ADPathFinder OpenGraph Attack Path Mapping in BloodHound CE

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://netspi.com/blog/technical-blog/network-pentesting/adpathfinder-opengraph-attack-path-mapping-in-bloodhound-ce
• Blog Title: ADPathFinder: OpenGraph Attack Path Mapping in BloodHound CE
• Suggested Section: Windows Hardening > Active Directory Methodology > BloodHound & Other AD Enum Tools, with cross-references to AD Certificates, MSSQL AD Abuse, and SCCM-related attack paths

🎯 Content Summary

ADPathFinder is an internal penetration-testing and graph-analysis tool for BloodHound CE. It automates the discovery, consolidation, and prioritization of privilege-escalation paths across Active Directory (AD), Active Directory Certificate Services (ADCS), Microsoft SQL Server (MSSQL), and Microsoft Configuration Manager (SCCM). The tool is available from the AD-PathFinder GitHub repository.

Why ADPathFinder ...

🔧 Technical Details

Cross-technology attack-path chaining: Import identity and authorization relationships from multiple BloodHound/OpenGraph collectors into a single graph, then search for paths that cross technology boundaries. For example, an AD principal may possess a SQL login through MSSQL_HasLogin, impersonate a more privileged SQL identity through MSSQL_ExecuteAs, connect to a database server through MSSQL_Connect, traverse an administratively configured linked server through MSSQL_LinkedAsAdmin, obtain host execution through MSSQL_ExecuteOnHost, and inherit powerful SCCM control through SCCM_AssignAllPermissions. Analyze the effective identity at every edge because a path becomes critical when one transition executes as a highly privileged domain account.

Shared-edge path grouping and choke-point remediation: Calculate shortest paths from many low-privileged users and comp...

🤖 Agent Actions

Done.

Updated:

• src/windows-hardening/active-directory-methodology/bloodhound.md

Added:

• A new ADPathFinder subsection under the BloodHound/OpenGraph area
• Concise coverage of:
  • cross-dataset AD/MSSQL/SCCM path chaining
  • shared-edge/choke-point remediation
  • graph-aware severity reprioritization
  • password-to-path correlation with NTDS + potfile input
• Inline cross-references to:
  • ad-certificates.md
  • abusing-ad-mssql.md
  • sccm-management-point-relay-sql-policy-secrets.md
• Blog link in the file’s ## References section

Verified:

• Diff looks correct
• Internal linked files exist

Note:

• mdbook build could not be executed because mdbook is not installed in this environment.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://netspi.com/blog/technical-blog/network-pentesting/adpathfinder-opengraph-attack-path-mapping-in-bloodhound-ce

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Active Directory Methodology > BloodHound & Other AD Enum Tools, with cross-references to AD Certificates, MSSQL AD Abuse, and SCCM-related attack paths".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge