BloodHound & Other AD Enum Tools
An advanced Active Directory (AD) viewer and editor. You can use AD Explorer to navigate an AD database easily, define favourite locations, view object properties, and attributes without opening dialog boxes, edit permissions, view an object's schema, and execute sophisticated searches that you can save and re-execute.
AD Explorer can create snapshots of an AD so you can check it offline. It can be used to discover vulns offline, or to compare different states of the AD DB across the time.
You will be requires the username, password, and direction to connect (any AD user is required).
To take a snapshot of AD, go to
Create Snapshotand enter a name for the snapshot.
ADRecon is a tool which extracts and combines various artefacts out of an AD environment. The information can be presented in a specially formatted Microsoft Excel report that includes summary views with metrics to facilitate analysis and provide a holistic picture of the current state of the target AD environment.
# Run it
BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify. Defenders can use BloodHound to identify and eliminate those same attack paths. Both blue and red teams can use BloodHound to easily gain a deeper understanding of privilege relationships in an Active Directory environment.
Booldhound is composed of 2 main parts: ingestors and the visualisation application.
The ingestors are used to enumerate the domain and extract all the information in a format that the visualisation application will understand.
The visualisation application uses neo4j to show how all the information is related and to show different ways to escalate privileges in the domain.
To install the visualisation application you will need to install neo4j and the bloodhound application. The easiest way to do this is just doing:
apt-get install bloodhound
You can download the Ingestors from:
- 1.Learn the path from the graph
Bloodhound come with various queries to highlight sensitive compromission path. It it possible to add custom queries to enhance the search and correlation between objects and more!
This repo has a nice collections of queries: https://github.com/CompassSecurity/BloodHoundQueries
$ curl -o "~/.config/bloodhound/customqueries.json" "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/customqueries.json"
After downloading/installing the required applications, lets start them. First of all you need to start the neo4j database:
service neo4j start
The first time that you start this database you will need to access http://localhost:7474/browser/. You will be asked default credentials (neo4j:neo4j) and you will be required to change the password, so change it and don't forget it.
Now, start the bloodhound application:
You will be prompted for the database credentials: neo4j:<Your new password>
And bloodhound will be ready to ingest data.
They have several options but if you want to run SharpHound from a PC joined to the domain, using your current user and extract all the information you can do:
./SharpHound.exe --CollectionMethod All
Invoke-BloodHound -CollectionMethod All
If you wish to execute SharpHound using different credentials you can create a CMD netonly session and run SharpHound from there:
runas /netonly /user:domain\user "powershell.exe -exec bypass"
If you have domain credentials you can run a python bloodhound ingestor from any platform so you don't need to depend on Windows. Download it from https://github.com/fox-it/BloodHound.py or doing
pip3 install bloodhound
bloodhound-python -u support -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local -c all
If you are running it through proxychains add
--dns-tcpfor the DNS resolution to work throught the proxy.
proxychains bloodhound-python -u support -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local -c all --dns-tcp
This script will quietly enumerate an Active Directory Domain via LDAP parsing users, admins, groups, etc.
group3r.exe -f <filepath-name.log>
# -s sends results to stdin
# -f send results to file
To run it, can execute the binary
PingCastle.exeand it will start an interactive session presenting a menu of options. The default option to use is
healthcheckwhich will establish a baseline overview of the domain, and find misconfigurations and vulnerabilities.