Conducting Internal Reconnaissance With Bloodhound Ce

Conducting Internal Reconnaissance with BloodHound CE

Overview

BloodHound Community Edition (CE) is a modern, web-based Active Directory reconnaissance platform developed by SpecterOps that uses graph theory to reveal hidden relationships and attack paths within AD environments. Unlike the legacy BloodHound application, BloodHound CE uses a PostgreSQL backend with a dedicated graph database, providing improved performance, a modern web UI, and enhanced API capabilities. Red teams use BloodHound CE to collect AD objects, ACLs, sessions, group memberships, and trust relationships, then visualize attack paths from compromised low-privileged accounts to high-value targets like Domain Admins. The SharpHound collector (v2 for CE) gathers data from Active Directory, while AzureHound collects from Azure AD / Entra ID environments.

Objectives

• Deploy BloodHound CE server using Docker Compose
• Collect AD data using SharpHound v2 or BloodHound.py
• Import collected data into BloodHound CE for graph analysis
• Identify shortest attack paths from owned principals to Domain Admins
• Discover ACL-based attack paths, Kerberoastable accounts, and delegation abuse
• Execute custom Cypher queries for advanced attack path analysis
• Generate attack path reports for engagement documentation

MITRE ATT&CK Mapping

• T1087.002 - Account Discovery: Domain Account
• T1069.002 - Permission Groups Discovery: Domain Groups
• T1482 - Domain Trust Discovery
• T1615 - Group Policy Discovery
• T1018 - Remote System Discovery
• T1033 - System Owner/User Discovery
• T1016 - System Network Configuration Discovery

Implementation Steps

Phase 1: BloodHound CE Deployment

1. Deploy BloodHound CE using Docker Compose:

   curl -L https://ghst.ly/getbhce -o docker-compose.yml
   docker compose pull
   docker compose up -d
   

2. Access the web interface at https://localhost:8080
3. Log in with the default admin credentials (displayed in Docker logs):

   docker compose logs | grep "Initial Password"
   

4. Change the default admin password immediately

Phase 2: Data Collection with SharpHound v2

1. Transfer SharpHound v2 to the compromised Windows host:

   # Execute full collection
   .\SharpHound.exe -c All --outputdirectory C:\Temp
   
   # DCOnly collection (LDAP only, stealthier)
   .\SharpHound.exe -c DCOnly
   
   # Session collection for logged-on user mapping
   .\SharpHound.exe -c Session --loop --loopduration 02:00:00
   
   # Collect from specific domain
   .\SharpHound.exe -c All -d child.domain.local
   

2. Alternative: Use BloodHound.py from Linux:

   bloodhound-python -u user -p 'Password123' -d domain.local -ns 10.10.10.1 -c All
   

3. Exfiltrate the generated ZIP file to the analysis workstation

Phase 3: Data Import and Initial Analysis

1. Upload collected data via the BloodHound CE web interface (File Ingest)
2. Mark compromised accounts as "Owned" in the interface
3. Run built-in analysis queries:
   • Shortest Path to Domain Admin
   • Kerberoastable Users with Path to DA
   • AS-REP Roastable Users
   • Users with DCSync Rights
   • Computers with Unconstrained Delegation

Phase 4: Custom Cypher Queries

1. Execute custom Cypher queries in the BloodHound CE search bar:

   // Find shortest path from owned principals to Domain Admins
   MATCH p=shortestPath((n {owned:true})-[*1..]->(m:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
   RETURN p
   
   // Find Kerberoastable users with path to DA
   MATCH (u:User {hasspn:true})
   MATCH p=shortestPath((u)-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
   RETURN p
   
   // Find computers with sessions of DA members
   MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
   RETURN c.name, u.name
   
   // Find ACL-based attack paths (GenericAll, WriteDACL, GenericWrite)
   MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(t)
   WHERE u.owned = true
   RETURN p
   
   // Find users who can DCSync
   MATCH (u)-[:MemberOf*0..]->()-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)
   RETURN u.name, d.name
   
   // Find computers with LAPS but readable by non-admins
   MATCH (c:Computer {haslaps:true})
   MATCH p=(u:User)-[:ReadLAPSPassword]->(c)
   RETURN p
   

Phase 5: Attack Path Prioritization

1. Score identified attack paths by:
   • Number of hops (shorter = higher priority)
   • Stealth requirements (avoid noisy techniques)
   • Tool availability for each hop
   • Likelihood of detection at each step
2. Create an execution plan for the highest-priority paths
3. Identify required tools for each step in the chain
4. Plan OPSEC considerations for each technique

Tools and Resources

Key Attack Path Types

Validation Criteria

• BloodHound CE deployed and accessible
• SharpHound v2 data collected from all domains in scope
• Data successfully imported into BloodHound CE
• Owned principals marked in the interface
• Shortest paths to Domain Admin identified
• ACL-based attack paths documented
• Kerberoastable and AS-REP roastable accounts listed
• Custom Cypher queries executed for advanced analysis
• Attack paths prioritized by feasibility and stealth
• Report generated with all identified paths and evidence