WEBVTT 00:00:02.840 --> 00:00:05.380 I downloaded the zip file to my Kali Linux machine, 00:00:05.660 --> 00:00:08.900 so now you could either drag or drop the zip file right into BloodHound, 00:00:08.900 --> 00:00:13.850 or you can use the upload data option and simply select the zip file. 00:00:14.600 --> 00:00:17.450 There's a few thousand users in that active directory, 00:00:17.650 --> 00:00:20.840 so it could take a minute or two for you to import the zip file, 00:00:20.850 --> 00:00:25.050 especially if the VM you're using is slow or doesn't have a lot of memory. 00:00:25.500 --> 00:00:28.110 It's not a huge domain though, so it should be fine. 00:00:28.110 --> 00:00:31.580 If you're ever using this in production on gigantic domains with 00:00:31.580 --> 00:00:34.690 hundreds of thousands of users and thousands of servers, 00:00:35.020 --> 00:00:38.050 keep in mind you could run Neo4j on a separate machine 00:00:38.060 --> 00:00:40.230 and connect to it via BloodHound. 00:00:40.450 --> 00:00:44.650 Just make sure you secure Neo4j with authentication before you do that. 00:00:45.240 --> 00:00:48.050 As you can see, all files have been processed. 00:00:48.640 --> 00:00:52.760 We can see the import has been successful because we've got over 3,000 users, 00:00:53.050 --> 00:00:55.770 a few computers, some groups, and some sessions. 00:00:56.150 --> 00:00:58.260 The interesting number is relationships. 00:00:58.480 --> 00:01:02.280 There is close to 34,000 relationships that have been imported. 00:01:02.840 --> 00:01:05.950 No one could visualize all that in their head, 00:01:06.580 --> 00:01:10.320 but with the graph database, BloodHound is able to do so. 00:01:10.320 --> 00:01:14.040 So as you can see, we have a lot of pre‑built queries. 00:01:14.210 --> 00:01:18.140 BloodHound uses cypher queries, which are Neo4j queries. 00:01:18.380 --> 00:01:20.350 We can see the raw query at the bottom here, 00:01:20.360 --> 00:01:23.490 but it comes with some very useful pre‑built queries. 00:01:23.490 --> 00:01:27.550 For example, if I want to find all domain admins, I'll simply click this. 00:01:28.240 --> 00:01:30.610 And as you can see, this is the DOMAIN ADMINS group. 00:01:30.810 --> 00:01:34.530 And if I zoom out a little bit, I can move, 00:01:34.540 --> 00:01:38.420 and I can see that the ADMINISTRATOR account is a domain 00:01:38.420 --> 00:01:42.890 admin and Jay Wilson is a domain admin. 00:01:42.890 --> 00:01:44.050 That's interesting. 00:01:44.640 --> 00:01:48.300 Now there's a lot of other pre‑built queries that are really interesting, 00:01:48.300 --> 00:01:52.240 like finding accounts that are Kerberoastable, 00:01:52.280 --> 00:01:54.770 finding unsupported operating systems, 00:01:55.020 --> 00:01:57.570 finding domain admins that are logged into things 00:01:57.570 --> 00:01:59.140 that are not domain controllers. 00:01:59.420 --> 00:02:01.490 This is something that's very dangerous because if 00:02:01.490 --> 00:02:03.100 you're logged into a domain controller, 00:02:03.740 --> 00:02:05.750 no one else is supposed to be able to connect to it. 00:02:05.810 --> 00:02:08.650 But if you're a domain admin and you're logged into a workstation, 00:02:08.650 --> 00:02:09.620 that's dangerous. 00:02:09.630 --> 00:02:14.550 So I just ran that, and I see Jay Wilson here, who's our domain admin. 00:02:15.890 --> 00:02:20.250 I can see here that he's got a session, HasSession, 00:02:20.640 --> 00:02:26.150 on MEMBER‑2, and he's got a session on MEMBER‑1. 00:02:26.790 --> 00:02:30.610 So right there, you know that if you could compromise one of these two servers, 00:02:31.040 --> 00:02:31.930 he's got a session. 00:02:31.930 --> 00:02:36.820 So his credentials are in memory, and you could then become a domain admin. 00:02:37.910 --> 00:02:43.750 So what you could do here is configure these as high value computers. 00:02:47.540 --> 00:02:55.350 Now, if I want to look at MEMBER‑2, let's say you want to compromise MEMBER‑2. 00:02:55.890 --> 00:02:58.130 Well, I see there's one session on it. 00:02:58.130 --> 00:03:02.020 It can reach 11 high value targets. 00:03:02.230 --> 00:03:04.890 That's most likely because Jay Wilson is logged into it. 00:03:04.890 --> 00:03:07.580 And it's got a few GPOs applied to it. 00:03:07.590 --> 00:03:12.450 So I'm going to right‑click it, and I'm going to select Shortest Paths to Here. 00:03:15.040 --> 00:03:16.410 This is a much more complete graph. 00:03:16.410 --> 00:03:23.950 So if you want to compromise MEMBER‑2, you can use the SYSADMINS group, 00:03:24.540 --> 00:03:29.150 which contains Guy Williams, Michelle Morris, 00:03:29.640 --> 00:03:30.600 and Stephanie Dodd. 00:03:30.600 --> 00:03:33.520 So these are all accounts that you could compromise that 00:03:33.520 --> 00:03:36.670 would let you access MEMBER‑2 as an admin, 00:03:36.900 --> 00:03:40.480 therefore compromising Jay's session, and he's a domain admin. 00:03:40.770 --> 00:03:43.850 So you could configure these as high value users. 00:03:43.860 --> 00:03:45.350 They're definitely interesting. 00:03:47.440 --> 00:03:49.190 Now, who else is an admin? 00:03:49.190 --> 00:03:53.320 Well DOMAIN ADMINS is an admin on MEMBER‑2, 00:03:53.330 --> 00:03:55.130 but that's what we're targeting, so in this case, 00:03:55.130 --> 00:03:56.350 that's not very interesting. 00:03:58.240 --> 00:04:00.750 Now who else seems to have a session? 00:04:02.740 --> 00:04:05.780 Karen Field has GenericAll, 00:04:05.780 --> 00:04:08.890 which is a permission that essentially says can control 00:04:08.890 --> 00:04:12.270 completely the account of Carly Roberts. 00:04:12.530 --> 00:04:16.850 So that might mean that Karen is able to reset Carly's password. 00:04:18.040 --> 00:04:22.850 But whatever the case is, Karen can take over Carly's account, 00:04:23.440 --> 00:04:26.150 and Carly is an admin on MEMBER‑2. 00:04:26.840 --> 00:04:30.850 So to compromise Carly, we could compromise Karen. 00:04:31.540 --> 00:04:39.030 And if we look at Karen, she has a session on PC‑1.GLOBOMANTICS.COM, 00:04:39.040 --> 00:04:40.350 which is a workstation. 00:04:44.240 --> 00:04:51.560 Now that workstation is managed by a HELPDESK group that's admin on it. 00:04:51.560 --> 00:04:56.850 And we can see that Victoria Cook and Robert McLean 00:04:57.440 --> 00:05:05.320 are members of the HELPDESK group, and Robert has a session on PC‑2. 00:05:07.240 --> 00:05:10.910 This means that if you could compromise PC‑2, 00:05:11.400 --> 00:05:14.450 you could compromise Robert McLane's account, 00:05:15.040 --> 00:05:21.360 which through the HELPDESK group will let you log into PC‑1 as a local admin. 00:05:24.040 --> 00:05:26.370 Karen has a session on PC‑1. 00:05:27.440 --> 00:05:32.050 You can compromise her account and use it to take over Carly Roberts account. 00:05:32.640 --> 00:05:33.350 From there, 00:05:34.040 --> 00:05:38.410 you'll be able to log into MEMBER‑2 as an admin and take over Jay's account, 00:05:38.410 --> 00:05:42.300 and he's a domain admin, so you essentially became domain admin. 00:05:43.680 --> 00:05:47.110 Now there's a few very useful things that BloodHound will 00:05:47.110 --> 00:05:49.640 provide to you to make that easier. 00:05:49.850 --> 00:05:54.450 One thing is right‑clicking on any of these links includes Help. 00:05:55.540 --> 00:05:58.880 And in the Help, it will tell you what the information is, 00:05:58.890 --> 00:06:01.350 what the name of that connection means, 00:06:01.740 --> 00:06:06.950 but it also tells you some information about how you can abuse this permission. 00:06:07.340 --> 00:06:11.650 So here it's telling us that you could use Cobalt Strike with psexec, 00:06:11.650 --> 00:06:13.050 wmi, and so on. 00:06:13.640 --> 00:06:16.420 It also usually has some OPSEC considerations, 00:06:16.420 --> 00:06:19.210 telling you how you could be detected if you try to 00:06:19.210 --> 00:06:21.410 abuse these different permissions. 00:06:21.650 --> 00:06:24.170 It always includes different references for more 00:06:24.170 --> 00:06:25.950 reading on how you could compromise this. 00:06:27.510 --> 00:06:32.790 The second extremely interesting thing here is the Pathfinding option. 00:06:34.080 --> 00:06:39.500 The Pathfinding option lets you specify a start node and a target node, 00:06:39.510 --> 00:06:42.350 and it will tell you the shortest path to get there. 00:06:43.840 --> 00:06:46.850 Assume you didn't know what we just saw before. 00:06:47.630 --> 00:06:52.480 All you know is that you compromised Victoria Cook's account. 00:06:52.490 --> 00:06:56.530 We will set her as the Start Node. 00:06:56.530 --> 00:07:00.650 And we want to compromise Jay Wilson. 00:07:03.940 --> 00:07:08.350 This automatically tells us that using Victoria's account through HELPDESK, 00:07:08.740 --> 00:07:14.050 we're admin on PC‑1, on which Karen has a session. 00:07:14.440 --> 00:07:19.200 Karen can compromise Carly, Carly is an admin on MEMBER‑2, 00:07:19.200 --> 00:07:22.650 and Jay has a session on MEMBER‑2. 00:07:23.680 --> 00:07:24.940 So you can save a lot of time. 00:07:24.940 --> 00:07:29.380 And these right‑clicks where we configure things as a high value 00:07:29.620 --> 00:07:32.200 will also let you configure something as owned. 00:07:32.480 --> 00:07:37.200 So assuming we compromise PC‑1, we would right‑click it and mark it as Owned. 00:07:38.740 --> 00:07:42.550 That will let BloodHound know that this is a computer that we control. 00:07:43.340 --> 00:07:47.940 We can now go back to our default queries and select the Shortest 00:07:47.940 --> 00:07:51.260 Paths to Domain Admin from things that we own, 00:07:51.330 --> 00:07:53.950 and these things could be accounts or computers. 00:07:54.900 --> 00:08:02.150 I'll run this, and it's telling us that if we own this, 00:08:02.480 --> 00:08:06.330 we need to compromise Karen's account, Carly's account, 00:08:06.520 --> 00:08:07.950 and the MEMBER‑2 server. 00:08:08.640 --> 00:08:11.200 So when you run BloodHound in a real environment, 00:08:11.200 --> 00:08:15.830 the first thing you should do is mark as owned the accounts and 00:08:15.830 --> 00:08:18.750 the computers that you already have access to. 00:08:19.840 --> 00:08:23.110 If you run a tool like Responder and you gathered a bunch of credentials, 00:08:23.360 --> 00:08:26.300 mark them all as owned because there's no way you can 00:08:26.300 --> 00:08:28.810 visualize these types of graphs in your head. 00:08:29.070 --> 00:08:30.950 But once you've compromised everything, 00:08:31.140 --> 00:08:36.450 using queries with BloodHound will let you get exactly where you need to be. 00:08:37.440 --> 00:08:39.950 You might have configured some high value targets. 00:08:40.340 --> 00:08:42.960 You have the same types of queries that will let you see the 00:08:42.960 --> 00:08:46.360 shortest path to your high value targets. 00:08:46.590 --> 00:08:47.720 And in this case, 00:08:47.780 --> 00:08:51.850 it's very complicated already because we have a lot of high value targets, 00:08:52.340 --> 00:08:54.980 including groups like the administrator groups, 00:08:54.990 --> 00:08:57.850 the backup operator groups, and much more.