Pentesting.Site - BloodHound Cheat Sheet

BloodHound is a powerful and popular security tool designed to analyze and visualize Active Directory (AD) environments. It is used by both attackers and defenders to identify and understand complex relationships and attack paths within AD. The primary goal of BloodHound is to help security professionals discover hidden and often overlooked attack vectors that could be exploited to escalate privileges and move laterally within a network.

Download BloodHound Download Collectors Download Neo4j Desktop

BloodHound Collection Methods

BloodHound uses SharpHound to collect data from an Active Directory environment. The collection methods are executed via SharpHound, typically in PowerShell or a command-line environment.

1
Invoke-BloodHound -CollectionMethod All           #Collects all data
2
Invoke-BloodHound -CollectionMethod Default       #Default collection methods
3
Invoke-BloodHound -CollectionMethod Group         #Collects group memberships
4
Invoke-BloodHound -CollectionMethod LocalGroup    #Collects local group memberships
5
Invoke-BloodHound -CollectionMethod Session       #Collects active sessions
6
Invoke-BloodHound -CollectionMethod Trusts        #Collects domain trusts
7
Invoke-BloodHound -CollectionMethod ACL           #Collects ACL information
8
Invoke-BloodHound -CollectionMethod ObjectProps   #Collects object properties
9
Invoke-BloodHound -CollectionMethod Container     #Collects container information
10
Invoke-BloodHound -CollectionMethod RDP           #Collects RDP sessions
11
Invoke-BloodHound -CollectionMethod DCOM          #Collects DCOM object information
12
Invoke-BloodHound -CollectionMethod PSRemote      #Collects PowerShell remoting sessions

SharpHound Collector Options

1
Invoke-BloodHound -Domain example.com                 #Specifies the target domain
2
Invoke-BloodHound -LDAPUser username                  #LDAP username for authentication
3
Invoke-BloodHound -LDAPPass password                  #LDAP password for authentication
4
Invoke-BloodHound -SkipPortScan                       #Skips the port scanning phase
5
Invoke-BloodHound -NoSaveCache                        #Does not save the cache to disk
6
Invoke-BloodHound -Throttle 2000                      #Adds a delay (in milliseconds) between each request
7
Invoke-BloodHound -RandomDelay                        #Adds a random delay between requests to avoid detection
8
Invoke-BloodHound -Stealth                            #Uses stealth collection methods to avoid detection
9
Invoke-BloodHound -LdapOnly                           #Collects only LDAP information
10
Invoke-BloodHound -CSVFolder C:\path\to\folder        #Specifies the folder to save CSV files
11
Invoke-BloodHound -ZipFileName C:\path\to\output.zip  #Specifies the name of the output ZIP file

Python BloodHound Collection Methods

1
bloodhound-python -d example.com -u username -p password      #Specifies the target domain and credentials
2
bloodhound-python -dc dc.example.com                          #Specifies a specific Domain Controller to query
3
bloodhound-python -c All                                      #Collects all data (default)
4
bloodhound-python -c Computers,Users,Groups                   #Collects specific object types (comma-separated)
5
bloodhound-python -g                                          #Retrieves group memberships
6
bloodhound-python -acls                                       #Collects ACL (Access Control List) information
7
bloodhound-python --ldap                                      #Uses LDAP only (no SMB or DCOM)
8
bloodhound-python -ip 10.1.1.1                                #Uses a specific Domain Controller by IP
9
bloodhound-python -o output.zip                               #Specifies the output ZIP file
10
bloodhound-python --disable-pooling                           #Disables connection pooling for stealthier queries
11
bloodhound-python --kerberos                                  #Uses Kerberos authentication (TGT required)
12
bloodhound-python --hashes NTLM_HASH                          #Uses an NTLM hash instead of a plaintext password
13
bloodhound-python --json                                      #Outputs results in JSON format instead of ZIP
14
bloodhound-python --zip                                       #Forces ZIP output format

The combined full command I use is

1
bloodhound-python -u username -p password -c All --zip -d hacker.com -dc dc.hacker.com -ns 10.1.1.1 -gc dc.hack.com --auth-method ntlm

AzureHound

AzureHound is the Azure AD ingestor for BloodHound, used to collect information about Azure AD users, roles, groups, applications, and attack paths.

Install and Import

1
Install-Module -name Az -AllowClobber
2
Install-Module -name AzureADPreview -AllowClobber
3
Connect-AzureAD                                              #Enter details on popup
4
Connect-AzAccount                                            #Enter details on popup or select signed in account
5

6
Import-Module .\AzureHound.ps1
7
Invoke-AzureHound

AzureHound Commands

1
Invoke-AzureHound -CollectionMethod All                                                                  #Collects all available Azure data
2
Invoke-AzureHound -CollectionMethod Default                                                              #Uses default collection methods
3
Invoke-AzureHound -CollectionMethod Users                                                                #Collects all Azure AD users
4
Invoke-AzureHound -CollectionMethod Groups                                                                #Collects Azure AD groups
5
Invoke-AzureHound -CollectionMethod Roles                                                                 #Collects Azure AD roles and role assignments
6
Invoke-AzureHound -CollectionMethod ServicePrincipals                                                      #Collects Azure AD service principals
7
Invoke-AzureHound -CollectionMethod Applications                                                          #Collects Azure AD applications
8
Invoke-AzureHound -CollectionMethod Devices                                                               #Collects registered Azure AD devices
9
Invoke-AzureHound -CollectionMethod Subscriptions                                                         #Collects Azure subscriptions and permissions
10
Invoke-AzureHound -CollectionMethod ResourceGroups                                                        #Collects Azure resource groups
11
Invoke-AzureHound -CollectionMethod VMInstances                                                           #Collects Azure Virtual Machine instances
12
Invoke-AzureHound -CollectionMethod KeyVaults                                                             #Collects Azure Key Vault information
13
Invoke-AzureHound -CollectionMethod StorageAccounts                                                       #Collects Azure Storage Account permissions
14
Invoke-AzureHound -CollectionMethod Networks                                                              #Collects Azure virtual networks and security groups
15
Invoke-AzureHound -Tenant example.onmicrosoft.com                                                         #Specifies the target Azure AD tenant
16
Invoke-AzureHound -AccessToken YOUR_ACCESS_TOKEN                                                          #Uses a provided Azure AD access token for authentication
17
Invoke-AzureHound -ClientID YOUR_CLIENT_ID                                                                #Uses a specific Azure AD client ID for authentication
18
Invoke-AzureHound -ClientSecret YOUR_CLIENT_SECRET                                                        #Uses a client secret for authentication
19
Invoke-AzureHound -RefreshToken YOUR_REFRESH_TOKEN                                                        #Uses a refresh token for authentication
20
Invoke-AzureHound -NoSaveCache                                                                            #Does not save the cache to disk
21
Invoke-AzureHound -Throttle 2000                                                                          #Adds a delay (in milliseconds) between each request
22
Invoke-AzureHound -RandomDelay                                                                            #Adds a random delay between requests to avoid detection
23
Invoke-AzureHound -Stealth                                                                                #Uses stealth collection methods to avoid detection
24
Invoke-AzureHound -OutputDirectory C:\path\to\folder                                                      #Specifies the folder to save collected data
25
Invoke-AzureHound -ZipFileName C:\path\to\output.zip                                                      #Specifies the name of the output ZIP file
26
Invoke-AzureHound -Throttle 5000 -RandomDelay                                                             #Slows down queries to evade detection
27
Invoke-AzureHound -CollectionMethod All -Tenant example.onmicrosoft.com -AccessToken YOUR_ACCESS_TOKEN    #Collects all available Azure AD data while authenticating with an access token

Using SharpHound in Different Environments

Powershell

1
Import-Module .\SharpHound.ps1
2
Invoke-BloodHound -CollectionMethod All -Domain example.com -LDAPUser user@example.com -LDAPPass password  #Collects all available data while authenticating with an LDAP username and password
3
Invoke-BloodHound -CollectionMethod All                                                                    #Collects all available data
4
Invoke-BloodHound -CollectionMethod Default                                                                #Uses default collection methods
5
Invoke-BloodHound -CollectionMethod Group                                                                  #Collects group memberships
6
Invoke-BloodHound -CollectionMethod LocalGroup                                                             #Collects local group memberships
7
Invoke-BloodHound -CollectionMethod Session                                                                #Collects active sessions
8
Invoke-BloodHound -CollectionMethod Trusts                                                                 #Collects domain trusts
9
Invoke-BloodHound -CollectionMethod ACL                                                                    #Collects ACL (Access Control List) information
10
Invoke-BloodHound -CollectionMethod ObjectProps                                                            #Collects object properties
11
Invoke-BloodHound -CollectionMethod Container                                                              #Collects container information
12
Invoke-BloodHound -CollectionMethod RDP                                                                    #Collects RDP session data
13
Invoke-BloodHound -CollectionMethod DCOM                                                                   #Collects Distributed COM object data
14
Invoke-BloodHound -CollectionMethod PSRemote                                                               #Collects PowerShell remoting session data
15
Invoke-BloodHound -Domain example.com                                                                      #Specifies the target domain
16
Invoke-BloodHound -LDAPUser user@example.com                                                               #LDAP username for authentication
17
Invoke-BloodHound -LDAPPass password                                                                       #LDAP password for authentication
18
Invoke-BloodHound -SkipPortScan                                                                            #Skips the port scanning phase
19
Invoke-BloodHound -NoSaveCache                                                                             #Does not save the cache to disk
20
Invoke-BloodHound -Throttle 2000                                                                           #Adds a delay (in milliseconds) between each request
21
Invoke-BloodHound -RandomDelay                                                                             #Adds a random delay between requests to avoid detection
22
Invoke-BloodHound -Stealth                                                                                 #Uses stealth collection methods to avoid detection
23
Invoke-BloodHound -LdapOnly                                                                                #Collects only LDAP information
24
Invoke-BloodHound -CSVFolder C:\path\to\folder                                                             #Specifies the folder to save CSV files
25
Invoke-BloodHound -ZipFileName C:\path\to\output.zip                                                       #Specifies the name of the output ZIP file

Command Line (SharpHound.exe)

1
SharpHound.exe -c All -d example.com -u user@example.com -p password    #Collects all available data while authenticating with a username and password
2
SharpHound.exe -c All                                                   #Collects all available data
3
SharpHound.exe -c Default                                               #Uses default collection methods
4
SharpHound.exe -c Computers,Users,Groups                                #Collects specific object types (comma-separated)
5
SharpHound.exe -c LocalAdmin,Session,Trusts                             #Collects local admin, session, and trust data
6
SharpHound.exe -d example.com                                           #Specifies the target domain
7
SharpHound.exe -u user@example.com -p password                          #Specifies credentials for authentication
8
SharpHound.exe -u user@example.com --hashes NTLM_HASH                   #Uses an NTLM hash instead of a plaintext password
9
SharpHound.exe -DomainController dc.example.com                         #Uses a specific Domain Controller
10
SharpHound.exe -ldaponly                                                #Uses only LDAP queries (stealth mode)
11
SharpHound.exe -acls                                                    #Collects ACL (Access Control List) information
12
SharpHound.exe -Stealth                                                 #Uses stealthy collection techniques
13
SharpHound.exe -Throttle 2000                                           #Adds a delay (milliseconds) between each request
14
SharpHound.exe -RandomDelay                                             #Adds a random delay between requests
15
SharpHound.exe -NoSaveCache                                             #Prevents cache from being saved to disk
16
SharpHound.exe -SkipPortScan                                            #Skips the port scanning phase
17
SharpHound.exe -JSON                                                    #Outputs results in JSON format
18
SharpHound.exe -ZipFileName C:\path\to\output.zip                       #Specifies the name of the output ZIP file
19
SharpHound.exe -OutputDirectory C:\path\to\folder                       #Specifies the folder to save output files
20
SharpHound.exe -CollectMethod DCOM,PSRemote,RDP                         #Collects specific remote access data

BloodHound GUI

BloodHound itself is a graphical interface to visualize the collected data. Once the data is collected using SharpHound, it can be uploaded and analyzed in the BloodHound interface.

Running BloodHound

1
neo4j console   #Starts the Neo4j database
2
     or
3
neo4j desktop
4
bloodhound       #Launches the BloodHound GUI

Neo4j Database Management

Starting Neo4j

1
neo4j console

Stopping Neo4j

1
neo4j stop

Checking Neo4j Status

1
neo4j status

BloodHound Data Import

Open the BloodHound interface. Use the “Upload Data” button in the GUI to import data collected by SharpHound.

Common Queries in BloodHound

BloodHound provides predefined queries to analyze the data. Here are a few examples:

Find all Domain Admins
Find shortest paths to Domain Admins
Identify users with unconstrained delegation
Detect computers with local admin rights
Analyze Kerberos delegation

Custom Queries in BloodHound

1
#Return all users of a specific group
2
MATCH (g:Group {name: 'IT USERS@HACKER.COM'})<-[:MemberOf]-(u:User) RETURN u.name AS UserName
3

4
#Return users with keyword in description
5
MATCH (u:User) WHERE u.description CONTAINS "pass" return u.name, u.displayname, u.description, u.group
6

7
#Gets all owned users in the specified group
8
MATCH (g:Group {name: 'VPN ACCESS GROUP@HACKER.COM'})<--(u:User) WHERE u.owned = true RETURN u.name AS OwnedUser, u.objectid AS ObjectID, g.name AS GroupName
9

10
#Gets all machines that a specific AD group is local Admin to
11
MATCH (g:Group {name: 'DOMAIN USERS@HACKER.COM'})-[:AdminTo]->(c:Computer) RETURN g.name AS GroupName, c.name AS ComputerName
12

13
#Find users with empty passwords
14
MATCH (n:User {enabled: True, passwordnotreqd: True}) RETURN n
15

16
#Find users with descriptions and display them
17
MATCH (c:User) WHERE c.description IS NOT NULL RETURN c.name,c.description
18

19
#Find computers with descriptions and display them
20
MATCH (c:Computer) WHERE c.description IS NOT NULL RETURN c.name,c.description
21

22
#Get all users and their emails from Bloodhound
23
In neo4j desktop browser
24
MATCH (u:User) RETURN u.name
25
MATCH (u:User) RETURN u.email
26
download as CSV
27

28
#Get all domain admins from Bloodhound
29
In neo4j desktop browser
30
MATCH (u:User)-[:MemberOf]->(g:Group {name: 'DOMAIN ADMINS@HACKER.LOCAL'})
31
RETURN u.name
32
download as CSV

Additional SharpHound Collection Scenarios

1
SharpHound.exe -c Group -d example.com -u user@example.com -p password            #Collecting Group Memberships Only
2
SharpHound.exe -c Session -d example.com -u user@example.com -p password          #Collecting Sessions Only
3
SharpHound.exe -c All -d example.com -u user@example.com -p password --Stealth    #Using Stealth Mode

Full SharpHound Command Syntax

1
SharpHound.exe -c <CollectionMethod> -d <Domain> -u <Username> -p <Password> --SkipPortScan --NoSaveCache --Throttle <Milliseconds> --RandomDelay --Stealth --LdapOnly --CSVFolder <FolderPath> --ZipFileName <ZipFileName>