The best way to collect data with BloodHound is to use SharpHound.
You'll find it on the same GitHub repo as BloodHound in the Ingestors directory.
It's available as a simple executable or a PowerShell version.
Depending on how stealthy you need to be, consider using PowerShell with
some customized options or maybe even recompiling your own.
You will then need to run it from a computer that's on the domain.
I downloaded mine to the SharpHound directory. Again, if trying to be stealth,
you probably don't want to name things like that.
The executable is simply SharpHound,
so if you just run it without passing it any
configuration it's going to use its defaults,
which are pretty good. However, we'll customize it a little bit.
SharpHound supports different collection methods.
These are configured by using the ‑‑CollectionMethod option
and specifying a comma‑separated list.
So I want to gather the information about groups,
local groups, remote desktop, DCOM permissions,
GPOLocalGroup,
which is used to enumerate local groups configured via GPO, sessions,
ObjectProps, who's logged on, domain trusts,
ACLs, and information about containers. Now, this will be extremely
noisy because it will create many different threads.
It will also connect to different computers to enumerate
sessions and who's logged on, and all of that.
So if you just ran that in an environment where you
have a pretty good Blue team, you're very likely to get caught.
There's also a stealth option for SharpHound,
and you can also configure it to only use LDAP, so it will
only connect to one domain controller.
So consider starting with the stealth option,
using only a specific domain controller, and going as slow as you can.
Now for this demo.
I'm just going to run this because it will gather as
much information as possible at once.
As you can see, it creates zip files,
and there's an option to encrypt those zip files when they're
created. Again, if this is a real engagement,
you might want to do that.
So you specify a file name,
and the person that tries to open the zip can't actually see that
someone just dumped their entire active directory into it.
So now that I have that zip file,
I'm going to import it into BloodHound. That zip file is what
you have available in the exercise files,
so this is the same zip file that you'll import on your side.