Output and Results

Output & Results

Every module writes into a single timestamped directory, created the first time anything runs. By default:

ad_enum_YYYYMMDD_HHMMSS/

Override the name in Configuration → [4]. The path is relative to where you launched ghostline.sh, so run Ghostline from your engagement workspace.

---

Directory layout

A fully exercised run produces:

ad_enum_20231220_143022/
├── nmap_ad.nmap           Nmap normal output
├── nmap_ad.xml            Nmap XML (importable)
├── nmap_ad.gnmap          Nmap greppable
├── enum4linux-ng.txt      Full SMB enumeration
├── rpcclient.txt          RPC null-session results
├── ldap.txt               Anonymous LDAP query results
├── dnsrecon.txt           DNS records
├── cme_shares.txt         CrackMapExec shares
├── cme_users.txt          CrackMapExec users
├── dns.csv                AD-integrated DNS dump (adidnsdump)
├── asreproast.txt         AS-REP roastable accounts + hashes
├── ridenum.txt            RID-cycling enumeration
├── smb_vulns.nmap         SMB vulnerability scan
├── secrets.txt            Domain secrets / NTLM hashes
└── *.json                 BloodHound data (zipped)

The Auto Workflow writes slightly different names (nmap.*, enum4linux.txt, rpc.txt, ldap.txt) since it runs the tools in a condensed batch.

Browse the directory any time with Special Actions → [4] View Results.

---

Importing results

BloodHound

neo4j console
# Then in the BloodHound GUI:  Upload Data  →  select the .json / .zip files

Use the graph to map attack paths to high-value targets (Domain Admins, DCSync rights, etc.).

Nmap XML

# Render an HTML report
xsltproc nmap_ad.xml -o report.html

# Reuse the host list in a follow-up scan
nmap -iL nmap_ad.gnmap ...

AS-REP / NTLM hashes

# AS-REP roast (from asreproast.txt)
hashcat -m 18200 asreproast.txt wordlist.txt

# NTLM hashes (from secrets.txt)
hashcat -m 1000 ntlm_hashes.txt wordlist.txt

DNS CSV

dns.csv (from adidnsdump) maps hostnames to IPs, import into a spreadsheet or feed the IPs back into further scans to widen the target set.

---

Handling sensitive output

secrets.txt, asreproast.txt and the BloodHound JSON contain credential material and a map of the environment. Treat the whole output directory as sensitive:

• keep it on an encrypted volume during the engagement;
• never commit it, .gitignore already excludes ad_enum_*/, output/ and results/;
• delete it securely when the engagement is closed and the report is delivered.

See Legal & Safe Use.