Bloodhound Cheatsheet
Introduction:
BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. It is used for analyzing and understanding Active Directory security.
Basic Commands:
Starting BloodHound:
- Start Neo4j:
sudo neo4j start
- Start BloodHound:
bloodhound
BloodHound Interface:
- Nodes: Represent objects like users, groups, computers, and domains.
- Edges: Represent relationships like group memberships, session connections, and ACLs.
Running BloodHound from Metasploit:
- Enter a SYSTEM level Meterpreter Session
sessions -i <session_id>
- Run the Post-Exploitation Module
meterpreter> run post/windows/gather/bloodhound
- Document the password, and move the
*.zipto your/home/kali/directorymv /home/kali/.msf4/loot/*.zip /home/kali/*.zip
- Modify the permissions, extract the files, and enter the password
chmod 777 *.zip && unzip *.zip
- Upload these files to BloodHound for analysis.
Uploading files into BloodHound:
- Navigate to the BloodHound interface.
- Click on the "Upload Data" button to the right side of the interface.
- Select and upload the
.zipfiles generated by SharpHound or the.jsonfiles extracted from the.zipfile.
Querying BloodHound:
BloodHound uses Cypher, a query language for Neo4j, to query the data.
Basic Cypher Queries:
- Find all domain admins:
MATCH (n:User)-[:MemberOf*1..]->(g:Group {name: "DOMAIN ADMINS@"}) RETURN n
- Find all sessions:
MATCH (n:User)-[:HasSession]->(m:Computer) RETURN n, m
- Find all local admins:
MATCH (n:User)-[:AdminTo]->(m:Computer) RETURN n, m
- Find all computers with unconstrained delegation:
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c
- Find shortest path to domain admin:
MATCH p=shortestPath((n:User {name:""})-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@"})) RETURN p
Common Analysis Techniques:
- Shortest Paths: Identifies the shortest path to high-value targets like domain admins.
- Group Memberships: Analyzes group memberships to find nested group memberships.
- ACL Analysis: Identifies users and groups that have specific permissions on objects.
- Session Analysis: Determines which users have active sessions on which computers.
Tips:
- Regularly update BloodHound and SharpHound to the latest versions.
- Use filters in the BloodHound interface to refine your results.
- Combine multiple queries for comprehensive analysis.
Help and Documentation:
- BloodHound GitHub: https://github.com/BloodHoundAD/BloodHound
- SharpHound GitHub: https://github.com/BloodHoundAD/SharpHound
- BloodHound Documentation: https://bloodhound.readthedocs.io/en/latest/
Example Workflow:
- Start Neo4j and BloodHound.
- Collect data using BloodHound module in a SYSTEM level meterpreter shell.
- Upload data to BloodHound.
- Run Cypher queries to analyze the data.
- Use the BloodHound interface to visualize and further explore the relationships.