Attacking Active Directory - Bloodhound

Enumeration of an Active Directory environment is vital when looking for misconfiguration that could lead to lateral movement or privilege escalation. Bloodhound is a tool that will make this process quick and will provide queriable graphs that allow for an easy discovery process. This tool is commonly used during pentesting engagements and be a lot of fun to practice within a home lab environment.
Join my new Discord server: discord.gg/9CvTtHqWCX
Follow me on Twitter for updates: / 0xconda
If you found this video helpful and would like to support future creations, please considering visiting the following links:
Buy Me a Coffee: www.buymeacoffee.com/conda
Download Bloodhound: github.com/BloodHoundAD/Blood...

[@InfiniteLogins]

I use Bloodhound on every internal assessment, but I never knew about the ability to run collectors remotely with Python. Thanks for sharing!

[@c0nd4]

Awesome! Thank you for the support!

[@archersterling4044]

Supposedly sharphound.exe is a more stable and reliable collector?

[@karthikeyanrajasekar7119]

Please make more of these videos on Active Directory. Absolutely loved this one !

[@c0nd4]

I do plan on it 🙂

[@zunicalmir]

Its amazing how u explain it, its easy to soak with just one run...thank you

[@b-rent4733]

Thanks Conda! This was key to using bloodhound without having local access to the domain.

[@ns-yz1hj]

Keep the AD videos coming man. Finding good AD guides is hard. Love your videos!

[@c0nd4]

Thank you!

[@balanceandjustice777]

Great video! Thank you so much!!

[@nilangaperera9649]

Thanks heaps, for making this great video demonstration.

[@c0nd4]

Appreciate the support 👍

[@WizardKing24]

Wow, very great video! I learned a lot, for example I didn't know that you can collect the data with Python. Thanks for all the tips in Bloodhound and the BadBlood you mentioned in another comment, I'll definitely check it out too! Thanks a lot!

[@c0nd4]

Glad you enjoyed the video!

[@colinrogers9927]

This is a great explanation. Good work

[@c0nd4]

Thank you!

[@pcap_pirate960]

Great explanation!

[@behnamahmadi6482]

thank u so much for this awesome tutorial video.

[@c0nd4]

No problem! Glad you enjoyed it

[@Jesse_Johnson]

I am getting this job. Thank you.

[@Arummekarlayung0706]

very clear explanation :)

[@c0nd4]

Thank you!

[@MrMrabaunza]

awesome video...it was very informative. subbed.

[@c0nd4]

Thank you 😁

[@sargondinkha8492]

Great tutorial!

[@c0nd4]

Thank you!

[@ca7986]

You are amazing dude 👌

[@c0nd4]

Thanks, I appreciate the support!

[@sul3y]

Thank you

[@danell12345]

Good job - one quick question I had was how did you create your user and group infrastructure? Did you do this manually adding random users assinging them to groups/roles or some kind of script? Obvs this is a testing environment.

[@c0nd4]

I used BadBlood which you can find here. github.com/davidprowe/BadBlood I then assigned a few group permissions manually to showcase some more complex attack paths with Bloodhound

[@danell12345]

@@c0nd4 will check it out - TY!

[@archersterling4044]

Hey bro how did you automate the domain configurations? I need to build a lab environment for work related research.

[@pentestsky]

nice keep going sorry for the late view

[@c0nd4]

Thank you for the constant support!

[@chiranjeevinaidu3660]

Hello I wanted to ask if we can make bloodhound portable for windows 10 for better use

[@quanghuyang2822]

Hi, I'm new to the world of security administration, and I was hoping to get some guidance from someone with your expertise. Do you have any advice on mapping out a career path in this area?

[@iakashx]

Hi. Is this allowd for OSCP exam.?? And thank you for this video. Happy Thanksgiving 🤗

[@c0nd4]

Hey! Bloodhound should be allowed on the exam, but I'm not sure if you would need it. Glad you enjoyed the video, and Happy Thanksgiving!

[@pentestsky]

@@c0nd4 no bloodhound in oscp

[@KaliLinuxIn]

Kuch Bhi.....

[@archersterling4044]

@@c0nd4 OSCP literally has no environment where bloodhound should be relevant.

[@shift3y]

Can the initial bloodhound query to AD be detected ? This would appear as a large LDAP query, is that right?

[@c0nd4]

Oh yeah, Bloodhound can be very noisy and is typically caught. They have some stealth settings but effectiveness will vary.

[@shift3y]

@@c0nd4 Thanks! Great channel, subscribed!

[@c0nd4]

Appreciate it 😃

[@LeonCheater13]

Hi nice video :) How to archive the GenericAll permission like you did? How to I need to configure my "Account managers" group to have GenericAll over Domain Admins? Thanks in advance

[@c0nd4]

The term AD uses for this is "Delegating control". Knowing the terminology helps find good resources on Google 😃 This article should help you do what you need. Good luck! www.beyondtrust.com/docs/ad-bridge/how-to/delegate-domain-join-privileges/how-to-delegate-control.htm

[@LeonCheater13]

@@c0nd4 Wow thank you very much :)

[@gabrielalonsonicolasundurr1751]

Puedes dejar el video con subtitulos al español ? Por favor.

[@8080VB]

I dont understand , how did you generated the loot.zip file?

[@jakeedmondson5288]

I was able to get everything installed properly but when trying to run bloodhound-python I just receive an error. I may have not been in the proper directory which I don't see in your tutorial. Any help is appreciated. Thanks.

[@c0nd4]

What's the error? Can't really offer help without knowing the error

[@jakeedmondson5288]

@@c0nd4 When opening a terminal window I am not sure where to go from there. I see from your video you are in a Bloodhound directory. Did you just create that or was that created from the install? I only see the Bloodhound folder under lib. I am almost certain everything installed properly though.

[@trejohnson7677]

its kind of ugly though.