I downloaded the zip file to my Kali Linux machine,
so now you could either drag or drop the zip file right into BloodHound,
or you can use the upload data option and simply select the zip file.
There's a few thousand users in that active directory,
so it could take a minute or two for you to import the zip file,
especially if the VM you're using is slow or doesn't have a lot of memory.
It's not a huge domain though, so it should be fine.
If you're ever using this in production on gigantic domains with
hundreds of thousands of users and thousands of servers,
keep in mind you could run Neo4j on a separate machine
and connect to it via BloodHound.
Just make sure you secure Neo4j with authentication before you do that.
As you can see, all files have been processed.
We can see the import has been successful because we've got over 3,000 users,
a few computers, some groups, and some sessions.
The interesting number is relationships.
There is close to 34,000 relationships that have been imported.
No one could visualize all that in their head,
but with the graph database, BloodHound is able to do so.
So as you can see, we have a lot of pre‑built queries.
BloodHound uses cypher queries, which are Neo4j queries.
We can see the raw query at the bottom here,
but it comes with some very useful pre‑built queries.
For example, if I want to find all domain admins, I'll simply click this.
And as you can see, this is the DOMAIN ADMINS group.
And if I zoom out a little bit, I can move,
and I can see that the ADMINISTRATOR account is a domain
admin and Jay Wilson is a domain admin.
That's interesting.
Now there's a lot of other pre‑built queries that are really interesting,
like finding accounts that are Kerberoastable,
finding unsupported operating systems,
finding domain admins that are logged into things
that are not domain controllers.
This is something that's very dangerous because if
you're logged into a domain controller,
no one else is supposed to be able to connect to it.
But if you're a domain admin and you're logged into a workstation,
that's dangerous.
So I just ran that, and I see Jay Wilson here, who's our domain admin.
I can see here that he's got a session, HasSession,
on MEMBER‑2, and he's got a session on MEMBER‑1.
So right there, you know that if you could compromise one of these two servers,
he's got a session.
So his credentials are in memory, and you could then become a domain admin.
So what you could do here is configure these as high value computers.
Now, if I want to look at MEMBER‑2, let's say you want to compromise MEMBER‑2.
Well, I see there's one session on it.
It can reach 11 high value targets.
That's most likely because Jay Wilson is logged into it.
And it's got a few GPOs applied to it.
So I'm going to right‑click it, and I'm going to select Shortest Paths to Here.
This is a much more complete graph.
So if you want to compromise MEMBER‑2, you can use the SYSADMINS group,
which contains Guy Williams, Michelle Morris,
and Stephanie Dodd.
So these are all accounts that you could compromise that
would let you access MEMBER‑2 as an admin,
therefore compromising Jay's session, and he's a domain admin.
So you could configure these as high value users.
They're definitely interesting.
Now, who else is an admin?
Well DOMAIN ADMINS is an admin on MEMBER‑2,
but that's what we're targeting, so in this case,
that's not very interesting.
Now who else seems to have a session?
Karen Field has GenericAll,
which is a permission that essentially says can control
completely the account of Carly Roberts.
So that might mean that Karen is able to reset Carly's password.
But whatever the case is, Karen can take over Carly's account,
and Carly is an admin on MEMBER‑2.
So to compromise Carly, we could compromise Karen.
And if we look at Karen, she has a session on PC‑1.GLOBOMANTICS.COM,
which is a workstation.
Now that workstation is managed by a HELPDESK group that's admin on it.
And we can see that Victoria Cook and Robert McLean
are members of the HELPDESK group, and Robert has a session on PC‑2.
This means that if you could compromise PC‑2,
you could compromise Robert McLane's account,
which through the HELPDESK group will let you log into PC‑1 as a local admin.
Karen has a session on PC‑1.
You can compromise her account and use it to take over Carly Roberts account.
From there,
you'll be able to log into MEMBER‑2 as an admin and take over Jay's account,
and he's a domain admin, so you essentially became domain admin.
Now there's a few very useful things that BloodHound will
provide to you to make that easier.
One thing is right‑clicking on any of these links includes Help.
And in the Help, it will tell you what the information is,
what the name of that connection means,
but it also tells you some information about how you can abuse this permission.
So here it's telling us that you could use Cobalt Strike with psexec,
wmi, and so on.
It also usually has some OPSEC considerations,
telling you how you could be detected if you try to
abuse these different permissions.
It always includes different references for more
reading on how you could compromise this.
The second extremely interesting thing here is the Pathfinding option.
The Pathfinding option lets you specify a start node and a target node,
and it will tell you the shortest path to get there.
Assume you didn't know what we just saw before.
All you know is that you compromised Victoria Cook's account.
We will set her as the Start Node.
And we want to compromise Jay Wilson.
This automatically tells us that using Victoria's account through HELPDESK,
we're admin on PC‑1, on which Karen has a session.
Karen can compromise Carly, Carly is an admin on MEMBER‑2,
and Jay has a session on MEMBER‑2.
So you can save a lot of time.
And these right‑clicks where we configure things as a high value
will also let you configure something as owned.
So assuming we compromise PC‑1, we would right‑click it and mark it as Owned.
That will let BloodHound know that this is a computer that we control.
We can now go back to our default queries and select the Shortest
Paths to Domain Admin from things that we own,
and these things could be accounts or computers.
I'll run this, and it's telling us that if we own this,
we need to compromise Karen's account, Carly's account,
and the MEMBER‑2 server.
So when you run BloodHound in a real environment,
the first thing you should do is mark as owned the accounts and
the computers that you already have access to.
If you run a tool like Responder and you gathered a bunch of credentials,
mark them all as owned because there's no way you can
visualize these types of graphs in your head.
But once you've compromised everything,
using queries with BloodHound will let you get exactly where you need to be.
You might have configured some high value targets.
You have the same types of queries that will let you see the
shortest path to your high value targets.
And in this case,
it's very complicated already because we have a lot of high value targets,
including groups like the administrator groups,
the backup operator groups, and much more.