Search everything Ctrl K

BloodHound

BloodHound collects the domain users, groups, sessions, ACLs and delegations and draws them as a graph. Mark what you already control as owned and ask for the shortest path to Domain Admins: almost every AD box is solved by following those arrows.

Platform
Docker (CE) · recolectores en Python, C# y Rust
Official site
github.com/SpecterOps/BloodHound
On HTB
22 machines
Install 
curl -L https://ghst.ly/getbhce | docker compose -f - up

BloodHound cheat sheet

Your values Saved in this browser and applied to every cheatsheet.
15 commands

Collectors

RustHound-CE from Linux 
rusthound-ce -d box.htb -u usuario -p 'Password123!' -z
SharpHound with just fast-changing data (sessions) Target 
.\SharpHound.exe -c Session --loop --loopduration 00:10:00

In our cheatsheets

Windows and Active Directory privilege escalation › Active Directory

Collect data for BloodHound 
bloodhound-python -u 'usuario' -p 'Password123!' -d box.htb -ns 10.10.11.20 -c All --zip

Active Directory in depth › BloodHound

Remote collector in Python (CE) Attacker 
bloodhound-ce-python -u usuario -p 'Password123!' -d box.htb -ns 10.10.11.20 -dc dc01.box.htb -c All --zip
With NetExec, nothing else to install Attacker 
nxc ldap 10.10.11.20 -u usuario -p 'Password123!' --bloodhound -c All --dns-server 10.10.11.20
SharpHound from the Windows target Target 
.\SharpHound.exe -c All --zipfilename datos
Mark what you already own as pwned 
MATCH (u:User) WHERE u.name STARTS WITH 'usuario' SET u.owned=true RETURN u
Shortest paths from what you own to Domain Admins 
MATCH p=shortestPath((n {owned:true})-[*1..]->(g:Group)) WHERE g.name STARTS WITH 'DOMAIN ADMINS@' RETURN p
Kerberoastable users (they have an SPN) 
MATCH (u:User {hasspn:true}) RETURN u.name, u.serviceprincipalnames
AS-REP roastable users (no pre-auth) 
MATCH (u:User {dontreqpreauth:true}) RETURN u.name
What your owned user can abuse (outbound ACLs) 
MATCH p=(u:User {owned:true})-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|AddKeyCredentialLink|ForceChangePassword|AddMember|AllowedToDelegate*1..]->(n) RETURN p
Computers with unconstrained delegation 
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name
High-value user sessions (where to grab credentials) 
MATCH (u:User)-[:MemberOf*1..]->(g:Group) WHERE g.highvalue=true MATCH (c:Computer)-[:HasSession]->(u) RETURN c.name, u.name
Who can read a gMSA password 
MATCH p=(n)-[:ReadGMSAPassword]->(m:User) RETURN p
Who can read LAPS on which computers 
MATCH p=(n)-[:ReadLAPSPassword]->(c:Computer) RETURN p

HTB machines where BloodHound is used

Taken from the chapters of IppSec videos where BloodHound shows up. The ▶ link jumps to the minute of that part.

Guides that use BloodHound