WEBVTT

00:00:03.140 --> 00:00:07.060
The best way to collect data with BloodHound is to use SharpHound.

00:00:07.340 --> 00:00:11.980
You'll find it on the same GitHub repo as BloodHound in the Ingestors directory.

00:00:12.350 --> 00:00:17.050
It's available as a simple executable or a PowerShell version.

00:00:17.600 --> 00:00:21.890
Depending on how stealthy you need to be, consider using PowerShell with

00:00:21.890 --> 00:00:25.250
some customized options or maybe even recompiling your own.

00:00:26.540 --> 00:00:29.740
You will then need to run it from a computer that's on the domain.

00:00:31.270 --> 00:00:35.340
I downloaded mine to the SharpHound directory. Again, if trying to be stealth,

00:00:35.340 --> 00:00:37.450
you probably don't want to name things like that.

00:00:39.240 --> 00:00:41.240
The executable is simply SharpHound,

00:00:41.520 --> 00:00:43.720
so if you just run it without passing it any

00:00:43.720 --> 00:00:46.130
configuration it's going to use its defaults,

00:00:46.130 --> 00:00:49.650
which are pretty good. However, we'll customize it a little bit.

00:00:50.140 --> 00:00:53.310
SharpHound supports different collection methods.

00:00:54.480 --> 00:01:00.300
These are configured by using the ‑‑CollectionMethod option

00:01:00.310 --> 00:01:02.450
and specifying a comma‑separated list.

00:01:03.040 --> 00:01:05.780
So I want to gather the information about groups,

00:01:06.320 --> 00:01:12.000
local groups, remote desktop, DCOM permissions,

00:01:13.240 --> 00:01:15.880
GPOLocalGroup,

00:01:15.880 --> 00:01:21.150
which is used to enumerate local groups configured via GPO, sessions,

00:01:26.040 --> 00:01:33.300
ObjectProps, who's logged on, domain trusts,

00:01:36.440 --> 00:01:43.920
ACLs, and information about containers. Now, this will be extremely

00:01:43.920 --> 00:01:46.630
noisy because it will create many different threads.

00:01:46.740 --> 00:01:49.300
It will also connect to different computers to enumerate

00:01:49.300 --> 00:01:51.430
sessions and who's logged on, and all of that.

00:01:51.610 --> 00:01:53.800
So if you just ran that in an environment where you

00:01:53.800 --> 00:01:57.060
have a pretty good Blue team, you're very likely to get caught.

00:01:57.540 --> 00:02:00.330
There's also a stealth option for SharpHound,

00:02:00.410 --> 00:02:03.830
and you can also configure it to only use LDAP, so it will

00:02:03.840 --> 00:02:05.790
only connect to one domain controller.

00:02:06.090 --> 00:02:08.940
So consider starting with the stealth option,

00:02:09.220 --> 00:02:13.150
using only a specific domain controller, and going as slow as you can.

00:02:13.740 --> 00:02:14.650
Now for this demo.

00:02:14.650 --> 00:02:17.220
I'm just going to run this because it will gather as

00:02:17.220 --> 00:02:19.550
much information as possible at once.

00:02:21.220 --> 00:02:23.510
As you can see, it creates zip files,

00:02:23.770 --> 00:02:26.520
and there's an option to encrypt those zip files when they're

00:02:26.520 --> 00:02:29.010
created. Again, if this is a real engagement,

00:02:29.010 --> 00:02:30.010
you might want to do that.

00:02:30.010 --> 00:02:32.320
So you specify a file name,

00:02:32.320 --> 00:02:35.140
and the person that tries to open the zip can't actually see that

00:02:35.140 --> 00:02:37.650
someone just dumped their entire active directory into it.

00:02:38.340 --> 00:02:40.110
So now that I have that zip file,

00:02:40.340 --> 00:02:44.290
I'm going to import it into BloodHound. That zip file is what

00:02:44.290 --> 00:02:48.140
you have available in the exercise files,

00:02:48.230 --> 00:02:51.250
so this is the same zip file that you'll import on your side.