What is this tool?

BloodHound has been developed by SpecterOps as a way to visualize relationships between objects in AD. Because of the scale and complexity of most AD networks, manually auditing these relationships is a nightmare. Instead, the original BloodHound relied on Neo4j’s Graph Theory to visualize this information to escalate between objects.

There are currently three versions of BloodHound you need to know about:

• BloodHound Legacy: The original BloodHound, no longer supported. Built on an Electron-based application, somewhat complicated to set up.
• BloodHound Community Edition: Released in August 2023, actively supported. Leverages docker compose to manage a set of containers, exceptionally easy to deploy. Smooth web application interface.
• BloodHound Enterprise: Paid version of BloodHound for attack path management. The major difference is that this version is used for risk management and validation.

The Collector

We need to gather the data from the AD environment in order to feed it into BloodHound for analysis. There are two major collectors you need to know about:

• **SharpHound:** This is the officially supported collector tool for BloodHound, written in C#. Must be run from a Windows-based PC connected to the domain in order to collect the information.
• BloodHound.py: A community driven python script used to collect AD data. Can be run from a Linux-based machine, such as a Raspberry Pi. Excellent use-case for a pentesting dropbox.

It’s important to realize that at the time of this writing, bloodhound.py does not natively support BloodHound-CE.

⚠️You must use the bloodhound-ce branch of the bloodhound.pypython collector if you choose to use this. We cannot mix legacy collectors with Community Edition collectors — this will cause the ingest to fail (and it’s frustrating!).

pipx install bloodhound-ce

Usage

Enumerate infos abount AD domain:

bloodhound-ce-python -d <DOMAIN.LOCAL> -c All -u '[email protected]' -p 'password' -ns <nameserver IP of domain> --zip

Enumerate infos passing through a Forest/Domain Trust between Domain A and Domain B:

bloodhound-ce-python -d <DOMAIN_B.LOCAL> -c All -u 'user@DOMAIN_A.LOCAL' -p 'password' -ns <nameserver IP of domain B> --zip

Installation

Download BloodHound CE using Docker: