In this Red Team tools course,
we'll see how we can perform discovery with BloodHound.
BloodHound is an open source tool that leverages the power of
graphs to let you visualize your active directory.
It was created by @_wald0, @CptJesus, and @harmj0y,
and is still maintained by them.
BloodHound allows you to find complex paths to your objective easily.
BloodHound is a single page JavaScript web application that is built on Neo4j,
which is a graph database.
It allows you to visualize and find the complex attack paths
using the power of that graph database.
It's available on GitHub at that link right here.
And it's the only open source tool that leverages the power of
graphs to find attack paths in active directory.
On the attack kill chain, you'll see that BloodHound is a post exploitation tool.
It's a discovery tool that you need to run from a
compromised computer that's on the domain.
It's not an escalation or a lateral movement tool,
but it will give you so much information you'll be
able to perform both with ease,
simply thanks to all the information that BloodHound will provide you.
If we look at MITRE ATT&CK, BloodHound maps to a few different tactics.
It is essentially a discovery tool. In terms of discovery, there's different
techniques that BloodHound covers like account discovery,
permission groups discovery, and system owner and user discovery.
These are only a few of the things that BloodHound is able to
gather, but what's even more powerful about BloodHound is not
just the information that it gets.
Anyone can connect over LDAP and download similar
information from active directory.
It's the way that it will present that information to you,
making it extremely easy to use.
So how does it work?
Well, imagine you have a domain.
That domain is managed by the domain admins group.
That domain admins group contains the sysadmins group.
So we have a nested group. And Mike is a member of the sysadmins group.
So you might think, well, that's simple enough, right?
I should just compromise Mike's account and I'll be
able to compromise the domain.
But maybe Mike's account is going to be hard to compromise,
and in reality,
the nested groups are going to be much more complex than a
simple two group chain like this one. So if Mike's account
is really hard to compromise, how would we go about this?
Well, what if Mike was logged into a laptop?
You might want to compromise that laptop.
How would you do that?
Well,
if there's a group policy applied to that laptop and that
group policy can be written to by Rose,
this now means that you can also compromise Rose's account to go edit that
group policy, take over the laptop on which Mike is logged in,
and you will essentially become domain admin with a few different steps.
Simple enough, right?
What BloodHound lets you do is visualize those steps really easily.
What it does is it connects to active directory over LDAP and
downloads all the information about the users,
the groups, the computers, and all of that.
It can also connect directly to computers to enumerate sessions and ACLs.
With all of that information,
it will create the graph database that'll let us see all the
relationships between all of these different objects, so you can
find the shortest path to your objective.
To follow along with the demo, you'll need a system to install BloodHound.
I highly recommend using Kali Linux for this because the
installation is really simple. However,
BloodHound works on Mac, Windows, and Linux.
You simply need to install Neo4j first.
You'll need the ability to transfer the exercise files
to your system running BloodHound.
You do not need active directory to follow along.
The example domain that'll be showing will be exported to a
BloodHound zip file that you can simply import to your own
running instance of BloodHound.