SpecterOps/BloodHound

No execution or admin rights are shown in UI

Closed this issue · 5 comments

HanseSecure commented

Description:

In the Community Edition no execution or admin privilege permissions are shown.

Component(s) Affected:

  • UI

Steps to Reproduce:

Load the same sharphound data into the old and the new Bloodhound editions.

Expected Behavior:

Permissions are shown.

Actual Behavior:

No permssions are shown.

Screenshots/Code Snippets/Sample Files:

old UI
grafik

grafik

new UI

grafik

grafik

Environment Information:

BloodHound: 5.1.0

Collector: 2.0.0

OS: current Kali

Browser: Firefox ESR 91.5

Docker (if using Docker): 20.10

StephenHinck commented

You'll need to collect with SharpHound v2 for BHCE, while using SharpHound v1 for BloodHound Legacy - they use different schemas for the data outputs, specifically for local groups and privileges.

HanseSecure commented

I gathered the information with the Sharphound Version from the Commuinty Edition (Administration->Collector)

HanseSecure commented

@StephenHinck could you please reopen the issue? iam using the right collector

emanuelduss commented

I have exactly the same issue. BloodHound CE does not correctly show AdminTo edges.

Here's my documentation and SharpHound files so you can reproduce it if you want (only testdata ofc ;-)).

It looks like it's not a UI issue but an issue when processing the data during the import, because the information is also not available in the Neo4J DB.

BloodHound Legacy

Group WS1ADMINS is local admin of WS1:

image

It's also correctly in the Neo4J DB:

image

Data is collected in 20241011080952_ous.json:

[...]
      "GPOChanges": {
        "LocalAdmins": [
          {
            "ObjectIdentifier": "S-1-5-21-2070903584-3070904861-4042972969-1138",
            "ObjectType": "Group"
          }
        ],
        "RemoteDesktopUsers": [
          {
            "ObjectIdentifier": "S-1-5-21-2070903584-3070904861-4042972969-1138",
            "ObjectType": "Group"
          }
[...]

This is as expected.

BloodHound CE

Latest BloodHound CE version as of 25.10.2024:

$ docker compose images
CONTAINER                    REPOSITORY              TAG                 IMAGE ID            SIZE
bloodhound-ce-app-db-1       postgres                16                  bc02d8216d73        432MB
bloodhound-ce-bloodhound-1   specterops/bloodhound   latest              b949e49cb322        87.4MB
bloodhound-ce-graph-db-1     neo4j                   4.4                 f7cfcc88300d        507MB

Data is collected in 20241011071647_ous.json:

[...]
      "GPOChanges": {
        "LocalAdmins": [
          {
            "ObjectIdentifier": "S-1-5-21-2070903584-3070904861-4042972969-1139",
            "ObjectType": "Group"
          }
        ],
        "RemoteDesktopUsers": [
          {
            "ObjectIdentifier": "S-1-5-21-2070903584-3070904861-4042972969-1139",
            "ObjectType": "Group"
          },
          {
            "ObjectIdentifier": "CHILD.TESTLAB.LOCAL-S-1-1-0",
            "ObjectType": "Group"
          }
        ],
        "DcomUsers": [],
        "PSRemoteUsers": [],
        "AffectedComputers": [
          {
            "ObjectIdentifier": "S-1-5-21-2070903584-3070904861-4042972969-1154",
            "ObjectType": "Computer"
          }
        ]
      },
[...]

BloodHound does not show the admin relationship:

image

There is also no edge in Neo4J:

image

--> This is not as expected.

EDIT:

AdminTo edges are shown for Users (but not for groups):

image
StephenHinck commented

Thank you for that information. This is a duplicate of #280

  • 👍1