WEBVTT 00:00:03.740 --> 00:00:05.390 In this Red Team tools course, 00:00:05.530 --> 00:00:08.480 we'll see how we can perform discovery with BloodHound. 00:00:09.340 --> 00:00:12.700 BloodHound is an open source tool that leverages the power of 00:00:12.710 --> 00:00:16.149 graphs to let you visualize your active directory. 00:00:17.480 --> 00:00:20.700 It was created by @_wald0, @CptJesus, and @harmj0y, 00:00:20.710 --> 00:00:21.850 and is still maintained by them. 00:00:22.640 --> 00:00:27.000 BloodHound allows you to find complex paths to your objective easily. 00:00:27.440 --> 00:00:32.490 BloodHound is a single page JavaScript web application that is built on Neo4j, 00:00:32.500 --> 00:00:33.850 which is a graph database. 00:00:34.270 --> 00:00:37.190 It allows you to visualize and find the complex attack paths 00:00:37.200 --> 00:00:39.250 using the power of that graph database. 00:00:39.640 --> 00:00:42.350 It's available on GitHub at that link right here. 00:00:42.980 --> 00:00:46.080 And it's the only open source tool that leverages the power of 00:00:46.080 --> 00:00:49.450 graphs to find attack paths in active directory. 00:00:50.440 --> 00:00:54.930 On the attack kill chain, you'll see that BloodHound is a post exploitation tool. 00:00:55.110 --> 00:00:57.220 It's a discovery tool that you need to run from a 00:00:57.220 --> 00:00:59.820 compromised computer that's on the domain. 00:01:00.170 --> 00:01:02.850 It's not an escalation or a lateral movement tool, 00:01:02.970 --> 00:01:05.150 but it will give you so much information you'll be 00:01:05.150 --> 00:01:07.220 able to perform both with ease, 00:01:07.420 --> 00:01:10.850 simply thanks to all the information that BloodHound will provide you. 00:01:11.440 --> 00:01:15.160 If we look at MITRE ATT&CK, BloodHound maps to a few different tactics. 00:01:16.470 --> 00:01:20.890 It is essentially a discovery tool. In terms of discovery, there's different 00:01:20.890 --> 00:01:24.200 techniques that BloodHound covers like account discovery, 00:01:24.940 --> 00:01:29.400 permission groups discovery, and system owner and user discovery. 00:01:29.700 --> 00:01:32.810 These are only a few of the things that BloodHound is able to 00:01:32.810 --> 00:01:36.040 gather, but what's even more powerful about BloodHound is not 00:01:36.040 --> 00:01:37.630 just the information that it gets. 00:01:37.770 --> 00:01:40.350 Anyone can connect over LDAP and download similar 00:01:40.350 --> 00:01:41.930 information from active directory. 00:01:42.250 --> 00:01:45.350 It's the way that it will present that information to you, 00:01:45.530 --> 00:01:47.650 making it extremely easy to use. 00:01:48.980 --> 00:01:49.950 So how does it work? 00:01:50.440 --> 00:01:51.860 Well, imagine you have a domain. 00:01:52.440 --> 00:01:55.050 That domain is managed by the domain admins group. 00:01:55.860 --> 00:01:59.660 That domain admins group contains the sysadmins group. 00:01:59.990 --> 00:02:04.880 So we have a nested group. And Mike is a member of the sysadmins group. 00:02:05.380 --> 00:02:07.960 So you might think, well, that's simple enough, right? 00:02:07.980 --> 00:02:10.220 I should just compromise Mike's account and I'll be 00:02:10.220 --> 00:02:11.570 able to compromise the domain. 00:02:12.340 --> 00:02:15.140 But maybe Mike's account is going to be hard to compromise, 00:02:15.450 --> 00:02:16.630 and in reality, 00:02:16.700 --> 00:02:19.810 the nested groups are going to be much more complex than a 00:02:19.810 --> 00:02:23.800 simple two group chain like this one. So if Mike's account 00:02:23.800 --> 00:02:26.360 is really hard to compromise, how would we go about this? 00:02:26.550 --> 00:02:30.290 Well, what if Mike was logged into a laptop? 00:02:30.300 --> 00:02:32.050 You might want to compromise that laptop. 00:02:32.140 --> 00:02:33.110 How would you do that? 00:02:33.340 --> 00:02:33.790 Well, 00:02:33.800 --> 00:02:36.740 if there's a group policy applied to that laptop and that 00:02:36.740 --> 00:02:39.550 group policy can be written to by Rose, 00:02:40.010 --> 00:02:44.720 this now means that you can also compromise Rose's account to go edit that 00:02:44.720 --> 00:02:48.220 group policy, take over the laptop on which Mike is logged in, 00:02:48.330 --> 00:02:52.110 and you will essentially become domain admin with a few different steps. 00:02:52.510 --> 00:02:53.590 Simple enough, right? 00:02:53.720 --> 00:02:57.350 What BloodHound lets you do is visualize those steps really easily. 00:02:57.900 --> 00:03:01.370 What it does is it connects to active directory over LDAP and 00:03:01.370 --> 00:03:03.500 downloads all the information about the users, 00:03:03.630 --> 00:03:05.650 the groups, the computers, and all of that. 00:03:06.040 --> 00:03:10.860 It can also connect directly to computers to enumerate sessions and ACLs. 00:03:11.180 --> 00:03:12.650 With all of that information, 00:03:12.660 --> 00:03:15.540 it will create the graph database that'll let us see all the 00:03:15.540 --> 00:03:18.740 relationships between all of these different objects, so you can 00:03:18.740 --> 00:03:21.050 find the shortest path to your objective. 00:03:21.270 --> 00:03:24.870 To follow along with the demo, you'll need a system to install BloodHound. 00:03:25.110 --> 00:03:27.690 I highly recommend using Kali Linux for this because the 00:03:27.690 --> 00:03:29.690 installation is really simple. However, 00:03:29.700 --> 00:03:32.030 BloodHound works on Mac, Windows, and Linux. 00:03:32.560 --> 00:03:34.850 You simply need to install Neo4j first. 00:03:35.640 --> 00:03:38.500 You'll need the ability to transfer the exercise files 00:03:38.840 --> 00:03:40.500 to your system running BloodHound. 00:03:40.820 --> 00:03:43.480 You do not need active directory to follow along. 00:03:43.710 --> 00:03:47.190 The example domain that'll be showing will be exported to a 00:03:47.190 --> 00:03:50.720 BloodHound zip file that you can simply import to your own 00:03:50.720 --> 00:03:52.250 running instance of BloodHound.