BloodHound Collection

Covers step 2 of OSCP AD Set - Assumed Breach Methodology. Run early, as soon as any valid creds exist.

Collect

Option 1: bloodhound-python (remote, LDAP only, no agent)

# from Linux, no agent needed:
bloodhound-python -u <user> -p <pass> -d <domain> -ns <DC-IP> -c All --zip

Option 2: nxc built-in collector (same engine as bloodhound-python)

nxc ldap <DC-IP> -u <user> -p <pass> --bloodhound --collection All

Convenient if nxc is already the tool in hand, one less thing to install. Under the hood it wraps the same bloodhound-python library, so it has the same LDAP-only limitations as Option 1 (see below) - it is not a separate/more accurate method, just a different entry point to the same one. Output zip lands in $HOME/.nxc/logs/.

Option 3: SharpHound (run from an actual Windows domain session - more accurate)

.\SharpHound.exe -c All -d <domain> --domaincontroller <DC-IP> --zipfilename <name>

Run this from a box where you have a real domain-user logon session (WinRM/RDP as a domain account works, local-admin-only shells don't count since they're not domain-authenticated). Uses native Win32 APIs (NetSessionEnum, NetWkstaUserEnum, NetLocalGroupGetMembers) instead of LDAP-only queries, so:

HasSession edges come back far more complete - bloodhound-python's/nxc's session enum is remote-LDAP based and frequently under-reports
Auth is natural Kerberos from a domain-joined box, avoiding the NTLM-fallback-on-TGT-failure issue that pure LDAP collectors can hit
Cert Services (ADCS/ESC path) data is generally cleaner when collected from inside the domain

Check AV/Defender status on the collection host first (Get-MpComputerStatus) - SharpHound.exe gets flagged by most AV, unlike the two LDAP-based options above.

Recommended order: run Option 1 or 2 immediately once you have any valid creds (fast, remote, no host needed), then re-run with Option 3 from the first domain-authenticated Windows session you land, and merge both zips into the same BloodHound ingest.

Analyze in BloodHound CE

Import the zip and check:

Shortest Path to Domain Admins
Shortest Path from Owned Principals (mark the starting user as Owned)
Kerberoastable / ASREPRoastable users
Unconstrained/constrained/RBCD delegation

See BloodHound Edge Risk to judge which edges are worth chasing first.

No BloodHound / It's Misbehaving?

Fall back to Manual LDAP Enumeration. The exam sometimes has AV/EDR blocking collectors, so manual enum matters too.

Once a path is found: ACL & Edge Abuse or Cheatsheets/Active Directory/Grabbing Credst the graph shows.