Lion Cipher Lab

Review AD attack paths with BloodHound (AD series, part 3)

• Penetration Testing / Red Team
• Advanced
• ~90 min
• Free · no account required

Why it matters

Once an attacker has any foothold inside a Windows network, their real goal is almost always the same: reach Domain Admin, the account that controls the entire directory and therefore every machine, file, and identity in it. The unsettling thing is that they rarely need a new exploit to get there. Most directories have quietly accumulated a tangle of permissions — this group can reset that account's password, that account can add itself to this admin group — and strung together, those everyday permissions form a hidden staircase from an ordinary user all the way up to Domain Admin. Nobody…

What you'll learn

• understanding what an attack path, privilege escalation, and Domain Admin are, in plain words
• understanding what an ACL (access control list) is and why a single mis-set permission can become an escalation route
• understanding what a graph, a node, and an edge are, and why BloodHound draws Active Directory as a graph
• understanding what BloodHound and its SharpHound collector actually do, and the difference between them
• installing BloodHound Community Edition on your own machine with the official Docker-based installer
• downloading the official SharpHound collector and running it against your OWN Part 1 AD lab to gather permission data
• uploading the collected data into BloodHound and running the built-in 'Shortest Paths to Domain Admins' query
• reading an attack path edge by edge to understand exactly HOW one account could reach Domain Admin
• mapping what you see to how attackers use it (MITRE ATT&CK: BloodHound S0521, Valid Accounts: Domain Accounts T1078.002)
• remediating one attack path on your own directory — removing the abusable right or membership that created it

Steps in this lab

1. The one rule that keeps this legal: your OWN directory, nobody else's
2. The words you need first: attack path, privilege escalation, Domain Admin, ACL
3. The words you need next: graph, node, edge — and what BloodHound vs SharpHound do
4. Get your Part 1 lab ready (and, if you did it, Part 2's hardening)
5. Install BloodHound Community Edition on your own machine
6. Get the SharpHound collector (from BloodHound itself)
7. Run SharpHound to collect your directory's permissions
8. Upload the data into BloodHound
9. Ask the key question: who can reach Domain Admin?
10. Read the path edge by edge: understand exactly HOW it works
11. See it the way attackers do (MITRE ATT&CK: S0521 and T1078.002)
12. Remediate: remove the abusable permission on your own directory
13. Prove it: re-collect, re-check, and watch the path disappear
14. What you proved, how to clean up, and where it takes you

Open the full interactive lab →