bloodhound-enum

BloodHound.py AD Information Gathering Methodology

BloodHound.py is the Python collector for BloodHound. Core advantages:No execution on the target required(remote collection via LDAP/DNS) + Comprehensive coverage(users/groups/computers/sessions/ACLs/trust relationships) + JSON output(import into the BloodHound GUI to analyze attack paths).

Project address:https://github.com/dirkjanm/BloodHound.py

Phase 1: Basic Collection

# 全量采集（最常用）
bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All

# 指定域控 IP
bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All -dc 10.0.0.1

# 指定 DNS 服务器
bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All -ns 10.0.0.1

Output archive

bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All --zip

## Phase 2: 认证方式

```bash
# 密码认证
bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All

# NTLM Hash 认证（Pass the Hash）
bloodhound-python -d corp.local -u user --hashes aad3b435b51404eeaad3b435b51404ee:hash -c All

# Kerberos 认证
bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All -k

# 使用 ccache 票据
export KRB5CCNAME=/tmp/krb5cc_user
bloodhound-python -d corp.local -u user -c All -k --auth-method kerberos

Phase 3: Collection Method Selection

# 默认采集（Group + LocalAdmin + Session + Trusts）
bloodhound-python -d corp.local -u user -p pass -c Default

# 仅采集组成员关系
bloodhound-python -d corp.local -u user -p pass -c Group

# 仅采集本地管理员
bloodhound-python -d corp.local -u user -p pass -c LocalAdmin

# 仅采集会话信息
bloodhound-python -d corp.local -u user -p pass -c Session

# ACL 采集（分析权限关系）
bloodhound-python -d corp.local -u user -p pass -c ACL

# 信任关系
bloodhound-python -d corp.local -u user -p pass -c Trusts

Phase 4: Import and Analysis

After collection is complete, import the JSON/ZIP file into the BloodHound GUI:

# 启动 Neo4j（BloodHound 后端）
sudo neo4j start

# 打开 BloodHound GUI，拖拽 JSON/ZIP 文件导入
# 常用查询：
# - Find all Domain Admins
# - Shortest Path to Domain Admins
# - Find Kerberoastable Users
# - Find AS-REP Roastable Users

Common Penetration Testing Scenarios

Scenario	Command
Full collection	bloodhound-python -d corp.local -u user -p pass -c All --zip
PTH collection	bloodhound-python -d corp.local -u user --hashes LM:NT -c All
ACL analysis only	bloodhound-python -d corp.local -u user -p pass -c ACL
Specify DC	bloodhound-python -d corp.local -u user -p pass -c All -dc 10.0.0.1 -ns 10.0.0.1