BloodHound

https://github.com/BloodHoundAD/BloodHound

$ cd /opt
$ sudo git clone https://github.com/BloodHoundAD/BloodHound.git
$ sudo wget https://github.com/BloodHoundAD/BloodHound/releases/download/3.0.3/BloodHound-linux-x64.zip

Neo4j has to be running for Bloodhound web app to work:

$ sudo neo4j console

Set the password if you haven't already.

Start bloodhound:

$ /opt/Bloodhound/BloodHound-linux-x64$ sudo ./Bloodhound --no-sandbox

https://github.com/BloodHoundAD/BloodHound/releases

https://github.com/BloodHoundAD/SharpHound3

Execute on target:

C:\> .\SharpHound.exe -c all

or in Powershell with .ps1 version

C:\> import-module .\sharphound.ps1
C:\> invoke-bloodHound -CollectionMethod all -domain <target-domain> -LDAPUser <username> -LDAPPass <password>

Note: -domain, -LDAPUser, and -LDAPPass are optional and bloodhound will run with only the -CollectionMethod flag.

Other useful sharphound flags:

• --encryptzip: allows you to encrypt the file using a random password
• --zipfilename: allows you to name the outputted filename so that "bloodhound" isn't in the name in case AV catches it.

If you want to run SharpHound from a PC that is not joined to the target domain, open a command prompt and run:

C:\> runas /netonly /user:DOMAIN\USER powershell.exe

Then run the PS commands listed above as the domain user in the PowerShell context.

Note: Only compatiable with BloodHound 3.0 or newer

https://github.com/fox-it/BloodHound.py