will Schoreder, and Andy Robbins - BloodHound uses a graph database (Neo4j) to map out every single relationship in a domain. It looks at AD objects as Nodes (Users, Computers, Groups) and their permissions as Edges (MemberOf, GenericAll, WriteDacl).

Why Defenders Use It

  • Defenders can see exactly which high-privileged groups or systems are exposed.

  • It exposes unintended behavior and nested groups that grant excessive rights.

  • By visualizing the domain from an attacker's perspective, defenders can eliminate attack paths BEFORE a breach occurs.

Why Attackers Use It

  • Instead of guessing or firing off random exploits, attackers can find legitimate misconfigurations to elevate privileges.

  • It instantly highlights high-value targets like Kerberoastable accounts... unconstrained delegations... and misconfigured GPOs.

Bloodhound installation

Bloodhound is already in kali repositories. So use the following command to install it.

Alternatively we can use the following command. (Not preferred)

Now start new4j console.

neo4j will start at http://localhost:7474/. we need to setup credentials first. So, go there and setup credentials.

username: neo4j

password: neo4j

Now, you can launch bloodhound with your new credentials.

Launch Bloodhound

Using sharphound for Manual Ingestion

Locate sharphound location

Copy to the current directory and start python server to transfer the file.

Start Powershell - powershell -ep bypass -ep bypasses the execution policy of powershell allowing you to easily run scripts

Now download the file to victim machine

Now run it

Now download it

scp download files

You can also use sharphound.exe to generate the zip file

Analysing data with bloodhound

Now import the downloaded file in bloodhound

Now we can run queries from the analysis section.

Remote collection with bloodhound.py

Install the collector script

Logobloodhound.py | Kali Linux ToolsKali Linux

Now run the script to collect data

PreviousAD ShellNextBloodhound CE

Last updated