Bloodhound
Bloodhound Usage
Linux
Rusthound
The most opsec
rusthound -d "$DOMAIN" -u "$USER"@"$DOMAIN" -p "$PASSWORD" --zip --ldaps --adcs --old-bloodhoundNXC
nxc ldap <ip> -u user -p pass --bloodhound --collection All
nxc ldap 192.168.1.48 -u raj -p Password@1 --bloodhound --collection All --dns-server 192.168.1.48Bloodhound.py
To get all data in Bloodhound, use SharpHond.exe - Exegol compatible version https://github.com/BloodHoundAD/SharpHound/releases/download/v1.0.4/SharpHound-v1.0.4.zip
Bloodhound.py don't get all data, probably because of DNS resolution
With password
$ sudo bloodhound-python -u 'forend' -p 'Klmcargo2' -ns 172.16.5.5 -d inlanefreight.local -c all
INFO: Found AD domain: inlanefreight.local
INFO: Connecting to LDAP server: ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL
INFO: Found 1 domains
INFO: Found 2 domains in the forest
INFO: Found 564 computers
INFO: Connecting to LDAP server: ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL
INFO: Found 2951 users
INFO: Connecting to GC LDAP server: ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL
INFO: Found 183 groups
INFO: Found 2 trusts
INFO: Starting computer enumeration with 10 workersTimeout errors - add dns-tcp
bloodhound.py --zip -c All -d "INLANEFREIGHT.LOCAL" -u "forend" -p "Klmcargo2" -ns "172.16.5.5" --dns-tcpEven better
$ cat /etc/resolv.conf
# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.
nameserver 127.0.0.53
search lan
options edns0 trust-ad
# Based on host file: '/etc/resolv.conf'
# Overrides: []
domain FREIGHTLOGISTICS.LOCAL
nameserver 172.16.5.238bloodhound.py --zip -c All -d FREIGHTLOGISTICS.LOCAL -ns 172.16.5.238 -c All -u forend@inlanefreight.local -p Klmcargo2 --dns-tcp
INFO: Found AD domain: freightlogistics.local
INFO: Getting TGT for userWith Kerberos (ccache)
# export KRB5CCNAME=krb5cc.florence.ramirez
# bloodhound.py --zip -c All -d "domain.htb" -u "florence.ramirez" -k -ns 10.10.11.24
Password: LDAPSearch - Avoid Detection
proxychains ldapsearch -LLL -H ldap://dc03.eu-ifrit.vl -D 'EU-IFRIT\Grace.Dunn' -w 'PenEuIfrit527#' -b "DC=EU-IFRIT,DC=VL" -N -o ldif-wrap=no -E '!1.2.840.113556.1.4.801=::MAMCAQc=' "(&(objectClass=*))" | tee objects.txt # git clone https://github.com/fortalice/bofhound
# cd bofhound
# pip install .
# cd ..# wget https://gist.githubusercontent.com/kozmer/725cde788e4b3c8bdd870468c243916b/raw/a797b4020bef960124d79d7295cb6ad1849b47a1/ldapsearch_parser.py
# python3 ldapsearch_parser.py objects.txt object-conv.txt
# bofhound -i object-conv.txt 
JSON files can be ingest int o Bloodhound and we now have ACLs
Can also see:
Windows
Sharphound.exe
For Exegol compatible version: https://github.com/BloodHoundAD/SharpHound/releases/download/v1.0.4/SharpHound-v1.0.4.zip
PS C:\htb> .\SharpHound.exe -c All --zipfilename ILFREIGHT
# removes noisy collection methods like RDP, DCOM, PSRemote and LocalAdmin
SharpHound.exe –-steatlhSharphound.ps1
C:\AD\Tools\BloodHound-master\Collectors\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All
# removes noisy collection methods like RDP, DCOM, PSRemote and LocalAdmin
Invoke-BloodHound –Steatlh
# avoid detections like MDI
Invoke-BloodHound -ExcludeDCsSOAPHound
ShadowHound
2 options: ADWS or LDAP
# 1/
ShadowHound-ADM -OutputFilePath "C:\Résultats\output.txt"
# 2/
python3 bofhound.py -i output.txt -p All
ADExplorer64 - Avoid Detection
ADExplorer64.exe is a sysinternal signed binary
C:\Windows\Temp\ is a default AppLocker Exclusion Path
Z:\>copy C:\Users\Grace.Dunn\Desktop\ADExplorer64.exe C:\Windows\Temp\
Overwrite C:\Windows\Temp\ADExplorer64.exe? (Yes/No/All): Yes
1 file(s) copied.
Z:\>C:\Windows\Temp\ADExplorer64.exe
File -> Create a Snapshot
Parse the snapshot to ingest it in Bloodhound
[Jan 18, 2025 - 07:04:10 (EST)] exegol-default ADExplorerSnapshot.py # vim adexpsnapshot/__init__.py Change self.preprocessCached() by self.preprocess()
python3 ADExplorerSnapshot.py ../snapshot.dat
Can now be used in Bloodhound
It doesn't include ACL datas
To get ACL datas see LDAPSearch
Run Bloodhound
Then upload zip file generate from Sharphound or bloodhound-python
Bloodhound-quickwin
bloodhound-quickwin -u neo4j -p exegol4thewinAD Miner
Autobloody
Bloodhound Query Library
Interesting Book
Interesting BooksPentesting Active Directory and Windows-based Infrastructure Enhance your skill set to pentest against real-world Microsoft infrastructure with hands-on exercises and by following attack/detect guidelines with OpSec considerations
Infrastructure Attack Strategies for Ethical Hacking Encompassing both external and internal enumeration techniques, the book delves into attacking routers and services, establishing footholds, privilege escalation, lateral movement, and exploiting databases and Active Directory.
RTFM: Red Team Field Manual v2 A quick reference when there is no time to scour the Internet for that perfect command
Red Team Development and Operations: A practical guide The authors have moved beyond SANS training and use this book to detail red team operations in a practical guide.
Cybersecurity Attacks – Red Team Strategies A practical guide to building a penetration testing program having homefield advantage
Support this Gitbook
I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.
Last updated