Thinking in graphs with IPAHound

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://swarm.ptsecurity.com/thinking-in-graphs-with-ipahound/
• Blog Title: Thinking in graphs with IPAHound
• Suggested Section: Linux Hardening -> FreeIPA Pentesting (add subsections on IPAHound tool usage, LDAP privilege inference/graph edges, and Kerberos delegation/PKINIT attack chains in FreeIPA)

🎯 Content Summary

This post introduces IPAHound, a BloodHound-style graph attack-path analysis toolkit for FreeIPA environments. It explains (1) how FreeIPA directory entities and authorization/delegation/PKI concepts are represented in LDAP, (2) how IPAHound reconstructs actionable attacker edges from what a standard user can read, and (3) provides concrete, copy/paste command sequences that chain those edges into domain compromise (e.g., gaining LDAP admin via Ke...

🔧 Technical Details

Recon/inference trick (FreeIPA pentest view): because standard users can’t read most ACI/permission internals, infer effective privileges from readable attributes like memberOf and delegation-related attributes (e.g., memberManager, managedBy, ipaAllowedToPerform;read_keys, ipaAllowedToPerform;write_keys, ipaAllowedToPerform;write_delegation), then represent them as graph edges to identify lateral-movement and compromise paths.

Password-spray target selection: derive PasswordAuthAllow from ipaUserAuthType (missing attribute implies password auth allowed), then query Neo4j for sprayable principals (e.g., MATCH (n:IPAUser) WHERE n.PasswordAuthAllow = True RETURN n.krbCanonicalName or splitting krbPrincipalName).

HBAC + sudo exploitability modeling: treat SSH access as “HBAC allow sshd” (CanSSH), and sudo access as “HBAC allow sud...

🤖 Agent Actions

I’m mapping the existing FreeIPA/Linux hardening content first, then I’ll read the nearest candidate pages to decide whether this belongs in an existing FreeIPA page or needs a new one.
There is already a dedicated src/linux-hardening/freeipa-pentesting.md, so I’m validating that page against nearby LDAP/Kerberos/BloodHound content before deciding what to add.
The FreeIPA page already covers baseline enumeration, HBAC, sudo rules, and RBAC, but it does not cover IPAHound’s low-privilege graph inference, PasswordAuthAllow spray targeting, or the FreeIPA-specific PKINIT/RBCD chains from the post.
I’ve pinned the insertion point inside the existing FreeIPA page. I’m doing one quick external verification for the IPAHound project links, then I’ll patch that file only.
I’m patching the existing FreeIPA page now. The edit stays in a single file and adds only the pieces that were missing: IPAHound workflow, inference from readable LDAP attributes, and the FreeIPA-specific PKINIT/RBCD chain.
The patch is in place. I’m checking the rendered markdown shape and the final diff now to make sure the page stays consistent and the references remain at the end.
Updated src/linux-hardening/freeipa-pentesting.md.

The new content stays in that single file and adds the missing technical material from the IPAHound post: low-privilege LDAP privilege inference, PasswordAuthAllow-based spray targeting, FreeIPA edge semantics like AddMember/Owns/AddRBCD, and the FreeIPA-specific PKINIT plus S4U2proxy/RBCD chain. I also added the PT SWARM blog and IPAHound repositories to the existing ## References section.

I verified the diff and final file layout. Only that file changed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://swarm.ptsecurity.com/thinking-in-graphs-with-ipahound/

Content Categories: Based on the analysis, this content was categorized under "Linux Hardening -> FreeIPA Pentesting (add subsections on IPAHound tool usage, LDAP privilege inference/graph edges, and Kerberos delegation/PKINIT attack chains in FreeIPA)".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0