ADPathFinder Maps Cross-Dataset Attack Paths in BloodHound
Summary
ADPathFinder combines BloodHound data with OpenGraph collectors to map privilege-escalation paths across AD, ADCS, MSSQL, and SCCM. It also audits cracked passwords with account and graph context and generates reports.
Key points
- The tool combines SharpHound data with OpenGraph collector data, including MSSQLHound and ConfigManBearPig, to analyze relationships across multiple datasets.
- It maps paths from lower-privileged users and computers to high-value targets, grouping principals that share the same path.
- Its checks cover ADCS, SCCM, and MSSQL issues, as well as standalone findings such as disabled SMB signing and delegation misconfigurations.
- Password auditing can use an NTDS dump and hashcat potfile to flag weak or reused passwords and add BloodHound context such as group membership and escalation paths.
- Reports include HTML, text, and JSON output; HTML findings include attack-path graphs and commands to confirm steps.
- The article warns that NTDS dumps, potfiles, and generated reports are sensitive, and that the optional unsafe-report output can include cleartext passwords.
Article Details
- Topic
- ADPathFinder, a tool for mapping cross-dataset privilege-escalation paths and auditing passwords using BloodHound graph data.
People
Products
Tools
ADPathFinderADPathFinder was built for the part of an internal assessment where BloodHound has the answer, but you don’t have time to find it.ConfigManBearPigIt joins SharpHound with OpenGraph collectors like MSSQLHound and ConfigManBearPig, so cross-dataset paths show up as one finding instead of separate leads you have to piece together.MSSQLHoundIt joins SharpHound with OpenGraph collectors like MSSQLHound and ConfigManBearPig, so cross-dataset paths show up as one finding instead of separate leads you have to piece together.SharpHoundThe hard gains are in the graph, so you fire up BloodHound and load SharpHound alongside OpenGraph data for MSSQL and SCCM context.