← retour aux outils back to tools

# BloodHound

Analyse des chemins d'attaque Active Directory par la théorie des graphes. Trouve les chemins les plus courts vers Domain Admin et visualise les relations AD. Active Directory attack path analysis using graph theory. Finds shortest paths to Domain Admin and visualizes AD relationships.

↗ https://github.com/SpecterOps/BloodHound

## Overview

BloodHound maps Active Directory relationships into a graph database (Neo4j / BloodHound CE) and reveals attack paths to high-value targets like Domain Admin. It turns complex AD enumeration into visual attack paths that are otherwise nearly impossible to spot manually.

## Collectors (Ingestors)

BloodHound needs data collected from the domain. Use one of these collectors:

    # SharpHound (C# — run on Windows in-domain)
    SharpHound.exe -c All --outputdirectory C:\Temp
    SharpHound.exe -c All,GPOLocalGroup --zipfilename output.zip

BloodHound.py (Python — run from Linux, no domain join required)

    bloodhound-python -d domain.local -u user -p 'Password1' -ns 10.10.10.1 -c All

Specify DC directly

    bloodhound-python -d domain.local -u user -p 'Password1' -dc dc01.domain.local -c All

With NTLM hash (pass-the-hash)

    bloodhound-python -d domain.local -u user --hashes :NTLMhash -ns 10.10.10.1 -c All

BloodHound CE python (newer)

    bloodhound-ce-python -d domain.local -u user -p 'Password1' -ns 10.10.10.1 -c All

## BloodHound CE Setup

Start BloodHound CE via Docker

    curl -L https://ghst.ly/getbhce | docker compose -f - up

    # Access the web UI at http://localhost:8080
    # Default credentials shown at first launch

## Key Cypher Queries (raw Neo4j)

    -- Find all paths to Domain Admins
    MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})) RETURN p

    -- Find users with DCSync rights
    MATCH p=(u)-[:DCSync|AllExtendedRights|GenericAll]->(d:Domain) RETURN p

    -- Find Kerberoastable users
    MATCH (u:User {hasspn:true}) RETURN u.name, u.description

    -- Find AS-REP Roastable users
    MATCH (u:User {dontreqpreauth:true}) RETURN u.name

    -- Computers where Domain Admins have sessions
    MATCH p=(m:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}) RETURN p

    -- Owned users with paths to DA
    MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})) RETURN p

## Built-in Queries (GUI)

Key pre-built queries to run after ingestion:

- Find all Domain Admins
- Find Shortest Paths to Domain Admins
- Find Principals with DCSync Rights
- Find Computers where Domain Users are Local Admin
- Find AS-REP Roastable Users
- Find Kerberoastable Users
- Find Users with Foreign Domain Group Membership

## Tips

- Mark compromised accounts/computers as “Owned” in BloodHound to reveal post-compromise paths
- `SharpHound -c DCOnly` is stealthier — only queries the DC, no computer enumeration
- Use `--stealth` flag in SharpHound to reduce network noise
- BloodHound CE (SpecterOps’ latest) replaces the legacy community edition

SharpHound collection flags

    SharpHound.exe [flags]

    -c, --collectionmethods   Collection methods (Default: Default)
        All, DCOnly, Group, LocalGroup, GPOLocalGroup, Session,
        LoggedOn, ObjectProps, ACL, Container, RDP, DCOM, PSRemote, Trusts

    -d, --domain              Target domain
    --zipfilename             Name of output zip file
    --outputdirectory         Output directory
    --stealth                 Enable stealth collection
    --distinguishedname       OU to limit collection
    --excludedcs              Exclude domain controllers from local admin collection
    --loop                    Loop collection
    --loopduration            Duration for looping (e.g. 01:00:00)
    --loopinterval            Interval between loops (e.g. 00:05:00)

## Vue d’ensemble

BloodHound cartographie les relations d’Active Directory dans une base de données graphe (Neo4j / BloodHound CE) et révèle les chemins d’attaque vers des cibles de grande valeur comme Domain Admin. Il transforme une énumération AD complexe en chemins d’attaque visuels, autrement presque impossibles à repérer manuellement.

## Collecteurs (Ingestors)

BloodHound a besoin de données collectées depuis le domaine. Utilisez l’un de ces collecteurs :

    # SharpHound (C# : à lancer sous Windows dans le domaine)
    SharpHound.exe -c All --outputdirectory C:\Temp
    SharpHound.exe -c All,GPOLocalGroup --zipfilename output.zip

    # BloodHound.py (Python : à lancer depuis Linux, aucune jointure au domaine requise)
    bloodhound-python -d domain.local -u user -p 'Password1' -ns 10.10.10.1 -c All

    # Spécifier le DC directement
    bloodhound-python -d domain.local -u user -p 'Password1' -dc dc01.domain.local -c All

    # Avec une empreinte NTLM (pass-the-hash)
    bloodhound-python -d domain.local -u user --hashes :NTLMhash -ns 10.10.10.1 -c All

    # BloodHound CE python (plus récent)
    bloodhound-ce-python -d domain.local -u user -p 'Password1' -ns 10.10.10.1 -c All

## Installation de BloodHound CE

    # Démarrer BloodHound CE via Docker
    curl -L https://ghst.ly/getbhce | docker compose -f - up

    # Accéder à l'UI web sur http://localhost:8080
    # Identifiants par défaut affichés au premier lancement

## Requêtes Cypher clés (Neo4j brut)

    -- Find all paths to Domain Admins
    MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})) RETURN p

    -- Find users with DCSync rights
    MATCH p=(u)-[:DCSync|AllExtendedRights|GenericAll]->(d:Domain) RETURN p

    -- Find Kerberoastable users
    MATCH (u:User {hasspn:true}) RETURN u.name, u.description

    -- Find AS-REP Roastable users
    MATCH (u:User {dontreqpreauth:true}) RETURN u.name

    -- Computers where Domain Admins have sessions
    MATCH p=(m:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}) RETURN p

    -- Owned users with paths to DA
    MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})) RETURN p

## Requêtes intégrées (GUI)

Requêtes prédéfinies clés à lancer après l’ingestion :

- Find all Domain Admins
- Find Shortest Paths to Domain Admins
- Find Principals with DCSync Rights
- Find Computers where Domain Users are Local Admin
- Find AS-REP Roastable Users
- Find Kerberoastable Users
- Find Users with Foreign Domain Group Membership

## Conseils

- Marquez les comptes/ordinateurs compromis comme “Owned” dans BloodHound pour révéler les chemins post-compromission
- `SharpHound -c DCOnly` est plus furtif : il n’interroge que le DC, sans énumération des ordinateurs
- Utilisez le flag `--stealth` dans SharpHound pour réduire le bruit réseau
- BloodHound CE (le dernier de SpecterOps) remplace l’ancienne community edition

Flags de collecte SharpHound

    SharpHound.exe [flags]

    -c, --collectionmethods   Collection methods (Default: Default)
        All, DCOnly, Group, LocalGroup, GPOLocalGroup, Session,
        LoggedOn, ObjectProps, ACL, Container, RDP, DCOM, PSRemote, Trusts

    -d, --domain              Target domain
    --zipfilename             Name of output zip file
    --outputdirectory         Output directory
    --stealth                 Enable stealth collection
    --distinguishedname       OU to limit collection
    --excludedcs              Exclude domain controllers from local admin collection
    --loop                    Loop collection
    --loopduration            Duration for looping (e.g. 01:00:00)
    --loopinterval            Interval between loops (e.g. 00:05:00)