DΛΣMӨП

// HackTricks · Windows

BloodHound & Other Active Directory Enumeration Tools

BloodHound & Other Active Directory Enumeration Tools

Adws Enumeration

NOTE: This page groups some of the most useful utilities to enumerate and visualise Active Directory relationships. For collection over the stealthy Active Directory Web Services (ADWS) channel check the reference above.

AD Explorer

AD Explorer (Sysinternals) is an advanced AD viewer & editor which allows:

  • GUI browsing of the directory tree
  • Editing of object attributes & security descriptors
  • Snapshot creation / comparison for offline analysis

Quick usage

  1. Start the tool and connect to dc01.corp.local with any domain credentials.
  2. Create an offline snapshot via File ➜ Create Snapshot.
  3. Compare two snapshots with File ➜ Compare to spot permission drifts.

ADRecon

ADRecon extracts a large set of artefacts from a domain (ACLs, GPOs, trusts, CA templates …) and produces an Excel report.

# On a Windows host in the domain
PS C:\> .\ADRecon.ps1 -OutputDir C:\Temp\ADRecon

BloodHound (graph visualisation)

BloodHound uses graph theory to reveal hidden privilege relationships inside on-prem AD, Entra ID, and any extra attack-surface data you ingest through OpenGraph.[1]

Deployment (Docker CE)

curl -L https://ghst.ly/getbhce | docker compose -f - up
# Web UI ➜ http://localhost:8080  (user: admin / password from logs)

Collectors

  • SharpHound.exe / Invoke-BloodHound – native or PowerShell variant
  • RustHound-CE – cross-platform CE collector for Linux, macOS, and Windows
  • NetExec --bloodhound – quick LDAP-driven collection from Linux
  • AzureHound – Entra ID enumeration
  • SoaPy + BOFHound – ADWS collection (see link at top)

BloodHound CE v8+ changed the collector output format when OpenGraph landed. After upgrading from legacy BloodHound or older CE installs, re-run discovery with current collectors before importing the data.[1]

Common SharpHound modes

SharpHound.exe --CollectionMethods All               # Full sweep (noisy)
SharpHound.exe --CollectionMethods Group,LocalAdmin,Session,Trusts,ACL
SharpHound.exe --Stealth --LDAP                      # Low noise LDAP only
SharpHound.exe --CollectionMethods Session --Loop --Loopduration 03:09:41

The collectors generate JSON which is ingested via the BloodHound GUI.

SharpHound from a non-domain-joined Windows host

If your operator VM is not joined to the target domain, point DNS to a DC, start a network-only shell, verify you can see SYSVOL/NETLOGON on a DC, and then collect against the remote domain:

runas /netonly /user:CORP\svc_bh cmd.exe
net view \\dc01.corp.local
SharpHound.exe -d corp.local --CollectionMethods Group,LocalAdmin,Session,Trusts,ACL

This is useful for disposable jump boxes or operator workstations that should not be domain-joined.

Cross-platform collection from Linux/macOS

# CE-compatible ZIP from Linux/macOS/Windows
rusthound-ce -d corp.local -u svc.collector@corp.local -p 'Passw0rd!' -z

# Quick LDAP-driven BloodHound dump from Linux
nxc ldap dc01.corp.local -u svc.collector -p 'Passw0rd!' --bloodhound --collection All

RustHound-CE is a good default when you want CE-compatible output from a non-Windows host.[2] NetExec is convenient when you are already using it for LDAP validation or spraying and want a quick graph import. For non-AD datasets, BloodHound OpenGraph can be extended with collectors such as ShareHound.[1]

ADPathFinder (OpenGraph path prioritisation)

ADPathFinder sits on top of BloodHound CE/OpenGraph when the graph is too large to manually pivot. Instead of only asking whether one principal can reach one target, it calculates shortest paths from many low-privileged users and computers to high-value objects, groups paths that reuse the same edges, and surfaces the shared choke point that should be remediated first.[4]

adpathfinder --setup-bloodhound-api
adpathfinder -i SharpHound.zip --ad
adpathfinder -i SharpHound.zip MSSQLHound.zip ConfigManBearPig.zip --ad --pwd Contoso,ContosoIT --ntds ntds.txt -p hashcat.potfile

With MSSQLHound and ConfigManBearPig data imported, one finding can cross AD CS, MSSQL AD abuse, and SCCM attack paths instead of leaving them as separate leads.[4] Example shared path:

J.REPORTER > MSSQL_HasLogin > j.reporter > MSSQL_ExecuteAs > ReportSvc >
MSSQL_Connect > lab-sql01.training.local > MSSQL_LinkedAsAdmin > sccmdb.training.local >
MSSQL_ExecuteOnHost (as DA@TRAINING.LOCAL) > SCCMDB.TRAINING.LOCAL >
SCCM_AssignAllPermissions > SCCM_Site(TRN)
  • Track the effective security context at every edge. A path becomes domain-critical as soon as one transition executes as a privileged domain identity, even if it started from a normal user.
  • Grouped findings are ideal for choke-point remediation: removing one SQL impersonation permission, linked-server trust, certificate-template abuse path, or SCCM assignment can collapse many shortest paths at once.
  • Re-prioritise “medium” findings with graph context. SMB signing disabled, WebClient exposure, delegation mistakes, or NTLM-relayable SQL servers deserve higher priority when the compromised node has onward paths to Domain Admins, Domain Controllers, CAs, or SCCM site servers.
  • If you also have NTDS.dit output and a hashcat potfile, --pwd correlates cracked passwords with BloodHound properties so you can quickly separate ordinary password reuse from cracked creds on privileged, Kerberoastable, AS-REP roastable, or path-relevant accounts.

Privilege & logon-right collection

Windows token privileges (e.g., SeBackupPrivilege, SeDebugPrivilege, SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege) can bypass DACL checks, so mapping them domain-wide exposes local LPE edges that ACL-only graphs miss. Logon rights (SeInteractiveLogonRight, SeRemoteInteractiveLogonRight, SeNetworkLogonRight, SeServiceLogonRight, SeBatchLogonRight and their SeDeny* counterparts) are enforced by LSA before a token even exists, and denies take precedence, so they materially gate lateral movement (RDP/SMB/scheduled task/service logon).[3]

Run collectors elevated when possible: UAC creates a filtered token for interactive admins (via NtFilterToken), stripping sensitive privileges and marking admin SIDs as deny-only. If you enumerate privileges from a non-elevated shell, high-value privileges will be invisible and BloodHound won’t ingest the edges.[3]

Two complementary SharpHound collection strategies now exist:[3]

  • GPO/SYSVOL parsing (stealthy, low-privilege):

    1. Enumerate GPOs over LDAP ((objectCategory=groupPolicyContainer)) and read each gPCFileSysPath.
    2. Fetch MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf from SYSVOL and parse the [Privilege Rights] section that maps privilege/logon-right names to SIDs.
    3. Resolve GPO links via gPLink on OUs/sites/domains, list computers in the linked containers, and attribute the rights to those machines.
    4. Upside: works with a normal user and is quiet; downside: only sees rights pushed via GPO (local tweaks are missed).

  • LSA RPC enumeration (noisy, accurate):

    • From a context with local admin on the target, open the Local Security Policy and call LsaEnumerateAccountsWithUserRight for each privilege/logon right to enumerate assigned principals over RPC.
    • Upside: captures rights set locally or outside GPO; downside: noisy network traffic and admin requirement on every host.

Example abuse path surfaced by these edges: CanRDP ➜ host where your user also has SeBackupPrivilege ➜ start an elevated shell to avoid filtered tokens ➜ use backup semantics to read SAM and SYSTEM hives despite restrictive DACLs ➜ exfiltrate and run secretsdump.py offline to recover the local Administrator NT hash for lateral movement/privilege escalation.[3]

Prioritising Kerberoasting with BloodHound

Use graph context to keep roasting targeted:

  1. Collect once with an ADWS-compatible collector and work offline: 
    rusthound-ce -d corp.local -u svc.collector -p 'Passw0rd!' -c All -z
  2. Import the ZIP, mark the compromised principal as owned, and run built-in queries (Kerberoastable Users, Shortest Paths to Domain Admins) to surface SPN accounts with admin/infra rights.
  3. Prioritise SPNs by blast radius; review pwdLastSet, lastLogon, and allowed encryption types before cracking.
  4. Request only selected tickets, crack offline, then re-query BloodHound with the new access: 
    netexec ldap dc01.corp.local -u svc.collector -p 'Passw0rd!' --kerberoasting kerberoast.txt --spn svc-sql

Group3r

Group3r enumerates Group Policy Objects and highlights misconfigurations.

# Execute inside the domain
Group3r.exe -f gpo.log   # -s to stdout

PingCastle

PingCastle performs a health-check of Active Directory and generates an HTML report with risk scoring.

PingCastle.exe --healthcheck --server corp.local --user bob --password "P@ssw0rd!"

References