conducting-internal-reconnaissance-with-bloodhound-ce

Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.

Zur Installation springen

Repository: autohandai/community-skills
Letzte Quellaktivität: 16. März 2026 um 00:59
Erkannte Sprache von SKILL.md: Englisch
Sterne: 10
Forks: 3

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/autohandai/community-skills --skill conducting-internal-reconnaissance-with-bloodhound-ce

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Datei-Explorer

8 Dateien

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

Deploy BloodHound CE using Docker Compose:

curl -L https://ghst.ly/getbhce -o docker-compose.yml
docker compose pull
docker compose up -d

Access the web interface at https://localhost:8080
Log in with the default admin credentials (displayed in Docker logs):
```
docker compose logs | grep "Initial Password"
```
Change the default admin password immediately

Transfer SharpHound v2 to the compromised Windows host:

# Execute full collection
.\SharpHound.exe -c All --outputdirectory C:\Temp

# DCOnly collection (LDAP only, stealthier)
.\SharpHound.exe -c DCOnly

# Session collection for logged-on user mapping
.\SharpHound.exe -c Session --loop --loopduration 02:00:00

# Collect from specific domain
.\SharpHound.exe -c All -d child.domain.local

Alternative: Use BloodHound.py from Linux:

bloodhound-python -u user -p 'Password123' -d domain.local -ns 10.10.10.1 -c All

Exfiltrate the generated ZIP file to the analysis workstation

Execute custom Cypher queries in the BloodHound CE search bar:

// Find shortest path from owned principals to Domain Admins
MATCH p=shortestPath((n {owned:true})-[*1..]->(m:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
RETURN p

// Find Kerberoastable users with path to DA
MATCH (u:User {hasspn:true})
MATCH p=shortestPath((u)-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
RETURN p

// Find computers with sessions of DA members
MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
RETURN c.name, u.name

// Find ACL-based attack paths (GenericAll, WriteDACL, GenericWrite)
MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(t)
WHERE u.owned = true
RETURN p

// Find users who can DCSync
MATCH (u)-[:MemberOf*0..]->()-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)
RETURN u.name, d.name

// Find computers with LAPS but readable by non-admins
MATCH (c:Computer {haslaps:true})
MATCH p=(u:User)-[:ReadLAPSPassword]->(c)
RETURN p

Tool	Purpose	Platform
BloodHound CE	Web-based graph analysis platform	Docker
SharpHound v2	AD data collection (.NET, for CE)	Windows
BloodHound.py	AD data collection (Python)	Linux
AzureHound	Azure AD / Entra ID data collection	Cross-platform
PlumHound	Automated BloodHound reporting	Python
BloodHound Query Library	Community Cypher query repository	Web

Path Type	Description	Example
ACL Abuse	Exploit misconfigured ACLs	GenericAll on DA group
Kerberoasting	Crack service account passwords	SPN account → DA
AS-REP Roasting	Attack accounts without pre-auth	No-preauth user → password crack
Delegation Abuse	Exploit unconstrained/constrained delegation	Computer → impersonate DA
GPO Abuse	Modify GPOs applied to privileged OUs	GPO write → code execution on DA
Session Hijack	Leverage DA sessions on compromised hosts	Admin session → token theft

name	conducting-internal-reconnaissance-with-bloodhound-ce
description	Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","reconnaissance","bloodhound","active-directory","attack-paths","privilege-escalation","graph-analysis"]
version	1.0
author	mahipal
license	Apache-2.0

name	conducting-internal-reconnaissance-with-bloodhound-ce
description	Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","reconnaissance","bloodhound","active-directory","attack-paths","privilege-escalation","graph-analysis"]
version	1.0
author	mahipal
license	Apache-2.0

conducting-internal-reconnaissance-with-bloodhound-ce

Installationsoptionen

Quelldateien prüfen