Question

After compromising a low-privileged domain account on an internal Windows network, a penetration tester collects Active Directory data with SharpHound and imports it into BloodHound. The tester's goal is to find the most efficient route to Domain Admin without launching noisy brute-force or exploitation attempts against every host. Which BloodHound capability best supports this objective?

Accepted Answer

Running the 'Shortest Paths to Domain Admins from Owned Principals' query to visualize existing ACL, group, and session-based attack paths

Answer

Using the built-in password-spraying module to test the compromised credential against all discovered accounts

Answer

Exporting the graph to CSV and manually deploying a Metasploit exploit against each computer object

Answer

Enabling BloodHound's live packet-capture feature to sniff NTLMv2 hashes during collection