Bloodhound Data Collection

Picture31

This is part 2 of the series on Bloodhound. For setting up the database and the tool refer to Part 1.

BloodHound data is done using the BloodHound.ps1 file located at:

https://github.com/adaptivethreat/BloodHound/tree/master/PowerShell

Clone the file and upload it to a host you have foothold.

From either CMD or PS shell cd to a folder you have write access and follow these steps:

  1. Upload the BloodHound.ps1 file
  2. powershell.exe –Exec Bypass
  3. Import Module BloodHound.ps1
  4. Get-BloodHoundData | Export-BloodHoundCSV
  5. Export the .csv files locally

*There is an API for sending the data directly from Cobalt Strike to BloodHound but it is not described in this post.

The above command will create 4 .csv files which can later be imported into BloodHound

  1. group_memberships.csv
  2. local_admins.csv
  3. trusts.csv
  4. user_sessions.csv

Use the upload data functionality to import the 4 .csv files created before.

2

In Part 3 of the series we will look into working with the database and results.