Bloodhound Usage

 

 

BloodHound-Python
If you have access to DC, need admin creds - Github

Linux:

proxychains python3 bloodhound.py -d Steins.local -u admin -p p@$$W0rd! -c all -dc dc.steins.local -gc dc.steins.local -v -ns 10.10.10.10 --dns-tcp 

Few files will appear in the same location, import them into bloodhound 

Kali: apt-get install bloodhound 
sudo neo4j console
go to localhost:7474
neo4j: neo4j 	#login in browser and change the password 

bloodhound   #bloodhoun login will pop-up, login with new creds

Windows:

Download this on Windows target: SharpHound.ps1

powershell -ep bypass 
..\SharpHound.ps1
invoke-Bloodhound -CollectionMethod All -Domain Steins.local -ZipfileName file.zip

invoke-Bloodhound -CollectionMethod LoggedOn -Verbose

or 

SharpHound.exe -c All -d Steins.local --zipfilename test.zip

OR 

.\SharpHound.exe  -d steins.local --domaincontroller 192.168.168.168 --ldapusername admin  --ldappassword P@$$W0rd! --zipfilename domain.zip - c All

open the file in bloodhound --> click on upload --> select file


For Testing: 
git clone https://github.com/BloodHoundAD/BloodHound-Tools
cd DBCreator
pip install neo4j-driver
sudo pip3 install neo4j
python3 DBCreator.py
sudo neo4j console 
dbconfig

Invoke-BloodHound Commands 

#specify detailed collection methods
Invoke-BloodHound -CollectionMethod ACL,ObjectProps

#Change the frequency of the requests sent by BloodHound 
Invoke-BloodHound -Throttle 1500 -Jitter 10

#increase the stealthiness of theBloodHound ingestor is to minimize its disk footprint. 
Invoke-BloodHound -CompressData -RemoveCSV and –NoSaveCache

Custom Commands

Click on custom queries and edit the json file, we can add as many queries as required 

Example 1

{
"name": "CUSTOM",
"queryList": [
{
"final": true,
"query": "MATCH (n:User) RETURN n"
}
]
}

List all Domain Admins

{
"name": "CUSTOM",
"queryList": [
{
"final": true,
"query": "MATCH (n:Group) WHERE n.name =~ \"(?i).*DOMAIN ADMINS.*\" WITH n MATCH (n)<-[r:MemberOf*1..]-(m) RETURN n,r,m"
}
]
}
 
Display all the users that are part of administrators group
{
"name": "CUSTOM",
"queryList": [
{
"final": true,
"query": "MATCH (u:User)-[MemberOf]->(g:Group {name: \"ADMINISTRATORS@ELS-CHILD.ELS.LOCAL\"}) RETURN u"
}
]
},