CrackMapExec Bloodhound (smb)


This page contains detailed information about how to use the bloodhound CME module while using the smb protocol. For list of all CrackMapExec modules, visit the CrackMapExec Module Library.

Description

This module executes the BloodHound recon script on the target and retrieves the results onto the attacker's machine. There are 2 supported modes:

  • CSV: exports data into CSVs on the target file system before retrieving them (NOT opsec safe)
  • Neo4j API : exports data directly to the Neo4j API (opsec safe)

The bloodhound module is OPSEC unsafe which means that it may touch the disk and therefore can trigger an alarm.

Supported Protocols

  • smb

Module Source Code

Authors

  • Waffle-Wrath

Module Options

Here is a complete list of bloodhound module options:

# cme smb -M bloodhound --options
[*] bloodhound module options:

        THREADS             Max numbers of threads to execute on target (defaults to 20)
        COLLECTIONMETHOD    Method used by BloodHound ingestor to collect data (defaults to 'Default')
        CSVPATH             (optional) Path where csv files will be written on target (defaults to C:\)
        NEO4JURI            (optional) URI for direct Neo4j ingestion (defaults to blank)
        NEO4JUSER           (optional) Username for direct Neo4j ingestion
        NEO4JPASS           (optional) Pass for direct Neo4j ingestion

        Give NEO4J options to perform direct Neo4j ingestion (no CSVs on target)

Note that none of these options is required. If you want to change any of the default values, you can do so by adding, e.g. -o THREADS=VALUE parameter to the command line.

Module Usage

This is how to use the bloodhound module while using the smb protocol:

Syntax:
# cme smb <TARGET[s]> -u <USERNAME> -p <PASSWORD> -d <DOMAIN> -M bloodhound

Local admin:
# cme smb 10.0.5.1 -u Administrator -p P@ss123 -d . -M bloodhound
# cme smb 10.0.5.1 -u Administrator -p P@ss123 --local-auth -M bloodhound

Domain user:
# cme smb 10.0.5.1 -u bkpadmin -p P@ss123 -d target.corp -M bloodhound

CrackMapExec also supports passing the hash, so you can specify NTLM hash instead of a password:

# cme smb 10.0.5.1 -u Administrator -H 432b022dc22aa5afe884e986b8383ff2 -d . -M bloodhound
# cme smb 10.0.5.1 -u bkpadmin -H 432b022dc22aa5afe884e986b8383ff2 -d target.corp -M bloodhound

The module can be run only on a single host. Running against multiple hosts is not supported.

References

Version

This page has been created based on CrackMapExec version 5.1.7dev.
Visit CrackMapExec Module Library for more modules.