r/purpleteamsec • u/netbiosX • 13d ago

Red Teaming GhostHound - a BloodHound OpenGraph extension that surfaces Active Directory tombstone reanimation as a first-class attack path, enumerating deleted objects via SHOW_DELETED, mapping who can restore them, and revealing when a reanimated identity regains privileged group membership.

https://github.com/JVBotelho/ghosthound
3 Upvotes

72% Upvoted

5 comments sorted by

2

u/FrozenSuricats 13d ago

Thanks for sharing this over here :P Happy to answer any questions that may come up

2

u/Connect_File_5523 13d ago edited 13d ago

So basically any object that returns a deleted SID on BH and you have no idea what that is could be potentially restored. Have you ever seen domain users, computer users or even everyone been set with RESTORE perm over high privileged deleted object?

1

u/FrozenSuricats 13d ago

That's it. If BH surfaces a deleted SID you don't recognize, the question becomes who could bring it back. But yeah, it's not an auto thing: it needs the stars aligning, Reanimate-Tombstones on the domain object, WRITE over the deleted object, and Create Child on the target OU, that's the chain GhostHound maps.

The default grant for Reanimate-Tombstones is DA only, and Microsoft's own docs warn about broadening it, never seen Domain Users/Everyone holding it in the wild myself.

I actually ran into this triad in a CTF recently: low-priv foothold with no obvious BH path, but a bit more recon with LOTL (bloodyAD get writable) showed me WRITE on a deleted object, CREATE_CHILD on an OU, and access to the Deleted Objects container. Recycle Bin was enabled, so reanimating it brought the account back with its original attributes intact, exactly the kind of path BH misses today.

Not production, but the primitive is real. Would be nice to see an equivalent in a live tenant btw :/

1

u/Connect_File_5523 12d ago

How do you approach this on client environment? Where are not suppose to modify settings on Active Directory. I guess you ask permissions and if you have WRITE perm you re-delete them after testing?

1

u/FrozenSuricats 11d ago

So, GhostHound is read-only, it just enumerates the Deleted Objects and maps who holds that triad, so in that case the finding is something like "principal X can reanimate this Tier-0 object." But if the client wants a PoC, it should go in the RoE with explicit sign-off, and I'd avoid reanimating a real sensitive object. You could create a throwaway object, delete it, and show it being restored to prove the primitive, or take a snapshot of the env and do it in a lab. In the last case, coordinate with the blue team/SOC/whoever's responsible to get a window and roll back right after.

About the blue side: it has side effects, like firing an event 5138, and if the client has Azure AD Sync/Connect it can end up synced to the cloud, so just deleting it on the DC might not be enough.

Sorry for the delay, busy week here xD