Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-25 14:10:41 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/windows-hardening/active-directory-methodology/bloodhound.md
Translator workflow b442ae90c4 Translated to Klingon
2024-02-10 17:52:19 +00:00

7.4 KiB
Raw Permalink Blame History

BloodHound & Other AD Enum Tools

htARTE (HackTricks AWS Red Team Expert) !HackTricks AWS Red Team Expert!

AD Explorer

AD Explorer is from Sysinternal Suite:

An advanced Active Directory (AD) viewer and editor. You can use AD Explorer to navigate an AD database easily, define favourite locations, view object properties, and attributes without opening dialog boxes, edit permissions, view an object's schema, and execute sophisticated searches that you can save and re-execute.

Snapshots

AD Explorer can create snapshots of an AD so you can check it offline.
It can be used to discover vulns offline, or to compare different states of the AD DB across the time.

You will be requires the username, password, and direction to connect (any AD user is required).

To take a snapshot of AD, go to File --> Create Snapshot and enter a name for the snapshot.

ADRecon

ADRecon is a tool which extracts and combines various artefacts out of an AD environment. The information can be presented in a specially formatted Microsoft Excel report that includes summary views with metrics to facilitate analysis and provide a holistic picture of the current state of the target AD environment.

# Run it
.\ADRecon.ps1

BloodHound

From https://github.com/BloodHoundAD/BloodHound

BloodHound is a single page Javascript web application, built on top of Linkurious, compiled with Electron, with a Neo4j database fed by a C# data collector.

BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory or Azure environment. Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify. Defenders can use BloodHound to identify and eliminate those same attack paths. Both blue and red teams can use BloodHound to easily gain a deeper understanding of privilege relationships in an Active Directory or Azure environment.

So, Bloodhound is an amazing tool which can enumerate a domain automatically, save all the information, find possible privilege escalation paths and show all the information using graphs.

Booldhound is composed of 2 main parts: ingestors and the visualisation application.

The ingestors are used to enumerate the domain and extract all the information in a format that the visualisation application will understand.

The visualisation application uses neo4j to show how all the information is related and to show different ways to escalate privileges in the domain.

Installation

After the creation of BloodHound CE, the entire project was updated for ease of use with Docker. The easiest way to get started is to use its pre-configured Docker Compose configuration.

  1. Install Docker Compose. This should be included with the Docker Desktop installation.
  2. Run:
curl -L https://ghst.ly/getbhce | docker compose -f - up

  1. Docker Compose-ghItlh vItlhutlhlaHchugh, terminal output Daq password randomly generated vItlhutlhlaHchugh.

  2. browser, http://localhost:8080/ui/login Daq navigatelnIS. admin username 'ej randomly generated password logs Daq login.

vaj password randomly generated vItlhutlhlaHchugh 'ej vItlhutlhlaHchugh, 'ej vaj interface new ready, 'ej directly download ingestors vItlhutlhlaHchugh.

SharpHound

They have several options but if you want to run SharpHound from a PC joined to the domain, using your current user and extract all the information you can do:

./SharpHound.exe --CollectionMethods All
Invoke-BloodHound -CollectionMethod All

CollectionMethod 'e' vItlhutlh 'ej loop session qaStaHvIS Daq.

vaj SharpHound vItlhutlh credentials different execute 'ej CMD netonly session create 'ej SharpHound run vItlhutlh:

runas /netonly /user:domain\user "powershell.exe -exec bypass"

Qa'vIn ired.team. Bloodhound

Group3r

Group3r vItlhutlh vulnerabilities Active Directory associated Group Policy.
run group3r vItlhutlh host domain user.

group3r.exe -f <filepath-name.log>
# -s sends results to stdin
# -f send results to file

PingCastle

PingCastle evaluates the security posture of an AD environment and provides a nice report with graphs.

To run it, can execute the binary PingCastle.exe and it will start an interactive session presenting a menu of options. The default option to use is healthcheck which will establish a baseline overview of the domain, and find misconfigurations and vulnerabilities.

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!