HTB Academy > Active Directory Bloodhound > Skills Assessment

I’m stuck completing the last question , I tired using every available cypher queries online still it’s giving me the wrong answer , if I could get some help , it would be appreciated .

Did anyone get the right answer for the last question? Any hint/nudge, it would be appreciated.

I got the answer but now how I was supposed to I don’t think. Reverse engineering from the answer I still can’t work out how it would be that number. I’m not sure if the data is correct because the inbuilt query shortest path from domain users to high value targets has no results.

For example I can prove that an individual user has a route to a high value target with ‘shortest paths to high value targets’, this user is a member of Domain Users however the query shortest path to high value from Domain Users yields no results.

This was a difficult question to answer but I was able to find it using some ways within BloodHound, and outside of BloodHound.

We first need to find how many users there are in the domain. We can use a PowerShell query on the Target Host to get a count of how many Domain Users there are in INLANEFREIGHT.LOCAL:

“(Get-ADGroupMember “Domain Users” | Select-Object -ExpandProperty Name).Count”

Next, we need to utilize BloodHound to find all users with a path to Domain Admin. Once you have run SharpHound on the Target Host and you’ve loaded the data into BloodHound on your box, run a Raw Query like this one to view the Domain Admins node:


Click on the Node and then from the hamburger menu, look at Node Info to view Group Members and find out how many users have a path to Domain Admins.

Final step is to divide those two numbers and obtain your answer :wink: