BloodHound is a powerful tool which everages graph theory to uncover hidden connections within Active Directory. This enables both attackers and defenders to visualize complex attack paths that might otherwise go unnoticed.
Bloodhound will show you the rights users have over others and this way show you a path for lateral movement. Bloodhound will also tell you what abuse is possible and provide the command to achieve this.
Extracting information with Sharphound
To get all the data we need to import in Bloodhound we can use Sharphound. This will create a .zip file with within .json files which can be import in Bloodhound.
.\SharpHound.exe -c All --zipfilename ZENCORPBloodhound.py
Bloodhound.py will also retrieve all information but does so from Linux.
sudo bloodhound-ce-python -u 'james' -p 'pass123' -ns 172.16.5.5 -d zencorp.local -c all Start Bloodhound
When starting Bloodhound for first time you have to change the password using default username admin.
Custom queries
Queries will help you find interesting users and rights using Bloodhound.
curl -o ~/.config/bloodhound/customqueries.json "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/BloodHound_Custom_Queries/customqueries.json"