1. System Architecture & Workflow
The diagram below represents the system architecture and operational data flow routing designed for this project.
2. Part 1: Step-by-Step Action Items & Key Execution Steps
STEP 1
Enumerate Active Directory Domains using BloodHound
Run directory ingestors to capture relationship models inside domain targets.
- Log in to your domain-joined Windows target machine.
- Open a command prompt and execute
SharpHound.exe to harvest relationship JSON records.
- Copy the exported zip file to your Kali attacker host.
- In your Kali terminal, start the database daemon and BloodHound GUI tool:
$ sudo systemctl start neo4j && bloodhound &
This command starts the local Neo4j graph database backend and opens the BloodHound GUI window.
| Part | What It Does |
|---|
systemctl | System Control — manages systemd services (start, stop, enable, disable, check status) |
start | Starts the specified service immediately |
- In the BloodHound GUI, log in, drag and drop the zip file into the window, and wait for ingest completion.
- Click on the Analysis tab, and select Find Shortest Paths to Domain Admins. Inspect the graph mappings.
STEP 2
Execute Pass-the-Hash (PtH) Lateral Movement
Perform authentication redirects using NTLM hashes instead of plaintext passwords.
- Retrieve the local Administrator NTLM hash via Mimikatz dump tasks.
- In your Kali Linux shell, run
evil-winrm to connect using the hash value:
$ evil-winrm -i 192.168.56.20 -u Administrator -H ccef208c6426a0902012c802bc37ae46
This command establishes an administrative shell session on target host 192.168.56.20 using the NTLM hash of the Administrator account.
| Part | What It Does |
|---|
-i | Case-insensitive search |
-u | Show only UDP connections |
-H | Adds a custom HTTP header to the request |
4. Part 2: Complete Deliverable Assets & Production Templates
To inspect active configuration settings inside domain targets, we will write a local PowerShell script named Get-ADAudit.ps1:
PS> .\Get-ADAudit.ps1
This executes the PowerShell script locally to gather active password policies.
Code Breakdown — Line by Line
Copy
Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# Get-ADAudit.ps1 - Active Directory domain policies auditor
Line 2: This is a comment that describes what the code does: "Get-ADAudit.ps1 - Active Directory domain policies auditor". Comments start with # and are ignored by Python.
Write-Host "[*] Inspecting Local AD Database baselines..." -ForegroundColor Cyan
Line 3: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
try {{
Line 4: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
Import-Module ActiveDirectory -ErrorAction Stop
Line 5: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
$Domain = Get-ADDomain
Line 6: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
$PassPolicy = Get-ADDefaultDomainPasswordPolicy
Line 7: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
Write-Host "[+] Domain: $($Domain.DNSRoot)"
Line 8: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
Write-Host "[+] Min Password Length: $($PassPolicy.MinPasswordLength)"
Line 9: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
Write-Host "[+] Lockout Threshold: $($PassPolicy.LockoutThreshold)"
Line 10: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
}} catch {{
Line 11: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
Write-Warning "AD Module not present. Ensure running on a domain-joined target VM."
Line 12: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
}}
Line 13: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.
Copy
# Get-ADAudit.ps1 - Active Directory domain policies auditor
Write-Host "[*] Inspecting Local AD Database baselines..." -ForegroundColor Cyan
try {{
Import-Module ActiveDirectory -ErrorAction Stop
$Domain = Get-ADDomain
$PassPolicy = Get-ADDefaultDomainPasswordPolicy
Write-Host "[+] Domain: $($Domain.DNSRoot)"
Write-Host "[+] Min Password Length: $($PassPolicy.MinPasswordLength)"
Write-Host "[+] Lockout Threshold: $($PassPolicy.LockoutThreshold)"
}} catch {{
Write-Warning "AD Module not present. Ensure running on a domain-joined target VM."
}}
5. Deliverables Summary
Created Files / Templates
Get-ADAudit.ps1 - AD domain policies inspector script- Graph mapping file exported from BloodHound in JSON/PNG
Verification Artifacts
- Screenshot of evil-winrm shell session displaying the target administrative command console.
- BloodHound shortest path query graph visualization.
3. Automation Architecture
The diagram below highlights the automated execution flow pipeline or scripting loop implemented for this module.
