# bloodhound-ce.py

Syntax for grabbing a Python-based BloodHound collection.

# Run a Bloodhound CE collection

bloodhound-ce.py --zip -c All -d domain.com -u lowpriv -p 'LowPrivPass$' -dc 192.168.10.10

# Run with hashes instead of account username/password

bloodhound-ce.py --zip -c All -d domain.com -u lowpriv --hashes :xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -dc 192.168.10.10

# Run the modified version from SpecterOps

On a recent pentest I compromised a user who could join machines to the domain, and I learned on BloodHound Slack that my compromised user might have more underlying powers (as discussed here). To explore this I had to install a modified BloodHound.py as follows:

# Grab only the bloodhound-ce branch into a new folder
git clone --branch bloodhound-ce --single-branch https://github.com/garrettfoster13/BloodHound.py.git BloodHoundCE

# Change to the tool directory
cd BloodHoundCE

# Create + activate a fresh venv alongside this checkout
python3 -m venv venv
source venv/bin/activate

# Upgrade pip/setuptools to avoid build issues
pip install -U pip setuptools wheel

# Install the package (editable mode so your venv points directly at this checkout)
pip install -e .

# Sanity check
git rev-parse --abbrev-ref HEAD   # should print: bloodhound-ce
./bloodhound.py --help

Run the collection:

/bloodhound.py --zip -c All -d domain -u lowpriv -p 'xxxxx' -dc dc1.domain.com