┌──(kali㉿kali)-[~/Desktop]
└─$ sudo apt install bloodhound
[sudo] password for kali:
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
binfmt-support fastjar jarwrapper neo4j openjdk-11-jre openjdk-11-jre-headless
Suggested packages:
fonts-ipafont-gothic fonts-ipafont-mincho fonts-wqy-microhei | fonts-wqy-zenhei fonts-indic
The following NEW packages will be installed:
binfmt-support bloodhound fastjar jarwrapper neo4j openjdk-11-jre openjdk-11-jre-headless
0 upgraded, 7 newly installed, 0 to remove and 649 not upgraded.
Need to get 221 MB of archives.
After this operation, 578 MB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://kali.cs.nycu.edu.tw/kali kali-rolling/main amd64 binfmt-support amd64 2.2.2-2 [64.0 kB]
Get:2 http://kali.cs.nycu.edu.tw/kali kali-rolling/main amd64 fastjar amd64 2:0.98-7 [80.1 kB]
Get:3 http://kali.cs.nycu.edu.tw/kali kali-rolling/main amd64 jarwrapper all 0.78 [21.8 kB]
Get:4 http://http.kali.org/kali kali-rolling/main amd64 openjdk-11-jre-headless amd64 11.0.20~7-1 [38.2 MB]
Get:5 http://http.kali.org/kali kali-rolling/main amd64 openjdk-11-jre amd64 11.0.20~7-1 [193 kB]
Get:6 http://http.kali.org/kali kali-rolling/main amd64 neo4j all 5.2.0+really4.4.16-0kali1 [113 MB]
Get:7 http://kali.cs.nycu.edu.tw/kali kali-rolling/main amd64 bloodhound amd64 4.3.1-0kali1 [69.3 MB]
Fetched 221 MB in 2min 57s (1,251 kB/s)
Selecting previously unselected package binfmt-support.
(Reading database ... 397536 files and directories currently installed.)
Preparing to unpack .../0-binfmt-support_2.2.2-2_amd64.deb ...
Unpacking binfmt-support (2.2.2-2) ...
Selecting previously unselected package fastjar.
Preparing to unpack .../1-fastjar_2%3a0.98-7_amd64.deb ...
Unpacking fastjar (2:0.98-7) ...
Selecting previously unselected package jarwrapper.
Preparing to unpack .../2-jarwrapper_0.78_all.deb ...
Unpacking jarwrapper (0.78) ...
Selecting previously unselected package openjdk-11-jre-headless:amd64.
Preparing to unpack .../3-openjdk-11-jre-headless_11.0.20~7-1_amd64.deb ...
Unpacking openjdk-11-jre-headless:amd64 (11.0.20~7-1) ...
Selecting previously unselected package openjdk-11-jre:amd64.
Preparing to unpack .../4-openjdk-11-jre_11.0.20~7-1_amd64.deb ...
Unpacking openjdk-11-jre:amd64 (11.0.20~7-1) ...
Selecting previously unselected package neo4j.
Preparing to unpack .../5-neo4j_5.2.0+really4.4.16-0kali1_all.deb ...
Unpacking neo4j (5.2.0+really4.4.16-0kali1) ...
Selecting previously unselected package bloodhound.
Preparing to unpack .../6-bloodhound_4.3.1-0kali1_amd64.deb ...
Unpacking bloodhound (4.3.1-0kali1) ...
Setting up fastjar (2:0.98-7) ...
Setting up openjdk-11-jre-headless:amd64 (11.0.20~7-1) ...
update-alternatives: using /usr/lib/jvm/java-11-openjdk-amd64/bin/jjs to provide /usr/bin/jjs (jjs) in auto mode
update-alternatives: using /usr/lib/jvm/java-11-openjdk-amd64/bin/rmid to provide /usr/bin/rmid (rmid) in auto mode
update-alternatives: using /usr/lib/jvm/java-11-openjdk-amd64/bin/pack200 to provide /usr/bin/pack200 (pack200) in auto mode
update-alternatives: using /usr/lib/jvm/java-11-openjdk-amd64/bin/unpack200 to provide /usr/bin/unpack200 (unpack200) in auto mode
Setting up binfmt-support (2.2.2-2) ...
update-binfmts: warning: python3.11 already enabled in kernel.
update-binfmts: warning: llvm-14-runtime.binfmt already enabled in kernel.
update-binfmts: warning: llvm-15-runtime.binfmt already enabled in kernel.
Created symlink /etc/systemd/system/multi-user.target.wants/binfmt-support.service → /lib/systemd/system/binfmt-support.service.
Setting up jarwrapper (0.78) ...
Processing triggers for ca-certificates-java (20230103) ...
done.
Processing triggers for mailcap (3.70+nmu1) ...
Processing triggers for kali-menu (2023.2.3) ...
Processing triggers for desktop-file-utils (0.26-1) ...
Processing triggers for hicolor-icon-theme (0.17-2) ...
Setting up openjdk-11-jre:amd64 (11.0.20~7-1) ...
Processing triggers for man-db (2.11.2-2) ...
Setting up neo4j (5.2.0+really4.4.16-0kali1) ...
Setting up bloodhound (4.3.1-0kali1) ...
┌──(kali㉿kali)-[~/domain]
└─$ sudo pip install bloodhound
DEPRECATION: Loading egg at /usr/local/lib/python3.11/dist-packages/PyBluez-0.30-py3.11-linux-x86_64.egg is deprecated. pip 25.1 will enforce this behaviour change. A possible replacement is to use pip for package installation. Discussion can be found at https://github.com/pypa/pip/issues/12330
Collecting bloodhound
Downloading bloodhound-1.8.0-py3-none-any.whl.metadata (973 bytes)
Requirement already satisfied: dnspython in /usr/lib/python3/dist-packages (from bloodhound) (2.6.1)
Requirement already satisfied: impacket>=0.9.17 in /usr/lib/python3/dist-packages (from bloodhound) (0.12.0.dev1)
Requirement already satisfied: ldap3!=2.5.0,!=2.5.2,!=2.6,>=2.5 in /usr/lib/python3/dist-packages (from bloodhound) (2.9.1)
Requirement already satisfied: pyasn1>=0.4 in /usr/lib/python3/dist-packages (from bloodhound) (0.5.1)
Collecting pycryptodome (from bloodhound)
Downloading pycryptodome-3.22.0-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.metadata (3.4 kB)
Downloading bloodhound-1.8.0-py3-none-any.whl (84 kB)
Downloading pycryptodome-3.22.0-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (2.3 MB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.3/2.3 MB 9.7 MB/s eta 0:00:00
Installing collected packages: pycryptodome, bloodhound
Successfully installed bloodhound-1.8.0 pycryptodome-3.22.0
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning.
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo neo4j console
Directories in use:
home: /usr/share/neo4j
config: /usr/share/neo4j/conf
logs: /etc/neo4j/logs
plugins: /usr/share/neo4j/plugins
import: /usr/share/neo4j/import
data: /etc/neo4j/data
certificates: /usr/share/neo4j/certificates
licenses: /usr/share/neo4j/licenses
run: /var/lib/neo4j/run
Starting Neo4j.
2023-07-29 11:10:52.602+0000 INFO Starting...
2023-07-29 11:10:53.628+0000 INFO This instance is ServerId{9c35d36c} (9c35d36c-66eb-4cef-825a-c64aee53f01b)
2023-07-29 11:10:56.849+0000 INFO ======== Neo4j 4.4.16 ========
2023-07-29 11:11:00.959+0000 INFO Initializing system graph model for component 'security-users' with version -1 and status UNINITIALIZED
2023-07-29 11:11:00.985+0000 INFO Setting up initial user from defaults: neo4j
2023-07-29 11:11:00.985+0000 INFO Creating new user 'neo4j' (passwordChangeRequired=true, suspended=false)
2023-07-29 11:11:01.014+0000 INFO Setting version for 'security-users' to 3
2023-07-29 11:11:01.030+0000 INFO After initialization of system graph model component 'security-users' have version 3 and status CURRENT
2023-07-29 11:11:01.045+0000 INFO Performing postInitialization step for component 'security-users' with version 3 and status CURRENT
2023-07-29 11:11:01.512+0000 INFO Bolt enabled on localhost:7687.
2023-07-29 11:11:04.013+0000 INFO Remote interface available at http://localhost:7474/
2023-07-29 11:11:04.027+0000 INFO id: 9DF0E320BCF7376AF159AAF73DE5028C775D19E7B96CDDDAB38577187E5F0965
2023-07-29 11:11:04.028+0000 INFO name: system
2023-07-29 11:11:04.029+0000 INFO creationDate: 2023-07-29T11:10:58.11Z
2023-07-29 11:11:04.030+0000 INFO Started.
┌──(kali㉿kali)-[~/Desktop]
└─$ cp /usr/lib/bloodhound/resources/app/Collectors/SharpHound.ps1 .
┌──(kali㉿kali)-[~/Desktop]
└─$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
controller\administrator@DOMAIN-CONTROLL C:\Users\Administrator\Downloads>powershell -ep bypass
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Users\Administrator\Downloads>
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> .\SharpHound.exe -c all
2023-07-30T01:13:52.1347165-07:00|INFORMATION|This version of SharpHound is compatible with the 4.3.1 Release of BloodHound
2023-07-30T01:13:52.2910006-07:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, GPOLocalGroup, Session, LoggedOn, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
2023-07-30T01:13:52.3222167-07:00|INFORMATION|Initializing SharpHound at 1:13 AM on 7/30/2023
2023-07-30T01:13:52.6190720-07:00|INFORMATION|[CommonLib LDAPUtils]Found usable Domain Controller for htb.local : FOREST.htb.local
2023-07-30T01:13:52.7598374-07:00|INFORMATION|Flags: Group, LocalAdmin, GPOLocalGroup, Session, LoggedOn, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
2023-07-30T01:13:53.2442157-07:00|INFORMATION|Beginning LDAP search for htb.local
2023-07-30T01:13:53.3848627-07:00|INFORMATION|Producer has finished, closing LDAP channel
2023-07-30T01:13:53.3848627-07:00|INFORMATION|LDAP channel closed, waiting for consumers
2023-07-30T01:14:23.3726534-07:00|INFORMATION|Status: 0 objects finished (+0 0)/s -- Using 44 MB RAM
2023-07-30T01:14:39.0465553-07:00|INFORMATION|Consumers finished, closing output channel
2023-07-30T01:14:39.0778054-07:00|INFORMATION|Output channel closed, waiting for output task to complete
Closing writers
2023-07-30T01:14:39.1403068-07:00|INFORMATION|Status: 161 objects finished (+161 3.577778)/s -- Using 50 MB RAM
2023-07-30T01:14:39.1403068-07:00|INFORMATION|Enumeration finished in 00:00:45.9011298
2023-07-30T01:14:39.2184306-07:00|INFORMATION|Saving cache with stats: 118 ID to type mappings.
118 name to SID mappings.
0 machine sid mappings.
2 sid to domain mappings.
0 global catalog mappings.
2023-07-30T01:14:39.2184306-07:00|INFORMATION|SharpHound Enumeration Completed at 1:14 AM on 7/30/2023! Happy Graphing!
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> ls
Directory: C:\Users\svc-alfresco\Documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 7/30/2023 1:14 AM 18868 20230730011352_BloodHound.zip
-a---- 7/30/2023 1:14 AM 19605 MzZhZTZmYjktOTM4NS00NDQ3LTk3OGItMmEyYTVjZjNiYTYw.bin
-a---- 7/30/2023 1:12 AM 1061888 SharpHound.exe
-a---- 7/30/2023 1:00 AM 1308348 SharpHound.ps1
sudo apt install bloodhound.py
┌──(kali㉿kali)-[~/domain/data]
└─$ sudo bloodhound-python -u fcastle -p 'Password1' -ns 192.168.145.138 -d MARVEL.local -c all
[sudo] password for kali:
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: marvel.local
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (hydra-dc.marvel.local:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: hydra-dc.marvel.local
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 3 computers
INFO: Connecting to LDAP server: hydra-dc.marvel.local
INFO: Found 8 users
INFO: Found 52 groups
INFO: Found 3 gpos
INFO: Found 2 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: SPIDERMAN.MARVEL.local
INFO: Querying computer: THEPUNISHER.MARVEL.local
INFO: Querying computer: HYDRA-DC.MARVEL.local
INFO: Done in 00M 01S