← Back to Academy

Academy Node

BloodHound Collection

BloodHound collection gathers AD relationships, sessions, ACLs, local admin, and attack paths.

Intermediate100 XPEnumeration

Why it matters

It converts AD into a graph so you can identify attackable edges fast.

How to identify it

  • Valid domain creds
  • LDAP/SMB reachable
  • SharpHound or bloodhound-python works

BloodHound indicators

  • All graph edges

NetExec commands

nxc ldap 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' --bloodhound --collection All

Linux commands

bloodhound-python -d xutslabs.local -u ba_low -p 'Password123' -ns 192.168.184.141 -c All --zip

Expected output

  • JSON files or ZIP ready for BloodHound

Success looks like

  • Graph imports
  • Edges visible
  • Shortest paths found

Failure looks like

  • DNS failure
  • LDAP bind failure
  • Collection incomplete

Troubleshooting

  • Fix /etc/hosts
  • Use DC IP as nameserver
  • Collect again after privilege changes

Common mistakes

  • Using stale BH data
  • Not collecting as newly found user
  • Ignoring object type

Alternative attacks

  • Manual LDAP ACL enum

What to try next

  • GenericWrite
  • GenericAll
  • AdminTo
  • CanPSRemote
  • WriteDACL

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.