Invoke-BloodHound - Empire Module
This page contains detailed information about how to use the powershell/situational_awareness/network/bloodhound3 Empire module. For list of all Empire modules, visit the Empire Module Library.
Module Overview
Name: Invoke-BloodHound
Module: powershell/situational_awareness/network/bloodhound3
Source code [1]: empire/server/modules/powershell/situational_awareness/network/bloodhound3.yaml
Source code [2]: empire/server/data/module_source/situational_awareness/network/BloodHound3.ps1
MITRE ATT&CK:
T1484
Language: PowerShell
Needs admin: No
OPSEC safe: No
Background: Yes
The bloodhound3 module executes BloodHound data collection (ingestor for version 3).
This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.
Note that the bloodhound3 module does not need administrative privileges to work properly which means that a normal user can run this module.
Required Module Options
This is a list of options that are required by the bloodhound3 module:
Agent
Agent to run module on.
CollectionMethod
The method to collect data. Group, LocalGroup, LocalAdmin, RDP, DCOM, PSRemote, Session, SessionLoop, Trusts, ACL, Container, ComputerOnly, GPOLocalGroup, LoggedOn, ObjectProps, SPNTargets, Default, DcOnly, All.
Default value: Default.
Additional Module Options
This is a list of additional options that are supported by the bloodhound3 module:
CacheFilename
Name for the cache file dropped to disk (default: unique hash generated per machine).
CollectAllProperties
Collect all string LDAP properties on objects.
ComputerFile
A file, /!\ ON THE HOST /!\, containing a list of computers to enumerate. This option can only be used with the following Collection Methods: Session, SessionLoop, LocalGroup, ComputerOnly, LoggedOn.
DisableKerberosSigning
Disables keberos signing/sealing, making LDAP traffic viewable.
Domain
Specifies the domain to enumerate. If not specified, will enumerate the current domain your user context specifies.
DomainController
Domain Controller to connect too. Specifiying this can result in data loss.
DumpComputerStatus
Dumps error codes from attempts to connect to computers.
EncryptZip
Encrypt the zip file with a random password.
ExcludeDomainControllers
Exclude domain controllers from enumeration (usefult o avoid Microsoft ATP/ATA).
InvalidateCache
Invalidate and rebuild the cache file.
Jitter
Add jitter to throttle.
LdapFilter
Append this ldap filter to the search filter to further filter the results enumerated.
LdapPassword
Password for connecting to LDAP. Use this if you're using a non-domain account for connecting to computers.
LdapPort
Port LDAP is running on. Defaults to 389/686 for LDAPS.
LdapUsername
Username for connecting to LDAP. Use this if you're using a non-domain account for connecting to computers.
Loop
Perform looping for computer collection.
LoopDuration
Duration to perform looping (Default 02:00:00).
LoopInterval
Interval to sleep between loops (Default 00:05:00).
NoRegistryLoggedOn
Disable remote registry check in LoggedOn collection.
NoSaveCache
Don't write the cache file to disk. Caching will still be performed in memory.
NoZip
Do NOT zip the json files.
OutputDirectory
Folder to output files to.
OutputPrefix
Prefix to add to output files.
OverrideUserName
Override username to filter for NetSessionEnum.
PortScanTimeout
Timeout for SMB port checks.
PrettyJSON
Output "pretty" json with formatting for readability.
RandomFilenames
Randomize file names completely.
RealDNSName
Overrides the DNS name used for API calls.
SearchBase
DistinguishedName to start LDAP searches at. Equivalent to the old --OU option.
SecureLDAP
Connect to LDAPS (LDAP SSL) instead of regular LDAP.
SkipPortScan
Skip SMB port checks when connecting to computers.
StatusInterval
Interval for displaying status in milliseconds.
Stealth
Use stealth collection options, will sacrifice data quality in favor of much reduced network impact.
Throttle
Throttle requests to computers (in milliseconds).
WindowsOnly
Limits computer collection to systems that have an operatingssytem attribute that matches *Windows*.
ZipFilename
Name for the zip file output by data collection.
Bloodhound3 Example Usage
Here's an example of how to use the bloodhound3 module in the Empire client console:
[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule powershell/situational_awareness/network/bloodhound3
Author @harmj0y
@_wald0
@cptjesus
rafff
Background True
Comments https://bit.ly/getbloodhound
Description Execute BloodHound data collection (ingestor for version 3).
Language powershell
Name powershell/situational_awareness/network/bloodhound3
NeedsAdmin False
OpsecSafe False
Techniques http://attack.mitre.org/techniques/T1484
,Record Options------------,---------,----------,-------------------------------------,
| Name | Value | Required | Description |
|--------------------------|---------|----------|-------------------------------------|
| Agent | | True | Agent to run module on. |
|--------------------------|---------|----------|-------------------------------------|
| CacheFilename | | False | Name for the cache file dropped to |
| | | | disk (default: unique hash |
| | | | generated per machine). |
|--------------------------|---------|----------|-------------------------------------|
| CollectAllProperties | | False | Collect all string LDAP properties |
| | | | on objects. |
|--------------------------|---------|----------|-------------------------------------|
| CollectionMethod | Default | True | The method to collect data. Group, |
| | | | LocalGroup, LocalAdmin, RDP, DCOM, |
| | | | PSRemote, Session, SessionLoop, |
| | | | Trusts, ACL, Container, |
| | | | ComputerOnly, GPOLocalGroup, |
| | | | LoggedOn, ObjectProps, SPNTargets, |
| | | | Default, DcOnly, All. |
|--------------------------|---------|----------|-------------------------------------|
| ComputerFile | | False | A file, /!\ ON THE HOST /!\, |
| | | | containing a list of computers to |
| | | | enumerate. This option can only be |
| | | | used with the following Collection |
| | | | Methods: Session, SessionLoop, |
| | | | LocalGroup, ComputerOnly, LoggedOn. |
|--------------------------|---------|----------|-------------------------------------|
| DisableKerberosSigning | | False | Disables keberos signing/sealing, |
| | | | making LDAP traffic viewable. |
|--------------------------|---------|----------|-------------------------------------|
| Domain | | False | Specifies the domain to enumerate. |
| | | | If not specified, will enumerate |
| | | | the current domain your user |
| | | | context specifies. |
|--------------------------|---------|----------|-------------------------------------|
| DomainController | | False | Domain Controller to connect too. |
| | | | Specifiying this can result in data |
| | | | loss. |
|--------------------------|---------|----------|-------------------------------------|
| DumpComputerStatus | | False | Dumps error codes from attempts to |
| | | | connect to computers. |
|--------------------------|---------|----------|-------------------------------------|
| EncryptZip | | False | Encrypt the zip file with a random |
| | | | password. |
|--------------------------|---------|----------|-------------------------------------|
| ExcludeDomainControllers | | False | Exclude domain controllers from |
| | | | enumeration (usefult o avoid |
| | | | Microsoft ATP/ATA). |
|--------------------------|---------|----------|-------------------------------------|
| InvalidateCache | | False | Invalidate and rebuild the cache |
| | | | file. |
|--------------------------|---------|----------|-------------------------------------|
| Jitter | | False | Add jitter to throttle. |
|--------------------------|---------|----------|-------------------------------------|
| LdapFilter | | False | Append this ldap filter to the |
| | | | search filter to further filter the |
| | | | results enumerated. |
|--------------------------|---------|----------|-------------------------------------|
| LdapPassword | | False | Password for connecting to LDAP. |
| | | | Use this if you're using a non- |
| | | | domain account for connecting to |
| | | | computers. |
|--------------------------|---------|----------|-------------------------------------|
| LdapPort | | False | Port LDAP is running on. Defaults |
| | | | to 389/686 for LDAPS. |
|--------------------------|---------|----------|-------------------------------------|
| LdapUsername | | False | Username for connecting to LDAP. |
| | | | Use this if you're using a non- |
| | | | domain account for connecting to |
| | | | computers. |
|--------------------------|---------|----------|-------------------------------------|
| Loop | | False | Perform looping for computer |
| | | | collection. |
|--------------------------|---------|----------|-------------------------------------|
| LoopDuration | | False | Duration to perform looping |
| | | | (Default 02:00:00). |
|--------------------------|---------|----------|-------------------------------------|
| LoopInterval | | False | Interval to sleep between loops |
| | | | (Default 00:05:00). |
|--------------------------|---------|----------|-------------------------------------|
| NoRegistryLoggedOn | | False | Disable remote registry check in |
| | | | LoggedOn collection. |
|--------------------------|---------|----------|-------------------------------------|
| NoSaveCache | | False | Don't write the cache file to disk. |
| | | | Caching will still be performed in |
| | | | memory. |
|--------------------------|---------|----------|-------------------------------------|
| NoZip | | False | Do NOT zip the json files. |
|--------------------------|---------|----------|-------------------------------------|
| OutputDirectory | | False | Folder to output files to. |
|--------------------------|---------|----------|-------------------------------------|
| OutputPrefix | | False | Prefix to add to output files. |
|--------------------------|---------|----------|-------------------------------------|
| OverrideUserName | | False | Override username to filter for |
| | | | NetSessionEnum. |
|--------------------------|---------|----------|-------------------------------------|
| PortScanTimeout | | False | Timeout for SMB port checks. |
|--------------------------|---------|----------|-------------------------------------|
| PrettyJSON | | False | Output "pretty" json with |
| | | | formatting for readability. |
|--------------------------|---------|----------|-------------------------------------|
| RandomFilenames | | False | Randomize file names completely. |
|--------------------------|---------|----------|-------------------------------------|
| RealDNSName | | False | Overrides the DNS name used for API |
| | | | calls. |
|--------------------------|---------|----------|-------------------------------------|
| SearchBase | | False | DistinguishedName to start LDAP |
| | | | searches at. Equivalent to the old |
| | | | --OU option. |
|--------------------------|---------|----------|-------------------------------------|
| SecureLDAP | | False | Connect to LDAPS (LDAP SSL) instead |
| | | | of regular LDAP. |
|--------------------------|---------|----------|-------------------------------------|
| SkipPortScan | | False | Skip SMB port checks when |
| | | | connecting to computers. |
|--------------------------|---------|----------|-------------------------------------|
| StatusInterval | | False | Interval for displaying status in |
| | | | milliseconds. |
|--------------------------|---------|----------|-------------------------------------|
| Stealth | | False | Use stealth collection options, |
| | | | will sacrifice data quality in |
| | | | favor of much reduced network |
| | | | impact. |
|--------------------------|---------|----------|-------------------------------------|
| Throttle | | False | Throttle requests to computers (in |
| | | | milliseconds). |
|--------------------------|---------|----------|-------------------------------------|
| WindowsOnly | | False | Limits computer collection to |
| | | | systems that have an |
| | | | operatingssytem attribute that |
| | | | matches *Windows*. |
|--------------------------|---------|----------|-------------------------------------|
| ZipFilename | | False | Name for the zip file output by |
| | | | data collection. |
'--------------------------'---------'----------'-------------------------------------'
(Empire: usemodule/powershell/situational_awareness/network/bloodhound3) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/powershell/situational_awareness/network/bloodhound3) > set CollectionMethod Default
[*] Set CollectionMethod to Default
(Empire: usemodule/powershell/situational_awareness/network/bloodhound3) > execute
[*] Tasked Y4LHEV83 to run Task 1
...
Now wait for the results to come.
Authors
References
- https://github.com/BC-SECURITY/Empire/tree/master/empire/server/modules/powershell/situational_awareness/network/bloodhound3.yaml
- https://github.com/BC-SECURITY/Empire/tree/master/empire/server/data/module_source/situational_awareness/network/BloodHound3.ps1
- https://bit.ly/getbloodhound
- http://attack.mitre.org/techniques/T1484
See Also
Check also the following modules related to this module:
- powershell/situational_awareness/network/arpscan
- powershell/situational_awareness/network/reverse_dns
- powershell/situational_awareness/network/get_sql_server_info
- powershell/situational_awareness/network/smbscanner
- powershell/situational_awareness/network/bloodhound
- powershell/situational_awareness/network/get_kerberos_service_ticket
- powershell/situational_awareness/network/portscan
- powershell/situational_awareness/network/get_sql_instance_domain
- powershell/situational_awareness/network/smblogin
- powershell/situational_awareness/network/smbautobrute
- powershell/situational_awareness/network/get_spn
Version
This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.
