mcpField
B
bloodhound-enum

bloodhound-enum

github.com/wgpsecSecurity1.8k51 installsUpdated 4d ago
Repository

About bloodhound-enum

A methodology for using BloodHound.py to collect Active Directory data, intended for penetration testers preparing data for BloodHound analysis. It describes remote collection over LDAP and DNS, including directory relationships and sessions, then importing JSON or ZIP output into BloodHound GUI to analyze attack paths.

Key features

  1. 01Remote collection over LDAP and DNS
  2. 02Collect users, groups, computers, and sessions
  3. 03Multiple authentication methods
  4. 04Full or category-specific collection
  5. 05Export JSON for BloodHound import

Use cases

  1. 01Gathering domain objects and relationship data
  2. 02Collecting selected local-admin or ACL information
  3. 03Importing results into the GUI to find attack paths

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wgpsec/aboutsecurity --skill bloodhound-enum

After installing, type/bloodhound-enumin Claude Code to confirm it loaded.

Details

From the project README

BloodHound.py AD 信息采集方法论

BloodHound.py 是 BloodHound 的 Python 采集器。核心优势：无需在目标执行（通过 LDAP/DNS 远程采集）+ 全面覆盖（用户/组/计算机/会话/ACL/信任关系）+ JSON 输出（导入 BloodHound GUI 分析攻击路径）。

项目地址：https://github.com/dirkjanm/BloodHound.py

Phase 1: 基本采集

# 全量采集（最常用）
bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All

# 指定域控 IP
bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All -dc 10.0.0.1

# 指定 DNS 服务器
bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All -ns 10.0.0.1

# 输出压缩包
bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All --zip

Phase 2: 认证方式

# 密码认证
bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All

# NTLM Hash 认证（Pass the Hash）
bloodhound-python -d corp.local -u user --hashes aad3b435b51404eeaad3b435b51404ee:hash -c All

# Kerberos 认证
bloodhound-python -d corp.local -u user -p 'P@ssw0rd' -c All -k

# 使用 ccache 票据
export KRB5CCNAME=/tmp/krb5cc_user
bloodhound-python -d corp.local -u user -c All -k --auth-method kerberos

Phase 3: 采集方式选择

# 默认采集（Group + LocalAdmin + Session + Trusts）
bloodhound-python -d corp.local -u user -p pass -c Default

# 仅采集组成员关系
bloodhound-python -d corp.local -u user -p pass -c Group

# 仅采集本地管理员
bloodhound-python -d corp.local -u user -p pass -c LocalAdmin

# 仅采集会话信息
bloodhound-python -d corp.local -u user -p pass -c Session

# ACL 采集（分析权限关系）
bloodhound-python -d corp.local -u user -p pass -c ACL

# 信任关系
bloodhound-python -d corp.local -u user -p pass -c Trusts

Phase 4: 导入与分析

采集完成后将 JSON/ZIP 文件导入 BloodHound GUI：

# 启动 Neo4j（BloodHound 后端）
sudo neo4j start

# 打开 BloodHound GUI，拖拽 JSON/ZIP 文件导入
# 常用查询：
# - Find all Domain Admins
# - Shortest Path to Domain Admins
# - Find Kerberoastable Users
# - Find AS-REP Roastable Users

渗透测试常用场景

场景命令
全量采集bloodhound-python -d corp.local -u user -p pass -c All --zip
PTH 采集bloodhound-python -d corp.local -u user --hashes LM:NT -c All
仅 ACL 分析bloodhound-python -d corp.local -u user -p pass -c ACL
指定 DCbloodhound-python -d corp.local -u user -p pass -c All -dc 10.0.0.1 -ns 10.0.0.1

Comments

Markdown supported