Active Directory Hacking Cheat Sheet

Active Directory is still the main target in most enterprise networks. SharpHound pulls the data into JSON files, but the real value comes from turning that raw output into clear attack paths and spotting the misconfigurations that actually matter. BloodBash is a lightweight Python tool that reads SharpHound and AzureHound JSON files, builds an in-memory graph, and surfaces the important findings without needing Neo4j or any web interface. It runs completely offline and gives you terminal output with context on why each issue is useful to an attacker plus suggestions on how to abuse it.

Quick Start

Grab the standalone binary so you do not need Python or a venv.

On Linux:

curl -sL -o bloodbash https://github.com/DotNetRussell/BloodBash/releases/latest/download/bloodbash-linux-x64
chmod +x bloodbash
./bloodbash /path/to/json --all

On Windows use the .exe from the same releases page and run it the same way.

If you prefer source:

pipx install git+https://github.com/DotNetRussell/BloodBash

Or clone it and install the small set of requirements. The repo includes sample SharpHound and AzureHound data you can test against right away.

Basic run against a collection folder or zip:

python3 BloodBash.py /path/to/sharpout --all --verbose

Add --fast when you want quicker results limited to the highest value targets. Use --domain to focus on one domain or tenant when the collection contains more than one.

Kerberos Attacks

Kerberoastable accounts have a Service Principal Name. Any authenticated user can request a ticket for that service and crack it offline with hashcat or similar tools. Service accounts often have weak or static passwords that never rotate, so one cracked ticket can give long-term access for lateral movement.

python3 BloodBash.py sharpout --kerberoastable

AS-REP roastable accounts have the DoNotRequirePreauth flag set. You can request an AS-REP without any user interaction and crack it offline. These show up frequently on legacy service accounts.

python3 BloodBash.py sharpout --as-rep-roastable

Delegation Abuses

Unconstrained delegation appears on computers or users with the TrustedForDelegation flag. When a user authenticates to that system their TGT gets cached. Compromise the machine and coerce authentication to steal tickets for high-value accounts including Domain Admins.

python3 BloodBash.py sharpout --unconstrained-delegation

Constrained delegation limits the target services via the msDS-AllowedToDelegateTo attribute. If you control the delegating account you can impersonate users to those specific services.

python3 BloodBash.py sharpout --constrained-delegation

Resource-based constrained delegation (RBCD) uses the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on the target computer. You only need write access to that attribute on the target. This lets you impersonate any user to the machine and is one of the more common modern escalation paths from a regular user foothold.

python3 BloodBash.py sharpout --rbcd

AD Certificate Services

ADCS misconfigurations in templates and permissions (ESC1 through ESC8) let low-privileged users request certificates that specify arbitrary identities or gain enrollment agent rights. A single vulnerable template can produce a certificate equivalent to a golden ticket.

python3 BloodBash.py sharpout --adcs

Replication and Credential Dumping

DCSync rights come from the Replicating Directory Changes and Replicating Directory Changes All permissions. Any principal with those rights can pull password hashes for the entire domain, including krbtgt, without touching a domain controller directly.

python3 BloodBash.py sharpout --dcsync

Dangerous Permissions and ACLs

GenericAll, WriteDacl, WriteOwner, ResetPassword, and similar rights on Domain Admins groups, high-value users, computers, or OUs let an attacker take control quickly. BloodBash highlights these especially when they apply to high-value targets.

python3 BloodBash.py sharpout --dangerous-permissions --high-value

Group Policy Abuse

Weak permissions on GPOs combined with the ability to edit scheduled tasks, startup scripts, or legacy cPassword fields in the XML let you push code that runs as SYSTEM across many systems. Point the tool at the GPO backup folder to parse the actual content.

python3 BloodBash.py sharpout --gpo-abuse --gpo-content-dir /path/to/gpo/backups

Additional Credential and Persistence Issues

Shadow credentials use the KeyCredentialLink attribute. An attacker with write access can register a public key and authenticate as that principal without knowing the password.

python3 BloodBash.py sharpout --shadow-credentials

SID history abuse adds SIDs from previous domains or trusted domains to an account. Adding a Domain Admins SID from a trusted domain instantly grants those rights.

python3 BloodBash.py sharpout --sid-history

Accounts with passwords stored in the description field, PasswordNeverExpires, or PasswordNotRequired are low-hanging fruit. These often belong to service accounts that never get cleaned up.

python3 BloodBash.py sharpout --password-descriptions --password-never-expires --password-not-required

Local Admin, Sessions, and LAPS

BloodBash reports on LAPS deployment status and maps LocalAdmin, RDP, and DCOM rights along with current sessions. This tells you exactly which machines a compromised account can reach and who is logged in where for targeted follow-up.

python3 BloodBash.py sharpout --laps --sessions

Shortest Path and Compromise Analysis

The tool calculates shortest attack paths to high-value targets such as Domain Admins, Enterprise Admins, and krbtgt. Mark principals you already control with --owned or use --from-user to generate a full compromise dossier for a specific foothold account. The dossier shows nested group memberships, AdminTo and RDP counts, ACL paths, and auto-generated paths to high-value targets. Export the dossier to text, CSV, or JSON for reporting.

python3 BloodBash.py sharpout --from-user alice --from-user-export

Additional flags like --busiest-paths rank which principals sit on the most paths to high-value targets, and --path-break suggests which relationships to remove to disrupt the largest number of paths.

Azure and Entra ID Coverage

BloodBash also ingests AzureHound JSON. Use the Azure-specific flags to surface privileged role assignments, application and service principal credential paths you can abuse, explicit MFA bypass configurations, guest user issues, and service principal abuse rights. These are especially relevant in hybrid environments.

python3 BloodBash.py azureout --azure-privileged-roles --azure-app-secrets --azure-guest-access

Output, Exports, and Reporting

Add export flags to save results instead of just printing them.

python3 BloodBash.py sharpout --all --export=html --export=md

Other options include JSON, CSV, YAML, BloodHound-style graph JSON, and Graphviz DOT. Use --report-pack to generate a multi-page HTML report suite with per-section CSVs, or --export-zip to bundle everything into a single deliverable. Profiles let you save common flag combinations in a YAML file for repeatable runs.

A single command that covers most of the high-impact checks:

python3 BloodBash.py sharpout --adcs --dcsync --gpo-abuse --rbcd --dangerous-permissions --kerberoastable --as-rep-roastable --shortest-paths --verbose

Final Notes

BloodBash is a fast offline analyzer built for practical pentester and pentest work. It uses heuristics and the actual collector data, so validate critical paths in BloodHound CE when you need full visual confirmation or want to cross-check edge cases. The project includes unit tests, a Metasploit auxiliary module that wraps the CLI, and ongoing updates for newer SharpHound CE output formats.

Check the GitHub repository for the latest flags, sample data, and the full help output. Run SharpHound, point BloodBash at the JSON, and you will have a clear picture of the real attack surface without standing up extra infrastructure.