Collect BloodHound Data (nxc, bloodhound-python, SharpHound)

Multiple ways to gather BloodHound data — remotely with netexec or bloodhound-python from Kali, or on-host with SharpHound — plus the Neo4j/Java steps needed to view the results.

Collect Active Directory data for BloodHound either remotely from Kali or by running SharpHound on a Windows host, then load the resulting data into Neo4j.

Remote collection from Kali

With netexec's LDAP BloodHound module:

``bash nxc ldap <IP> -u <USER> -p '<PASS>' -d <TARGET> --dns-server <IP> --bloodhound --collection All ``

Or with bloodhound-python (use --dns-tcp when UDP DNS is flaky, --zip to bundle the output):

``bash bloodhound-python --dns-tcp -c ALL -u <USER> -p '<PASS>' -d <TARGET> -ns <IP> python3 /usr/bin/bloodhound-python --dns-tcp -ns <IP> -d <TARGET> -u '<USER>' -p '<PASS>' -c all --zip ``

On-host collection with SharpHound

Download SharpHound, upload it to the target, run it, then download the generated ZIP:

``cmd wget https://github.com/BloodHoundAD/SharpHound/releases/download/v1.1.0/SharpHound.exe .\SharpHound.exe -c All ``

Viewing the data

The legacy BloodHound GUI needs Java 17 (not 21) and a running Neo4j (default login neo4j:neo4j):

``bash sudo update-alternatives --config java sudo neo4j start ``

Then start BloodHound (e.g. ./bin/neo4j start and ./BloodHound --disable-gpu --no-sandbox) and upload the collected ZIP.