Package: autobloody
autobloodyautobloodyis a tool to automatically exploit Active Directory privilege escalation paths shown by BloodHound.DescriptionThis tool automates the AD privesc between two AD objects, the source (the one we own) and the target (the one we want) if a privesc path exists in BloodHound database.
The automation is composed of two steps:Finding the optimal path for privesc using bloodhound data and neo4j queries.Execute the path found usingbloodyADpackageBecause autobloody relies onbloodyAD, it supports authentication using cleartext passwords, pass-the-hash, pass-the-ticket or certificates and binds to LDAP services of a domain controller to perform AD privesc.InstallationFirst if you run it on Linux, you must havelibkrb5-devinstalled on your OS in order for kerberos to work:# Debian/Ubuntu/Kaliapt-getinstalllibkrb5-dev# Centos/RHELyuminstallkrb5-devel# Fedoradnfinstallkrb5-devel# Arch Linuxpacman-Skrb5A python package is available:pipinstallautobloodyOr you can clone the repo:gitclone--depth1https://github.com/CravateRouge/autobloodypipinstall.DependenciesbloodyADNeo4j python driverNeo4j with theGDS libraryBloodHoundPython 3Gssapi (linux) or Winkerberos (Windows)How to use itFirst data must be imported into BloodHound (e.g using SharpHound or BloodHound.py) and Neo4j must be running.:warning:-ds and -dt values are case sensitiveSimple usage:autobloody-ujohn.doe-p'Password123!'--host192.168.10.2-dp'neo4jP@ss'-ds'JOHN.DOE@BLOODY.LOCAL'-dt'BLOODY.LOCAL'Full help:[bloodyAD]$./autobloody.py-husage:autobloody.py[-h][--dburiDBURI][-duDBUSER]-dpDBPASSWORD-dsDBSOURCE-dtDBTARGET[-dDOMAIN][-uUSERNAME][-pPASSWORD][-k][-cCERTIFICATE][-s]--hostHOSTADPrivescAutomationoptions:-h,--helpshowthishelpmessageandexit--dburiDBURIThehostneo4jisrunningon(defaultis"bolt://localhost:7687")-duDBUSER,--dbuserDBUSERNeo4jusernametouse(defaultis"neo4j")-dpDBPASSWORD,--dbpasswordDBPASSWORDNeo4jpasswordtouse-dsDBSOURCE,--dbsourceDBSOURCECasesensitivelabelofthesourcenode(namepropertyinbloodhound)-dtDBTARGET,--dbtargetDBTARGETCasesensitivelabelofthetargetnode(namepropertyinbloodhound)-dDOMAIN,--domainDOMAINDomainusedforNTLMauthentication-uUSERNAME,--usernameUSERNAMEUsernameusedforNTLMauthentication-pPASSWORD,--passwordPASSWORDCleartextpasswordorLMHASH:NTHASHforNTLMauthentication-k,--kerberos-cCERTIFICATE,--certificateCERTIFICATECertificateauthentication,e.g:"path/to/key:path/to/cert"-s,--secureTrytouseLDAPoverTLSakaLDAPS(defaultisLDAP)--hostHOSTHostnameorIPoftheDC(ex:my.dc.localor172.16.1.3)How it worksFirst a privesc path is found using the Dijkstra's algorithm implemented into the Neo4j's GDS library.
The Dijkstra's algorithm allows to solve the shortest path problem on a weighted graph. By default the edges created by BloodHound don't have weight but a type (e.g MemberOf, WriteOwner). A weight is then added to each edge accordingly to the type of edge and the type of node reached (e.g user,group,domain).Once a path is generated,autobloodywill connect to the DC and execute the path and clean what is reversible (everything exceptForcePasswordChangeandsetOwner).LimitationsFor now, only the following BloodHound edges are currently supported for automatic exploitation:MemberOfForceChangePasswordAddMembersAddSelfDCSyncGetChanges/GetChangesAllGenericAllWriteDaclGenericWriteWriteOwnerOwnsContainsAllExtendedRights