BloodHound Deep Dive Part 8: A Full Walkthrough, From Foothold to a Graph-Confirmed Credential

Seven posts, one lab, one foothold. This closes the series by walking CONTOSO.LOCAL from j.reyes’s workstation login through every step this series covered, in the order a real engagement would actually run them.

Starting point

Everything here starts exactly where Impacket Deep Dive Part 1 left off: CONTOSO\j.reyes, a standard domain user, local admin on WKS01 only, no other privileges known yet. Impacket’s own series went straight from there to manual enumeration with samrdump.py and GetADUsers.py. This walkthrough takes the step that series skipped.

Collection

From WKS01, as j.reyes, a DCOnly SharpHound run is the obvious choice on a domain this size, covered in Part 2:

C:\> SharpHound.exe --CollectionMethods DCOnly --Domain CONTOSO.LOCAL --OutputDirectory C:\temp\

That run, touching only DC01, produces zipped JSON covering group memberships, ACL data, and object properties, everything Parts 4 through 6 of this series query against.

Ingestion

That zip, uploaded to a BloodHound Community Edition instance, becomes graph data through the pipeline Part 3 covered: the Go API parses it, Neo4j stores the resulting nodes and edges, Postgres holds nothing about the graph itself, only the application state around it. From here on, every query is Cypher against Neo4j, run for real against this series’ own seeded instance.

Querying: what’s roastable, and whether it matters

The first useful query isn’t a path search, it’s the property lookup from Part 5:

neo4j> MATCH (u:User {hasspn:true}) WHERE NOT u.name STARTS WITH 'KRBTGT' RETURN u.name AS kerberoastable;
kerberoastable
"SVC-BACKUP@CONTOSO.LOCAL"

neo4j> MATCH (u:User {dontreqpreauth:true}) RETURN u.name AS asrep_roastable;
asrep_roastable
"SVC-LEGACY-SCAN@CONTOSO.LOCAL"

Two candidates, both matching what Impacket Parts 3 and 4 found by hand. Before spending any hashcat time on either, the shortest-path query from Kerberoastable users to Domain Admins comes back empty, exactly as it did in Part 5. That’s the graph earning its keep before a single hash gets cracked: neither account’s roastability leads anywhere on its own.

Querying: the ACL path

The GenericAll query from Part 4 finds the other route:

neo4j> MATCH (n)-[r:GenericAll]->(m) RETURN n.name, type(r), m.name;
n.name, type(r), m.name
"IT-HELPDESK@CONTOSO.LOCAL", "GenericAll", "BACKUP OPERATORS@CONTOSO.LOCAL"

j.reyes, a member of IT-HELPDESK, holds that control transitively. Following it one hop further, Backup Operators’ ForceChangePassword over svc-legacy-scan completes a two-edge chain from a group j.reyes already belongs to, to a working credential, with no cracking involved.

Exploitation

Part 6 walked this with bloodyAD, the tool built specifically for turning ACL edges like these into LDAP writes:

$ bloodyAD --host 10.10.30.10 -d CONTOSO.LOCAL -u j.reyes -p 'Summer2026!' set password svc-legacy-scan 'N3wP4ssw0rd!'

That’s a graph-confirmed credential, reached through two AD access rights BloodHound modeled directly, GenericAll and ForceChangePassword, rather than through a cracked hash. Compared to Password Cracking Part 7’s full crack of the same domain, which needed real GPU time against svc-legacy-scan’s AS-REP hash to arrive at Sc4nn3r2019!, this route needed none. Same target account, two independent ways in, only one of which depended on password strength at all.

Where it stops, honestly

Nothing in this lab’s graph carries svc-legacy-scan, or svc-backup for that matter, onward to Domain Admins. That’s not a gap in this series, it’s an accurate reflection of a real engagement: BloodHound tells you what’s reachable from where you already are, not that everything eventually reaches Domain Admins. A real attacker at this point doesn’t stop, they go back to SharpHound with svc-legacy-scan’s new credential and collect again, since that account may have sessions, group memberships, or local admin rights that weren’t visible, or weren’t worth collecting, from j.reyes’s more limited starting position. Each new credential is a new vantage point into the same graph, and a real engagement loops through that cycle, collect, query, abuse, collect again, until it either reaches something worth having or genuinely runs out of edges.

Where this leaves the site’s offensive AD coverage

Between Impacket Deep Dive, Password Cracking and Wordlist Engineering, Pivoting and Tunneling, and this series, CONTOSO.LOCAL has now been enumerated by hand, cracked, tunneled through, and mapped as a graph, four different lenses on the same four accounts and three computers. Part 7 covered the detection side of the collection run and the ACL abuse chain specifically. What none of the four series can substitute for is the analyst deciding, at each step, which edge is worth following and which one leads nowhere, the same judgment call BloodHound’s own empty query results kept forcing throughout this series.