OK so now we have our bloodhound open.
It's a blank screen.
We've got our file transferred over and we're ready to do some bloodhound reviewing.
So let's go ahead and do upload data over here on the right.
It's a little up arrow and then I have my file that zip in my home folder so I'm going to go here and
I'm going to go file that zip.
We're just going to upload this.
You can see it's processing all of the Jason files that are coming through.
And in just a second it will have us some nodes available.
So now let's go ahead and click over here on the little hamburger and you can see that we've got nine
users three computers fifty two groups three sessions 512 access control lists and five hundred ninety
two relationships.
That's a lot of numbers.
So what we're looking at in years might be a little different because it's looking at sessions so based
on who you have logged in at the time and mine have you know I've been just logging in kind of willy
nilly on either Frank Castle or administrator or wherever.
So the different sessions could be different versus how you been logging in.
But the group should be relatively the same computer should be the same user should be pretty much the
same.
So we can go over to queries and they have some pre-built queries for us.
So let's find all domain admins and we can look here and it says hey administrators of domain admin
t starts a domain Amman.
And if we drag this over just a bit sequel services the domain admin so right away we know all the domain
admins.
Let's find the shortest path to the domain admin.
And it says domain admins at Marvel that local.
Go ahead and select that.
And it says OK well if we look at the Punisher dot marvel that local well administrator at Marvel that
local has a session here well I was logged in as Administrator so the sessions here.
What does that make you think of.
Well OK token impersonation which we haven't covered yet but token impersonation is gonna be a big one.
We can leverage attacks against this to try to compromise the administrator accounts with Mimi Katz
but you're going to see as well.
So you want to target boxes where there is a domain admin logged in and we can leverage this here we
could say OK well I don't want to target Spider-Man Spiderman it's got nothing going on but the punisher.
Now if I can get onto that machine I get that administrator account and then I'm a domain am and that's
the shortest path for me.
Right.
So we can look through here now Domain Trust.
There's nothing for us here there's no domain trust for us to do.
We could look through unconstrained delegation and try to find information on that.
And there's just a bunch of pre-built queries here.
So we haven't talked about Kirby roasting yet but we will shortest path to curb harassing users or curb
arrestable users so there's the care of TGT account which is a ticket granting ticket account and sequel
service that we set up.
Let's just look at sequel service so we can look through that and it's telling us hey you know the sequel
service is part of domain admins that's not good right.
And the Punisher has access Spider-Man has access and we'll talk about what Kirby roasting is here in
just a few videos.
So high value targets we can look at that as well.
And this is insane right.
But obviously the administrator is a high level target.
So if we can if we can capture the administrators here or the actual administrator that lights up all
the different paths here where it's red and you could see Frank Castle is an AB unto the Punisher which
has a session with an administrator who is part of the administrators group who's part of the domain
Ammons group is part of the enterprise admins group.
And you can kind of look through here and see all the different memberships and all these unique graphs
look at this look at the complex complexity that's going on here.
Right.
And this is just nine users three computers.
Imagine a network and how complex this is.
And imagine having to try to figure this out for yourself where we can just click a button and we know
all the domain happens or we can just click a button and see where the domain admin has a session.
This is amazing stuff here.
So when you're doing an assessment and you've got compromised and you're on a machine you might as well
run bloodhound and gather as much data that you can out of that machine out of that network and see
where your next movement is and really start to target your paths especially if you're in a timed assessment
or you don't know your next step re next move.
This is a great tool really great tool to use.
And again just like power of you this just scratches the surface there are pre-built queries and custom
queries that you can write and define here and kind of make your own idea to leave that up to you as
well to do research on those honestly.
Me I use pretty much what's in here as the prebuilt and that's enough for me.
But if you want to go more deep here and go into custom queries you're welcome to do that as well.
But this is a nice overview of what bloodhound is capable of and how you can enumerate with it so that's
it.
Hopefully this was informative for you.
I just wanted to provide a quick overview of a couple tools that we can use the numerator in process
never changes right.
Once we have an account on a network we're going to enumerate we're going to enumerate before we get
an account.
We're gonna try to find access once we get access.
We're going to re enumerate we're going to see what information we can learn.
Once we've gathered that account and then again every time we have access to a new machine we don't
know what stones that's going to uncover as you're going to see in the next section.
One machine to the next can be a huge difference based on who's logged in and what information that
has on it.
You don't know if that information on there has maybe a text file with documents or passwords in it
you don't know if there's a administrator logged into that computer and then we can impersonate that
administrator.
There's so many different things that change from machine to machine enumeration is important.
And the tools and techniques all the way through this course that you've learned already you know and
map digging around just looking around for information is important.
And then just adding these two tools here to your arsenal gonna make you significantly better as a pen
Tester.
And I'll give you something to talk about in an interview as well you can say look I use power of you
and I use that to look through for users groups I look through policies group policies computer policies
you know and you be able talk to those and you could say look I use bloodhound and I I look at that
to look at the administrators in the network what administrators are and what machine what's my shortest
path to the domain admin what are my high value targets.
And you could talk through that as well an interview and you're gonna sound like you know what you're
talking about and it's going to make you is going to set you apart from other people.
Honestly it's going to set you apart.
So take these two tools that I'm showing you and play around with them get better and you're going to
see a big difference.
So from here we're going to talk about post exploitation attacks.
So once we have compromised one account what can we do with that account and how can we leverage that
into other compromises and eventually own this whole network here.
So I'm excited to move forward and cover these next sections so I'll see you over in the next section
when we start talking about these attacks.