retour aux outils back to tools Ducklings

BloodHound

Analyse des chemins d'attaque Active Directory par la théorie des graphes. Trouve les chemins les plus courts vers Domain Admin et visualise les relations AD. Active Directory attack path analysis using graph theory. Finds shortest paths to Domain Admin and visualizes AD relationships.

↗ https://github.com/SpecterOps/BloodHound

Overview

BloodHound maps Active Directory relationships into a graph database (Neo4j / BloodHound CE) and reveals attack paths to high-value targets like Domain Admin. It turns complex AD enumeration into visual attack paths that are otherwise nearly impossible to spot manually.

Collectors (Ingestors)

BloodHound needs data collected from the domain. Use one of these collectors:

# SharpHound (C# — run on Windows in-domain)
SharpHound.exe -c All --outputdirectory C:\Temp
SharpHound.exe -c All,GPOLocalGroup --zipfilename output.zip

BloodHound.py (Python — run from Linux, no domain join required)

bloodhound-python -d domain.local -u user -p 'Password1' -ns 10.10.10.1 -c All

Specify DC directly

bloodhound-python -d domain.local -u user -p 'Password1' -dc dc01.domain.local -c All

With NTLM hash (pass-the-hash)

bloodhound-python -d domain.local -u user --hashes :NTLMhash -ns 10.10.10.1 -c All

BloodHound CE python (newer)

bloodhound-ce-python -d domain.local -u user -p 'Password1' -ns 10.10.10.1 -c All

BloodHound CE Setup

Start BloodHound CE via Docker

curl -L https://ghst.ly/getbhce | docker compose -f - up
# Access the web UI at http://localhost:8080
# Default credentials shown at first launch

Key Cypher Queries (raw Neo4j)

-- Find all paths to Domain Admins
MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})) RETURN p

-- Find users with DCSync rights
MATCH p=(u)-[:DCSync|AllExtendedRights|GenericAll]->(d:Domain) RETURN p

-- Find Kerberoastable users
MATCH (u:User {hasspn:true}) RETURN u.name, u.description

-- Find AS-REP Roastable users
MATCH (u:User {dontreqpreauth:true}) RETURN u.name

-- Computers where Domain Admins have sessions
MATCH p=(m:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}) RETURN p

-- Owned users with paths to DA
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})) RETURN p

Built-in Queries (GUI)

Key pre-built queries to run after ingestion:

  • Find all Domain Admins
  • Find Shortest Paths to Domain Admins
  • Find Principals with DCSync Rights
  • Find Computers where Domain Users are Local Admin
  • Find AS-REP Roastable Users
  • Find Kerberoastable Users
  • Find Users with Foreign Domain Group Membership

Tips

  • Mark compromised accounts/computers as “Owned” in BloodHound to reveal post-compromise paths
  • SharpHound -c DCOnly is stealthier — only queries the DC, no computer enumeration
  • Use --stealth flag in SharpHound to reduce network noise
  • BloodHound CE (SpecterOps’ latest) replaces the legacy community edition
SharpHound collection flags 
SharpHound.exe [flags]

-c, --collectionmethods   Collection methods (Default: Default)
    All, DCOnly, Group, LocalGroup, GPOLocalGroup, Session,
    LoggedOn, ObjectProps, ACL, Container, RDP, DCOM, PSRemote, Trusts

-d, --domain              Target domain
--zipfilename             Name of output zip file
--outputdirectory         Output directory
--stealth                 Enable stealth collection
--distinguishedname       OU to limit collection
--excludedcs              Exclude domain controllers from local admin collection
--loop                    Loop collection
--loopduration            Duration for looping (e.g. 01:00:00)
--loopinterval            Interval between loops (e.g. 00:05:00)

Vue d’ensemble

BloodHound cartographie les relations d’Active Directory dans une base de données graphe (Neo4j / BloodHound CE) et révèle les chemins d’attaque vers des cibles de grande valeur comme Domain Admin. Il transforme une énumération AD complexe en chemins d’attaque visuels, autrement presque impossibles à repérer manuellement.

Collecteurs (Ingestors)

BloodHound a besoin de données collectées depuis le domaine. Utilisez l’un de ces collecteurs :

# SharpHound (C# : à lancer sous Windows dans le domaine)
SharpHound.exe -c All --outputdirectory C:\Temp
SharpHound.exe -c All,GPOLocalGroup --zipfilename output.zip

# BloodHound.py (Python : à lancer depuis Linux, aucune jointure au domaine requise)
bloodhound-python -d domain.local -u user -p 'Password1' -ns 10.10.10.1 -c All

# Spécifier le DC directement
bloodhound-python -d domain.local -u user -p 'Password1' -dc dc01.domain.local -c All

# Avec une empreinte NTLM (pass-the-hash)
bloodhound-python -d domain.local -u user --hashes :NTLMhash -ns 10.10.10.1 -c All

# BloodHound CE python (plus récent)
bloodhound-ce-python -d domain.local -u user -p 'Password1' -ns 10.10.10.1 -c All

Installation de BloodHound CE

# Démarrer BloodHound CE via Docker
curl -L https://ghst.ly/getbhce | docker compose -f - up

# Accéder à l'UI web sur http://localhost:8080
# Identifiants par défaut affichés au premier lancement

Requêtes Cypher clés (Neo4j brut)

-- Find all paths to Domain Admins
MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})) RETURN p

-- Find users with DCSync rights
MATCH p=(u)-[:DCSync|AllExtendedRights|GenericAll]->(d:Domain) RETURN p

-- Find Kerberoastable users
MATCH (u:User {hasspn:true}) RETURN u.name, u.description

-- Find AS-REP Roastable users
MATCH (u:User {dontreqpreauth:true}) RETURN u.name

-- Computers where Domain Admins have sessions
MATCH p=(m:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}) RETURN p

-- Owned users with paths to DA
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})) RETURN p

Requêtes intégrées (GUI)

Requêtes prédéfinies clés à lancer après l’ingestion :

  • Find all Domain Admins
  • Find Shortest Paths to Domain Admins
  • Find Principals with DCSync Rights
  • Find Computers where Domain Users are Local Admin
  • Find AS-REP Roastable Users
  • Find Kerberoastable Users
  • Find Users with Foreign Domain Group Membership

Conseils

  • Marquez les comptes/ordinateurs compromis comme “Owned” dans BloodHound pour révéler les chemins post-compromission
  • SharpHound -c DCOnly est plus furtif : il n’interroge que le DC, sans énumération des ordinateurs
  • Utilisez le flag --stealth dans SharpHound pour réduire le bruit réseau
  • BloodHound CE (le dernier de SpecterOps) remplace l’ancienne community edition
Flags de collecte SharpHound 
SharpHound.exe [flags]

-c, --collectionmethods   Collection methods (Default: Default)
    All, DCOnly, Group, LocalGroup, GPOLocalGroup, Session,
    LoggedOn, ObjectProps, ACL, Container, RDP, DCOM, PSRemote, Trusts

-d, --domain              Target domain
--zipfilename             Name of output zip file
--outputdirectory         Output directory
--stealth                 Enable stealth collection
--distinguishedname       OU to limit collection
--excludedcs              Exclude domain controllers from local admin collection
--loop                    Loop collection
--loopduration            Duration for looping (e.g. 01:00:00)
--loopinterval            Interval between loops (e.g. 00:05:00)