Lion Cipher Lab
Read BloodHound output: find the Active Directory privilege paths worth cutting
- Penetration Testing / Red Team
- Advanced
- ~50 min
- Free · no account required
Why it matters
The most damaging Active Directory attacks almost never need a new exploit. They need a PATH: an ordinary account that, through a chain of everyday permissions nobody reviewed together, can reach Domain Admin — total control of the directory and therefore every machine and identity it manages. BloodHound is the tool that draws that chain as a graph, and its highest-value use is defensive: it shows YOU, the owner, the escalation routes hiding in your own permissions so you can remove them first. But the graph only helps if you can read it. A screen full of nodes and edges is useless until you…
What you'll learn
- reading a BloodHound graph as nodes (users/groups/computers) and edges (the rights between them)
- knowing what MemberOf, AdminTo, GenericAll, HasSession and DCSync each MEAN and what they IMPLY
- tracing a transitive path from a low-privilege principal to Domain Admins, hop by hop
- identifying the ONE excessive edge that makes an escalation path possible
- deciding which permission to remove to break the path — fixing the CLASS, not one account
- reading a 'principals with DCSync rights' list and spotting a Tier 0-equivalent finding that never touches the Domain Admins group
- judgment: when the graph reveals what a manual ACL review can't (transitive paths) and its limits (a config snapshot, not proof of exploitation)
- prioritizing paths that terminate at Tier 0 and re-collecting to verify a cut
Steps in this lab
- Who you are here: the administrator reading a map of your own directory
- BloodHound draws AD as a graph: nodes and edges
- The five edge types in this report — what each one MEANS and IMPLIES
- The output, part 1: the node and edge inventory
- The output, part 2: 'Shortest Paths to Domain Admins'
- Find the ONE excessive edge that makes the path possible
- The defender's payoff: remove the right permission, and fix the CLASS
- The output, part 3: the DCSync and GenericAll rights lists (a second finding)
- When the graph answers the question — and when it can't (read this before you trust it)
- What you can now do, and where to take it