BloodHound icon indicating copy to clipboard operation
BloodHound copied to clipboard

Can't login using password & id given from bloodhound `./bloodhound-cli resetpwd`

Open DSCmatter opened this issue 8 months ago • 16 comments

I have tried resetting the passwd multiple times but no progress. And also via http://127.0.0.1:8080/ui/login - always gives An error occurred when attempting to reset your password. Please try again.

I used this guide: https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart

DSCmatter avatar Apr 20 '25 16:04 DSCmatter

Hi @DSCmatter,

Have you ensured that you are using the correct password from this command: bloodhound-cli config get default_password

That will show you the automatically generated password that was created during the install process. If that isn't working, we can try a few more steps to ensure you're able to reset it successfully.

After running: ./bloodhound-cli resetpwd

It will give you output like: User ID: admin Password: somethingsecure

Make sure you're using "admin" (or whatever ID it shows) as the username, not your email address or something else.

You can also try to run the full command explicitly like this: ./bloodhound-cli resetpwd --user-id admin --password 'YourNewPassword'

Then restart the BloodHound container (if it's dockerized) to ensure the change is picked up: docker restart bloodhound

Or if running via docker-compose: docker-compose restart

Sometimes the web UI might have trouble with certain special characters. Try resetting it to a simple password (temporarily) like: ./bloodhound-cli resetpwd --user-id admin --password 'BloodHound123' Then test that login via http://127.0.0.1:8080/ui/login

Sometimes the login failure is not because of the password, but because of a broken backend connection to the Neo4j database or the internal user store.

If you’re using docker-compose, make sure all services are up: docker-compose ps

If any are exiting or restarting, there’s likely a problem in the stack. You can inspect individual logs: docker-compose logs

Let me know if you make any progress with these suggestions or if you're still having issues with the pw. And let me know the install method you used to set it up.

psionicjake avatar Apr 21 '25 21:04 psionicjake

Hi everyone!

Same issue here.

After a succesfull installation the random password does not work to login as admin.

Same issue after running ./bloodhound-cli resetpwd.

You can no longer run ./bloodhound-cli resetpwd --user-id admin --password 'YourNewPassword'

iamagarre avatar Apr 28 '25 06:04 iamagarre

I also observed the same issue. The default password doesn't work, nor does the password I obtained after running ./bloodhound-cli resetpwd.

Impensio avatar May 05 '25 12:05 Impensio

Hello!

I did a new installation and it worked! The only difference was to install Docker using the .deb package instead of the apt install commmand.

iamagarre avatar May 05 '25 13:05 iamagarre

Same issue, new install and unable to reset password on initial login. get error of "An error occurred when attempting to reset your password. please try again."

brittadams avatar May 07 '25 05:05 brittadams

Hey all, can you please post the output of docker compose version for me to help troubleshoot this?

StephenHinck avatar May 07 '25 23:05 StephenHinck

Same issue, Docker Compose version v2.35.1-desktop.1

mis-ssn avatar May 30 '25 15:05 mis-ssn

yup I have confirmed this bug as well on multiple setups.

The solution believe it or not-boost your VM RAM from Kali's 2GB default up to 8..

rolling-code avatar May 31 '25 03:05 rolling-code

but I’m running natively on Mac (not in a VM), so increasing VM RAM didn’t apply to my situation. The problem still persists on my setup.

mis-ssn avatar May 31 '25 15:05 mis-ssn

I'm experiencing this same issue, I think (?). I can log in using the randomly generated password, but the reset prompt right after gives me "An error occurred when attempting to reset your password. Please try again." – as mentioned in the OP. Looking at the request in the Network tab shows this error:

{
  "http_status": 401,
  "timestamp": "2025-07-16T11:27:56.654678728Z",
  "request_id": "0ece1675-47d0-4b03-825f-4af2c26080ca",
  "errors": [
    {
      "context": "",
      "message": "not authorized for d69c3147-f4e6-4817-b4a0-c5a39e7569fd"
    }
  ]
}

So somewhere there's a permissions issue. d69c3147-f4e6-4817-b4a0-c5a39e7569fd seems to be the default uid for the admin account.

This occurs with both bloodhound-cli and using Docker manually via the docker-compose.yml file. Both are the latest builds. Other info:

$ docker-compose -v
Docker Compose version 2.26.1-4
                                                                                                                                                                                                                                           
$ uname -a                   
Linux kali 6.12.25-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.12.25-1kali1 (2025-04-30) x86_64 GNU/Linux

clfr0nt avatar Jul 16 '25 11:07 clfr0nt

In my case, besides not being able to login, right after I ran sudo ./bloodhound-cli resetpwd, the bloodhound-bloodhound-1 exited with error Exited (1) and the UI was no longer accesible.

The logs showed the following:

time=2025-07-18T07:00:11.323Z level=INFO message="Reading configuration found at /bloodhound.config.json"
time=2025-07-18T07:00:11.324Z level=INFO message="Logging configured"
time=2025-07-18T07:00:11.346Z level=INFO message="No database driver has been set for migration, using: neo4j"
time=2025-07-18T07:00:11.346Z level=INFO message="Connecting to graph using Neo4j"
time=2025-07-18T07:00:11.347Z level=INFO message="Starting daemon Tools API"
time=2025-07-18T07:00:11.352Z level=INFO message="No new SQL migrations to run"
time=2025-07-18T07:00:13.537Z level=INFO message="Recreating default admin user"
time=2025-07-18T07:00:15.268Z level=ERROR message="Database error" query="DELETE FROM \"users\" WHERE \"users\".\"id\" = 'be814c7c-be2a-497c-96c5-7e5c1a11583e'" err="ERROR: update or delete on table \"users\" violates foreign key constraint \"fk_file_upload_jobs_user\" on table \"ingest_jobs\" (SQLSTATE 23503)"
time=2025-07-18T07:00:15.271Z level=ERROR message="Failed starting the server: failed to start services: unable to delete exisiting admin user: admin: ERROR: update or delete on table \"users\" violates foreign key constraint \"fk_file_upload_jobs_user\" on table \"ingest_jobs\" (SQLSTATE 23503)"

Also, the postgres instance got another error:

2025-07-18 06:59:50.039 UTC [29] LOG:  database system was shut down at 2025-07-18 06:59:42 UTC
2025-07-18 06:59:50.050 UTC [1] LOG:  database system is ready to accept connections
2025-07-18 07:00:15.268 UTC [49] ERROR:  update or delete on table "users" violates foreign key constraint "fk_file_upload_jobs_user" on table "ingest_jobs"
2025-07-18 07:00:15.268 UTC [49] DETAIL:  Key (id)=(be814c7c-be2a-497c-96c5-7e5c1a11583e) is still referenced from table "ingest_jobs".
2025-07-18 07:00:15.268 UTC [49] STATEMENT:  DELETE FROM "users" WHERE "users"."id" = $1

The solution for me was to manually log into the postgres DB and delete all the ingest jobs:

$ sudo docker exec -it bloodhound-app-db-1 /bin/bash
root@1c3890be9f09:/# psql -h 127.0.0.1
psql (16.9 (Debian 16.9-1.pgdg120+1))
Type "help" for help.

bloodhound=# delete from ingest_jobs where user_id = 'be814c7c-be2a-497c-96c5-7e5c1a11583e';

After doing this, the resetpwd worked fine.

m2rc-p avatar Jul 18 '25 07:07 m2rc-p

I had exactly the same issue as described by @m2rc-p. I checked the solution and it worked for me too.

Impensio avatar Jul 28 '25 15:07 Impensio

This is super helpful information - exactly what I needed to confirm the issue. The constraint on the ingest_jobs table is holding up the reset because we're recreating the user. I'll get this logged internally for a fix!

StephenHinck avatar Jul 28 '25 15:07 StephenHinck

Hi, still getting this on a M4 Mac with a clean install. Is there any news on a fix?

fawkesianmask avatar Dec 01 '25 16:12 fawkesianmask

Also, two separate clean installs are generating the same default password which is odd

fawkesianmask avatar Dec 01 '25 16:12 fawkesianmask

@fawkesianmask have you tried my workaround above? https://github.com/SpecterOps/BloodHound/issues/1383#issuecomment-3087602203

m2rc-p avatar Dec 01 '25 16:12 m2rc-p

@fawkesianmask - can you confirm what version of BloodHound you experienced this on? I believe this was fixed as of v8.4.0.

StephenHinck avatar Dec 04 '25 21:12 StephenHinck