BloodHound
Intro to BloodHound
Active Directory environments are massive webs of users, computers, groups, and permissions. Before BloodHound, attacking AD meant combing through thousands of rows of access control lists manually. BloodHound fundamentally changed this process by introducing Graph Theory to Active Directory security.
Originally created by Rohan Vazarkar, Will Schoreder, and Andy Robbins - BloodHound uses a graph database (Neo4j) to map out every single relationship in a domain. It looks at AD objects as Nodes (Users, Computers, Groups) and their permissions as Edges (MemberOf, GenericAll, WriteDacl).
Why Defenders Use It
Defenders can see exactly which high-privileged groups or systems are exposed.
It exposes unintended behavior and nested groups that grant excessive rights.
By visualizing the domain from an attacker's perspective, defenders can eliminate attack paths BEFORE a breach occurs.
Why Attackers Use It
Instead of guessing or firing off random exploits, attackers can find legitimate misconfigurations to elevate privileges.
It instantly highlights high-value targets like Kerberoastable accounts... unconstrained delegations... and misconfigured GPOs.
Bloodhound installation
Bloodhound is already in kali repositories. So use the following command to install it.
Alternatively we can use the following command. (Not preferred)
Now start new4j console.
neo4j will start at http://localhost:7474/. we need to setup credentials first. So, go there and setup credentials.
Now, you can launch bloodhound with your new credentials.
Launch Bloodhound
Using sharphound for Manual Ingestion
Locate sharphound location
Copy to the current directory and start python server to transfer the file.
Start Powershell - powershell -ep bypass -ep bypasses the execution policy of powershell allowing you to easily run scripts
Now download the file to victim machine
Now run it
Now download it
scp download files
You can also use sharphound.exe to generate the zip file
Analysing data with bloodhound
Now import the downloaded file in bloodhound
Now we can run queries from the analysis section.
Remote collection with bloodhound.py
Install the collector script
Now run the script to collect data
Last updated