Hi.
Welcome to this video lesson on BloodHound.
Now we'll begin looking into different tools that
can unleash Active Directory and find misconfigurations which
we can go and fix before a potential adversary can
discover them.
BloodHound is a really famous tool
which can reveal hidden and often unintended relationships
in Active Directory.
And by relationships, what we really mean is,
imagine a path where a user can have forced change password
to another user who is member of a privileged group that
can log into a server.
The entire chain of sequence is something
that BloodHound is really good at can discover and then
showcase back to us in a very easy to understand form.
With BloodHound we can go scan our environment
and identify those paths because,
in a large organization it's very often the case when
one administrator might leave delegations
or add groups to be members of groups
to get a very big list of merged groups or nested membership
that you completely lose track of who is a member of what.
I have seen environments where the main users in five or six
layers nested grouping was member of Domain Admins,
simply because administrators had no easy way
to identify the entire chain, or follow who is member of what.
And this is where BloodHound comes in handy.
For attackers that could be great
because they can see if a compromised user has
any rights across the rest of the network just
in one simple view.
While for defenders, they can go and see those exact paths
as well.
But instead of forbidding them, we can fix them.
BloodHound consists of two different parts.
The first part is an ingestor.
The ingestor, you would use to go and scan your environment,
collect data.
And that data will contain a lot of information.
For example, it will extract information
about every group, every user, the relationship between them,
what group is a user a member of, what group
is a member of another group.
You have the entire information of everything
from Active Directory.
You'll also see what access control list
objects have on each other.
And one example would be a group that
can change passwords of every user,
or a group that can write certain properties of a user,
or a user who can read LAPS passwords.
This can be really, really many different things.
And the great thing about BloodHound
is that it will extract all of it--
will have it in one really easy overview at the end.
And the ingestor initially it was a PowerShell script,
but performance wise it was really slow.
So what the developers did is they re-implemented the tool
in C# that significantly improved the speed of gathering
this data.
And the tool rebranded now in C#, the ingestor part of it,
is called SharpHound.
You can download BloodHound and SharpHound
from the links which are provided on the slide
currently.
They are free for use.
They are available on GitHub.
Now the second part of BloodHound
is essentially a database with a nice GUI.
And that GUI is the part which would display back
to us the results that were collected.
Essentially, it's just a visualization
of all the relationships which were discovered.
And we can also do custom searches.
One such example would be if we take a user in our environment
called Slavi, and search if Slavi has a way
to become Domain Administrator.
That could be because Slavi has access to server 01,
where a domain administrator is also logged into.
Then if Slavi logs into server 01,
he can perform a credential theft attack, for example,
dumping credentials from the LSASS process and obtaining
the password or the password hash of the domain
administrator account logged in there.
Then Slavi can essentially escalate
to become a domain administrator by abusing credential
theft and the domain administrator account that's
logged into the server.
Now let's take a graphical view.
We have executed BloodHound into the environment
and we extracted all of data.
What we did a search of is, can Johnny
become a domain administrator.
So what we can see here in the diagram
is that Johnny has generic right access over the account
exchange ADM, or the EXCH_ADM.
Generic right access will give the ability for Johnny
to change quite a few properties of EXCH_ADM
including the password.
But as an attacker, you'd probably not
go over to go and change their password
because you'll make a user aware that something's wrong.
Another way to approach this is, Johnny with his generic right
access can add an SPN value to the EXCH_ADM account.
And by doing so, this account will
be potentially vulnerable towards Kerberoasting
which was one of the first attacks which
we discussed in this course.
So if Kerberoasting is now in play,
we can extract a Kerberos ticket that we can crack offline
with our password cracking tools.
By doing so, if we successfully crack the password of EXCH_ADM,
we can log in as that account.
And then going forward on the diagram of BloodHound,
when we have compromised EXCH_ADM, that account
is member of SG_AZURESYNC.
And this group, SG_AZURESYNC in Active Directory,
you can actually see that users are
shown as a green single user identity, while groups
in the diagram are multiple identities shown in yellow.
So SG_AZURESYNC is a group.
And that group has certain rights on the domain object.
And these rights will give the ability for this group
to add replication changes permissions to any user
that this group desires.
So if Johnny compromises EXCH_ADM
through Kerberoasting he can provide himself the ability
to perform this sync by modifying the domain object
ELS.BANK
With the [INAUDIBLE] rights, then
Johnny can obtain the password hash of any of the domain
administrator accounts.
And in this case, BloodHound shows
that one of those accounts could be,
as an example, the administrator account of the domain.
So essentially, yes, to answer the question,
Johnny has a path to escalate himself
to domain administrators.
And that path goes through changing the password,
or cracking the password EXCH_ADM
and performing certain changes in ELS.BANK.
Now let's go into the environment
and go through the entire process
of executing the ingestor of BloodHound
and then analyzing data so you can get a better
view of how to use the tool.
I'm now currently in the environment,
and we're going to simulate that--
let's say we don't know anything about this Active Directory
at all.
So what we want to do is, from the perspective of an attacker,
although we're morally defending in this case,
let's just take the perspective of an attacker.
Let's compromise this user called Slavi or just do whoami.
User Slavi in the domain production or prod.
So I went forward and I downloaded SharpHound
just so that we don't have to go through that process together.
But everything from now onwards, we'll
go through and do it step-by-step.
So I have downloaded SharpHound and I'll
execute it to get a Help menu.
Now, we're not going to go through each
of these different options.
The one that I really want to outline
is the CollectionMethod, or you can specify just, c.
The Collection Method tells SharpHound
what exactly do we want to obtain from the Directory.
And my really common recommendation
here is that we should go for everything.
We want to obtain all the information
that these two can get, because we want to identify all paths.
Now, getting this data and not being stealth--
getting this data and not being stealth
will produce a lot of noise into the environment.
And that's also a good thing from the defending point
of view because, if you have monitoring in your environment
you will be able to detect this SharpHound tool requesting
a lot of LDAP queries.
One way to detect it is by using a tool, Azure ATP,
which we're going to discuss later in the module.
Or, you can set up additional logging
at the endpoint, which can detect LDAP queries being
created from the endpoint towards some of the servers.
For example, some of these queries with SharpHound
is also going to create our core members of the group domain
administrators.
And that LDAP query is not normal occurrence,
or it's not something normal that you'd expect
from a endpoint to create.
If you see someone from an HR or Marketing department making
an LDAP query, asking who is member of domain admins,
that is really suspicious.
So we're not really going to attack anything in this case.
We'll just go forward and extract data.
What we're going to do is, we will
specify that we want the collection method to be All,
simply because we have a small environment.
But in a big enterprise environment,
you should specify collection method,
All, and separately, you should also
define SessionLoop that will enumerate sessions over time.
So for example, you can extract all the data as of now
at this moment.
But let the Session Loop run for another day
to extract sessions in different servers
that users are connecting to throughout the entire day,
and not just at that specific moment.
So we'll just execute SharpHound with dash c, All,
for all collection methods.
And I'm getting a network error.
I'll debug the network right now.
I'll pause the video, and then I'll
resume when I have figured out what is causing this issue.
So I looked around and it seems that there was not really
any issue.
At the point, something was wrong with the DNS.
But if we run it now, we'll see that SharpHound
starts collecting data.
And it's really that fast.
All the data is now collected.
That is because of course, we have a very small environment.
If your environment is 10,000 or more objects,
you would expect it to take a longer time.
When BloodHound finishes, it will create this zip file.
And this zip file is now all the extracted data
that we need to move into the second tool of BloodHound,
or the virtualization side of it.
This was the ingestor collecting the data.
Now we'll move the zip file into the other tool
that can visualize it to us.
I have the second part of BloodHound
installed on our Linux machine.
So I'll switch to the Linux machine and move the file.
I'll pause the video when I'm switching,
and then resume it when I'm at the next machine.
All right.
Now we're connected to the Linux machine
and I have already started BloodHound.
This is the GUI and you're going to become
very familiar with it once you start working with the tool
yourself.
The first thing we have to do is go and upload data.
So we're going to upload the zip file.
You had select just the zip code.
And the tool automatically unzip it and take the different text
documents which were inside.
So it will go, unzip the files, process the data
and then just show us the output or the summary
of what it found.
So there are seven users in our environment, three computers,
65 groups, two active sessions where users
are logged into computers.
There are certain access control lists between objects
and some relationships.
We can start and search for a computer or user in here.
Or, we can also go into the Queries section which comes
with some pre-built queries.
For example, we can state or just
click on the one that says, Find all Domain Admins.
And it will visualize the domain admins group
to the right, and everyone who is a member of it.
So what we're going to see here is that we have two members.
One of them is the account called Administrator, and also
the domain controller.
And it's really weird that the domain controller
is a member of this group.
This is not something custom.
And actually this would be a misconfiguration
that we need to look into and potentially
mitigate by removing the domain controller from being
a member of this group.
But aside from that, we have the administrator account,
which is a domain controller--
sorry it's domain admin.
The built in queries can also identify certain paths.
So for example, show us all the different paths
from user or computer to become a domain administrator,
if there's any relationship between them.
To use any of these queries, we can
specify what edges we want to be part of that.
So do we want to consider the fact
that the user can RDP to a server as a jumping spot,
or BloodHound to detect that relationship or not?
In this case, I don't want to see points
where a user has the RDP ability but is not
a local administrator of that machine.
And I want to see all the different access control
list edges that BloodHound can detect, such as as
the rights, or generic rights.
If certain users own objects, that
is something I would like to discover.
Or, if they're member of-- if they session tool,
the administrator tool, and so on.
I'll let you play with the different built
in queries yourself so you can see how valuable they can be.
But instead, what I'm going to do
is I'll specify a path that I want to look for myself.
And the path is, if we could start from the compromised
user called Slavi, and can I use that user
to become a domain administrator.
Is there a path?
So running that query returns an output,
which means that BloodHound has indeed detected a path.
So let's look into that.
What we're going to discover here is that the account,
Slavi is administrator to Server 01 where currently the account
administrator is logged into.
And the administrator account is the account
that we discovered has domain admin rights.
So if Slavi, my compromised user--
if I could [INAUDIBLE] that user to go to Server 01,
I can perform credential theft and compromise this
administrator account.
By doing that, I will escalate my privileges
to those of domain administrator.
Now, there is something really interesting about BloodHound,
because since it has all the data
about all users in all groups it can also visualize it to us.
For example, if I press on the account, Slavi,
on the left hand side I'll see all the information
that BloodHound extracted about this user.
And that would include the Sid value, when the password was
last changed, when the user last logged on,
whether the user is enabled or disabled,
the description filed.
What is interesting here is that you'll see that
in the description field, it contains pass:Welcome1.
That could potentially be the password
of the user which is another misconfiguration that might
exist an Active Directory.
But there's much more than this.
Because it will also create a summary
of the groups that the user is member of,
and you can directly press on this number.
So you can see that, for example, Slavi
is a member of the group Domain Users directly.
But indirectly, he's a member of five groups.
So if you press on five, we'll see
that the direct membership into Domain Users
starts to expand into other groups as well.
Then the account has local admin rights into one computer,
and we can see which computer that is immediately.
If we do, Derivative Local Admin Rights,
we'll see that there's a path for this user
to escalate their privileges to essentially derive local admin
rights on three machines.
And if you remember, the three machines were--
all of the machines will have in our environment.
And there's much more that can be shown here, really.
It's just a matter of identifying a bigger--
or having a better environment to have these populated
so we can see how valuable they can be.
And one thing of the queries which
I mentioned before earlier was that the pre-built ones
can detect and showcase quite a few things.
You can also create custom queries
into the language of this database.
It's using [INAUDIBLE] backend.
So if you're more familiar with the language-- or there is also
cheat sheets of the most common queries
that you can have already pre-made in a cheat sheet,
which you can just plug in using here.
But if we run the pre-built one called,
Find Shortest Path to Domain Admins,
it will essentially identify all paths
that exist towards domain admins without a starting point.
The one that's interesting here is
that if we go all the way to the left,
we'll see that there's a path from Slavi, who we already
discussed earlier, to the administrator.
There's also a path for account operators,
because account operators have generic All rights
on computer objects.
So a member of this group--
right now, there's no members.
If you click on the group we'll see
that there's no direct or indirect members of the group.
So if there was a member of this group, who
he'll have the ability to alter the computer
object and escalate the right domain admin
again through the same path that the Slavi user can.
I really hope that this short video and demonstration
of BloodHound can showcase how valuable this tool can
be, and not just for attackers but also for defenders
to identify these escalation paths
and essentially stop them.
Implement something that mitigates
the escalation for these users.