Bloodhound

Steps:

From the target machine:

1)

  Sharphound.exe --CollectionMethods METHODS (Default all) --Domain DOMAIN --ExcludeDCs

OR in case the above command doesn't work, try to use SharpHound via LDAP credentials

 .\SharpHound.exe --outputdirectory c:\temp --ldapusername USERNAME --ldappassword PASS

2) Collect Bloodhound.zip file

From attacking machine:

1)

  sudo neo4j console start

2)

  bloodhound --no-sandbox

3) Use default credentials (neo4j:neo4j) Or you can go to http://localhost:7474 to change default credentials

4) Drag and drop zip file in Bloodhound GUI

5) EZ ENUMERATION!1!1!!!1!

BENEFITS

1) GUI

2) Shows attack paths

3) More profound insights into AD Objects

DRAWBACKS

1) Requires Sharphound which is VERY noisy

USAGE OF BLOODHOUND REMOTELY

1)

  bloodhound-python -d DOMAIN.LOCAL -u 'USER' -p 'PASSWORD -dc DC.DOMAIN.LOCAL -c all -ns IP --zip

TIP: If you receive DNS errors, you can set up a fake DNS server with the DNSChef tool https://github.com/iphelix/dnschef

2)

  python3 dnschef.py --fakeip TARGET_IP --nameserver TARGET_IP

3)

  bloodhound-python -d DOMAIN.LOCAL -u 'USER' -p 'PASSWORD' -dc DC.DOMAIN.LOCAL -c all -ns 127.0.0.1

BLOODHOUND CYPHER QUERIES CHEATSHEET

https://raw.githubusercontent.com/LuemmelSec/Custom-BloodHound-Queries/main/README.md