# 9. Set Up Neo4j and Launch BloodHound GUI

#### 🎯 Goal:

Use **BloodHound** to find paths that could help user `alfredo` become a **Domain Admin** 😈

***

#### 🔧 Tools:

* **Neo4j** = the brain (stores all relationships like users → groups → computers)
* **BloodHound GUI** = the eyes (lets you see those relationships)

***

### 🪜 Step-by-step:

**✅ Step 1: Start Neo4j**

In terminal:

```bash
sudo neo4j start
```

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2Fj9SAkkLSQ1iEF2DuHief%2Fimage.png?alt=media&#x26;token=000c988c-cb26-4874-91d0-a2ada1cc8173" alt=""><figcaption></figcaption></figure>

\
\
Then open browser:

```
http://localhost:7474
```

* First time? Username: `neo4j`
* Password: `wonder` (or change it if Neo4j asks)

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FWGOgMIDBuIIHwhcsV7Ir%2F222.png?alt=media&#x26;token=1301ead0-8910-47e1-99c3-ae2f03973385" alt=""><figcaption></figcaption></figure>

***

**✅ Step 2: Open BloodHound**

In another terminal:

```bash
bloodhound
```

* **Don’t use `sudo`** here.
* Login with:
  * **Username:** `neo4j`
  * **Password:** `wonder`

***

**✅ Step 3: Upload the data**

* You already ran `bloodhound-python` earlier and got a `.zip` file.
*   In BloodHound GUI, click **Upload Data**\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2F5tpU6O14tOuXmRHZgU4K%2F222.png?alt=media&#x26;token=eb16f39c-4615-4f09-8f6d-16e3631ab006" alt=""><figcaption></figcaption></figure>
* Select the **unzipped files** (like `computers.json`, `users.json`, etc.)

***

**✅ Step 4: Analyze Alfredo 👀**

1.  Search:

    ```
    ALFREDO@MEGACHANGE.NYX
    ```
2. Click **Analysis** tab
3.  Click **Find Shortest Paths to Domain Admins**\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FQCXIzHHE9XgXVPkCgg64%2F1.jpg?alt=media&#x26;token=d38aa3ea-c7dc-4f45-8304-8b7d74d07652" alt=""><figcaption></figcaption></figure>

💥 If a path exists — BloodHound will show you how to go from Alfredo to full domain control.\


<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FN8GpobVc9E8ZjUqZpflW%2F2.jpg?alt=media&#x26;token=60b30ab6-9cd5-4f7c-8e15-edc216ab0f57" alt=""><figcaption></figcaption></figure>

#### We found that **Alfredo** has a <mark style="color:orange;">ForceChangePassword</mark> permission over **Sysadmin**. What does that mean?

It means **user `alfredo` is allowed to change the password of `sysadmin`**, **without knowing the current password**! 😮

Because if `sysadmin` is a **privileged user** (like a Domain Admin), then:

1. Alfredo can change their password 🔑
2. Then log in as `sysadmin` .
3. And boom — **he becomes a domain admin.**&#x20;







&#x20;
