BloodHound - Grimoire

Graphs AD relationships to find attack paths to Domain Admin: run collection first, then import the JSON and query from the UI.

Collection

Collect from your attack box using bloodhound-python or nxc: no need to touch the target host.

bloodhound-python -u $USER -p $PASSWORD -d $DOMAIN -dc $DC_HOST -c all -ns $DC_IP
nxc ldap $IP -u $USER -p $PASSWORD --bloodhound -c all

.\SharpHound.exe -c All

cd ~/tools/bloodhound
docker compose up -d
# http://localhost:8080
docker compose down

Run these in order after importing data: they cover the most common privilege escalation paths.