Package: bofhound
_____________________________ __    __    ______    __    __   __   __   _______
             |   _   /  /  __   / |   ____/|  |  |  |  /  __  \  |  |  |  | |  \ |  | |       \
             |  |_)  | |  |  |  | |  |__   |  |__|  | |  |  |  | |  |  |  | |   \|  | |  .--.  |
             |   _  <  |  |  |  | |   __|  |   __   | |  |  |  | |  |  |  | |  . `  | |  |  |  |
             |  |_)  | |  `--'  | |  |     |  |  |  | |  `--'  | |  `--'  | |  |\   | |  '--'  |
             |______/   \______/  |__|     |__|  |___\_\________\_\________\|__| \___\|_________\
           
                                         << @coffeegist | @Tw1sm >>BOFHound is an offline BloodHound ingestor and LDAP result parser compatible with TrustedSec'sldapsearch BOF, the Python adaptation,pyldapsearchand Brute Ratel'sLDAP Sentinel.By parsing log files generated by the aforementioned tools, BOFHound allows operators to utilize BloodHound's beloved interface while maintaining full control over the LDAP queries being run and the spped at which they are executed. This leaves room for operator discretion to account for potential honeypot accounts, expensive LDAP query thresholds and other detection mechanisms designed with the traditional, automated BloodHound collectors in mind.Check thisPRto the SA BOF repo for BOFs that collect session and local group membership data and can be parsed by BOFHound.Related BlogsBlog - Granularize Your AD Recon GameBlog - Granularize Your AD Recon Game Part 2InstallationBOFHound can be installed withpip3 install bofhoundor by cloning this repository and runningpip3 install .UsageExample UsageParse ldapseach BOF results from Cobalt Strike logs (/opt/cobaltstrike/logsby default) to /data/bofhound -o /data/Parse pyldapsearch logs and only include all properties (vs only common properties)bofhound -i ~/.pyldapsearch/logs/ --all-propertiesParse LDAP Sentinel data from BRc4 logs (will change default input path to/opt/bruteratel/logs)bofhound --brute-ratelldapsearchRequired DataThe following attributes are required for proper functionality:samaccounttype
dn
objectsidSome object classes rely on domain objects being populated within BOFHound. Domains can be queried with either of the following commandsldapsearch (objectclass=domain) *,ntsecuritydescriptor
ldapsearch (distinguishedname=DC=windomain,DC=local) *,ntsecuritydescriptorExample ldapsearch QueriesGet All the Data (Maybe Run BloodHound Instead?)ldapsearch (objectclass=*) *,ntsecuritydescriptorRetrieve All Schema Infoldapsearch (schemaIDGUID=*) name,schemaidguid -1 "" CN=Schema,CN=Configuration,DC=windomain,DC=localRetrieve Only the ms-Mcs-AdmPwd schemaIDGUIDldapsearch (name=ms-mcs-admpwd) name,schemaidguid 1 "" CN=Schema,CN=Configuration,DC=windomain,DC=localRetrieve Domain NetBIOS Names (useful if collecting data vianetsession2/netloggedon2BOFs)ldapsearch (netbiosname=*) * 0 "" "CN=Partitions,CN=Configuration,DC=windomain,DC=local"VersionsCheck the tagged releases to download a specific versionv0.3.0 and onward support session/local group datav0.2.1 and onward are compatible with BloodHound CEv0.2.0 is the last release supporting BloodHound LegacyDevelopmentbofhound uses Poetry to manage dependencies. Install from source and setup for development with:gitclonehttps://github.com/fortalice/bofhoundcdbofhound
poetryinstall
poetryrunbofhound--helpReferences and Credits@_dirkjan(and other contributors) forBloodHound.pyTrustedSec forCS-Situational-Awareness-BOF