菜单
Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/xalgord/xalgorix --skill conducting-internal-reconnaissance-with-bloodhound-ce命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | conducting-internal-reconnaissance-with-bloodhound-ce |
| description | Conduct internal Active Directory reconnaissance using BloodHound Community Edition to map attack paths, identify privilege escalation chains, and discover misconfigurations in domain environments. |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["red-team","reconnaissance","bloodhound","active-directory","attack-paths","privilege-escalation","graph-analysis"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"] |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
BloodHound Community Edition (CE) is a modern, web-based Active Directory reconnaissance platform developed by SpecterOps that uses graph theory to reveal hidden relationships and attack paths within AD environments. Unlike the legacy BloodHound application, BloodHound CE uses a PostgreSQL backend with a dedicated graph database, providing improved performance, a modern web UI, and enhanced API capabilities. Red teams use BloodHound CE to collect AD objects, ACLs, sessions, group memberships, and trust relationships, then visualize attack paths from compromised low-privileged accounts to high-value targets like Domain Admins. The SharpHound collector (v2 for CE) gathers data from Active Directory, while AzureHound collects from Azure AD / Entra ID environments.
-c All when stealth matters. Full collection touches every host (SMB/session enumeration) and is noisy. Start with -c DCOnly (LDAP-only) for a quiet first pass.-c Session --loop, HasSession edges are stale and the best token-theft paths to DA stay invisible.shortestPath Cypher from an Owned node to DOMAIN ADMINS@... returns at least one path p. A path is only actionable once you've confirmed you hold the entry node and the first edge's primitive is exploitable. Don't conclude "no path to DA exists" until you've run Session-loop collection and custom ACL/DCSync Cypher — built-in queries alone routinely miss the edge.curl -L https://ghst.ly/getbhce -o docker-compose.yml
docker compose pull
docker compose up -d
docker compose logs | grep "Initial Password"
# Execute full collection
.\SharpHound.exe -c All --outputdirectory C:\Temp
# DCOnly collection (LDAP only, stealthier)
.\SharpHound.exe -c DCOnly
# Session collection for logged-on user mapping
.\SharpHound.exe -c Session --loop --loopduration 02:00:00
# Collect from specific domain
.\SharpHound.exe -c All -d child.domain.local
bloodhound-python -u user -p 'Password123' -d domain.local -ns 10.10.10.1 -c All
// Find shortest path from owned principals to Domain Admins
MATCH p=shortestPath((n {owned:true})-[*1..]->(m:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
RETURN p
// Find Kerberoastable users with path to DA
MATCH (u:User {hasspn:true})
MATCH p=shortestPath((u)-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"}))
RETURN p
// Find computers with sessions of DA members
MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})
RETURN c.name, u.name
// Find ACL-based attack paths (GenericAll, WriteDACL, GenericWrite)
MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(t)
WHERE u.owned = true
RETURN p
// Find users who can DCSync
MATCH (u)-[:MemberOf*0..]->()-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)
RETURN u.name, d.name
// Find computers with LAPS but readable by non-admins
MATCH (c:Computer {haslaps:true})
MATCH p=(u:User)-[:ReadLAPSPassword]->(c)
RETURN p
| Tool | Purpose | Platform |
|---|---|---|
| BloodHound CE | Web-based graph analysis platform | Docker |
| SharpHound v2 | AD data collection (.NET, for CE) | Windows |
| BloodHound.py | AD data collection (Python) | Linux |
| AzureHound | Azure AD / Entra ID data collection | Cross-platform |
| PlumHound | Automated BloodHound reporting | Python |
| BloodHound Query Library | Community Cypher query repository | Web |
| Path Type | Description | Example |
|---|---|---|
| ACL Abuse | Exploit misconfigured ACLs | GenericAll on DA group |
| Kerberoasting | Crack service account passwords | SPN account → DA |
| AS-REP Roasting | Attack accounts without pre-auth | No-preauth user → password crack |
| Delegation Abuse | Exploit unconstrained/constrained delegation | Computer → impersonate DA |
| GPO Abuse | Modify GPOs applied to privileged OUs | GPO write → code execution on DA |
| Session Hijack | Leverage DA sessions on compromised hosts | Admin session → token theft |