Bloodhound-Sharphound

Steps:

From the target machine:

1)

Sharphound.exe --CollectionMethods METHODS (Default all) --Domain DOMAIN --ExcludeDCs

2) Collect Bloodhound.zip file

From attacking machine:

1)

sudo neo4j console start

2)

bloodhound --no-sandbox

3) Use default credentials (neo4j:neo4j) Or you can go to http://localhost:7474 to change default credentials

4) Drag and drop zip file in Bloodhound GUI

5) EZ ENUMERATION!1!1!!!1!

BENEFITS

1) GUI

2) Shows attack paths

3) More profound insights into AD Objects

DRAWBACKS

1) Requires Sharphound which is VERY noisy

USAGE OF BLOODHOUND REMOTELY

1)

bloodhound-python -d DOMAIN.LOCAL -u 'USER' -p 'PASSWORD -dc DC.DOMAIN.LOCAL -c all

TIP: If you receive DNS errors, you can set up a fake DNS server with the DNSChef tool https://github.com/iphelix/dnschef

2)

python3 dnschef.py --fakeip TARGET_IP --nameserver TARGET_IP

3)

bloodhound-python -d DOMAIN.LOCAL -u 'USER' -p 'PASSWORD' -dc DC.DOMAIN.LOCAL -c all -ns 127.0.0.1