BloodHound
BloodHound is a powerful tool used by adversaries to visualize and analyze Active Directory relationships, allowing them to quickly identify and exploit potential attack paths and privilege escalation opportunities within a network. It automates the reconnaissance phase of an attack, helping attackers pinpoint weak points and ultimately compromise Active Directory environments.
Ingestion
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nara/bloodhound]
└─$ KRB5CCNAME=../tracy.white@nara.nara-security.com.ccache bloodhound-python -d NARA-SECURITY.COM -u tracy.white -k -no-pass --auth-method kerberos -ns $IP -dc nara.nara-security.com --zip -c Experimental,LoggedOn,All -op python_
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: nara-security.com
INFO: Using TGT from cache
INFO: Found TGT with correct principal in ccache file.
INFO: Connecting to LDAP server: nara.nara-security.com
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: nara.nara-security.com
INFO: Found 14 users
INFO: Found 55 groups
INFO: Found 2 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: Nara.nara-security.com
INFO: User with SID S-1-5-21-914744703-3800712539-3320214069-1113 is logged in on Nara.nara-security.com
INFO: Done in 00M 06S
INFO: Compressing output into 20250701161155_bloodhound.zipUsing the TGT of the compromised tracy.white user, domain ingestion complete.
Preps
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nara/bloodhound]
└─$ neo4j_kickstart
2025-07-01 14:13:07.959+0000 INFO Starting...
2025-07-01 14:13:08.427+0000 INFO This instance is ServerId{823c0986} (823c0986-8860-45ad-af0e-a0f1316bef16)
2025-07-01 14:13:09.535+0000 INFO ======== Neo4j 4.4.26 ========
2025-07-01 14:13:10.428+0000 INFO Performing postInitialization step for component 'security-users' with version 3 and status CURRENT
2025-07-01 14:13:10.429+0000 INFO Updating the initial password in component 'security-users'
2025-07-01 14:13:11.821+0000 INFO Bolt enabled on localhost:7687.
2025-07-01 14:13:12.519+0000 INFO Remote interface available at http://localhost:7474/
2025-07-01 14:13:12.522+0000 INFO id: F22BE6505A50EE3B6AE80482B39DD2B6A7082E68C916A87DF6F1CD7ECA4DD942
2025-07-01 14:13:12.522+0000 INFO name: system
2025-07-01 14:13:12.522+0000 INFO creationDate: 2024-09-01T10:39:20.089Z
2025-07-01 14:13:12.522+0000 INFO Started.
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nara/bloodhound]
└─$ bloodhound-legacyStarting neo4j and bloodhound
/Practice/nara/3-Exploitation/attachments/{75A4046A-7924-4E5A-B04E-498F036B21BA}.png)
Ingested domain data uploaded.
Domain
/Practice/nara/3-Exploitation/attachments/{9BFD45BD-4DE4-4432-8858-A782378A57A0}.png)
/Practice/nara/3-Exploitation/attachments/{6772BA1D-D560-465A-AA90-2F627192081E}.png)
/Practice/nara/3-Exploitation/attachments/{69887BD8-C71E-459D-8A17-966A2072FC83}.png)
tracy.white User
/Practice/nara/3-Exploitation/attachments/{81BB81FB-0AFD-40B3-8F9B-22BF60A48913}.png)
/Practice/nara/3-Exploitation/attachments/{E68B256D-831A-403F-B097-06DB156F99DB}.png)
/Practice/nara/3-Exploitation/attachments/{1193C3A8-705D-40C3-A02C-D51ED1BE363B}.png)
/Practice/nara/3-Exploitation/attachments/{D0ADEC95-9B93-49EE-B1D2-714E313C9118}.png)
The compromised domain user, tracy.white is part of the staff group.
This was also enumerated from ldapdomaindump.
/Practice/nara/3-Exploitation/attachments/{B516D315-F0AF-4732-9824-343E138023ED}.png)
The user also has an on-going session to the DC host; nara.nara-security.com
This was how the user was able to open the phishing payloads.
/Practice/nara/3-Exploitation/attachments/{2B48C3F0-BE2A-4C03-9E43-AFDFFB154C90}.png)
The tracy.white user has GenericAll privilege over the Remote Access group and the Remote OU
Remote Access Group
/Practice/nara/3-Exploitation/attachments/{F0C922D3-6C2C-48EF-A7B2-FDF9907EF123}.png)
/Practice/nara/3-Exploitation/attachments/{A42FCB61-7DD4-4326-A81F-C1443EAA7A97}.png)
/Practice/nara/3-Exploitation/attachments/{AD386A8C-28E5-4E89-9484-EE86D426C702}.png)
jodie.summers is the sole member to the Remote Access group.
/Practice/nara/3-Exploitation/attachments/{3978576E-2CEF-4C3A-8CFD-C674D7D6CAB2}.png)
/Practice/nara/3-Exploitation/attachments/{2319405D-2231-4843-8CCD-370CAD8229F1}.png)
The Remote Access group is part of the Remote Maanagement Users group.
This allows WinRM access to the DC host; nara.nara-security.com(192.168.209.30)