SpecterOps/SharpHound

# SharpHound  ## 获取 SharpHound 最新版本的 SharpHound 构建始终可以在[这里](https://github.com/SpecterOps/SharpHound/releases)找到。 要确定与已部署的 BloodHound CE 实例兼容的 SharpHound 版本，请登录到 BloodHound CE 的 Web UI 并点击 ⚙️ (Settings) → Download Collectors。然后，点击用户界面中的“Download SharpHound”按钮，或使用显示的 SharpHound 版本来下载相应的 [release binary](https://github.com/SpecterOps/SharpHound/releases)。或者，也可以从相应的 release commit 编译 SharpHound 二进制文件。 ## 文档 请参阅 [BloodHound Community Edition 文档](https://bloodhound.specterops.io/home)中的 [SharpHound 部分](https://bloodhound.specterops.io/collect-data/ce-collection/sharphound)。 ## 编译说明 要构建此项目，请使用 .NET SDK 运行以下命令： ``` dotnet restore dotnet build ``` 默认情况下，项目会针对 [SharpHoundCommon Library](https://github.com/SpecterOps/SharpHoundCommon) 的下一个预发布 `-dev` 版本（追踪 v4 分支）进行构建。 如果你希望针对库的本地副本进行构建，请确保 `_CommonLibPath` 和 `_RPCPath` 属性指向正确的 DLL，并运行 `dotnet build -p:CommonSource=Local`。 如果 `CommonLibsVersion` 已经包含预发布标签（例如 `4.6.0-rc1`）， 对于 `Stable` 和 `Dev` 源，都将按原样使用该确切版本。 | `CommonSource` (默认: `Dev`) | 解析的 Package | |---------------------------------|-----------------------------------------------------------------------------| | `Dev` | 预发布版本 (例如 `4.6.0-rc1`) 或下一个补丁版本 `-dev*` (例如 `4.6.1-dev*`) | | `Stable` | 当前的 CommonLibsVersion (例如 `4.6.0`) | | `Local` | 本地的 `SharpHoundCommon` DLL | ``` dotnet build # Dev (default) dotnet build -p:CommonSource=Stable dotnet build -p:CommonSource=Local dotnet build --tl:off # To view CommonLib resolution logs ``` ## 环境要求 SharpHound 的设计目标是 .Net 4.7.2。SharpHound 必须在域用户的上下文中运行，可以通过直接登录或通过 RUNAS 等其他方法来实现。 # CLI 参数 下面的列表详细说明了 SharpHound 支持的 CLI 参数。有关这些选项的更多详细信息，请参阅 [BloodHound CE Collection 文档](https://bloodhound.specterops.io/collect-data/ce-collection/sharphound-flags)。 ``` -c, --collectionmethods (Default: Default) Collection Methods: Container, Group, LocalGroup, GPOLocalGroup, Session, LoggedOn, ObjectProps, ACL, ComputerOnly, Trusts, Default, RDP, DCOM, DCOnly, UserRights, CARegistry, DCRegistry, CertServices, WebClientService, NTLMRegistry,SMBInfo,LdapServices -d, --domain Specify domain to enumerate -s, --searchforest (Default: false) Search all available domains in the forest --stealth Stealth Collection (Prefer DCOnly whenever possible!) -f Add an LDAP filter to the pregenerated filter. --distinguishedname Base DistinguishedName to start the LDAP search at --computerfile Path to file containing computer names to enumerate --outputdirectory (Default: .) Directory to output file too --outputprefix String to prepend to output file names --cachename Filename for cache (Defaults to a machine specific identifier) --memcache Keep cache in memory and don't write to disk --rebuildcache (Default: false) Rebuild cache and remove all entries --randomfilenames (Default: false) Use random filenames for output --zipfilename Filename for the zip --nozip (Default: false) Don't zip files --trackcomputercalls (Default: false) Adds a CSV tracking requests to computers --zippassword Password protects the zip with the specified password --prettyprint (Default: false) Pretty print JSON --ldapusername Username for LDAP --ldappassword Password for LDAP --domaincontroller Override domain controller to pull LDAP from. This option can result in data loss --ldapport (Default: 0) Override port for LDAP --secureldap (Default: false) Connect to LDAP SSL instead of regular LDAP --disablecertverification (Default: false) Disable certificate verification for secure LDAP --disablesigning (Default: false) Disables Kerberos Signing/Sealing --skipportcheck (Default: false) Skip checking if 445 is open --portchecktimeout (Default: 500) Timeout for port checks in milliseconds --skippasswordcheck (Default: false) Skip PwdLastSet age check when checking computers --excludedcs (Default: false) Exclude domain controllers from session/localgroup enumeration (mostly for ATA/ATP) --throttle Add a delay after computer requests in milliseconds --jitter Add jitter to throttle (percent) --threads (Default: 50) Number of threads to run enumeration with --skipregistryloggedon Skip registry session enumeration --overrideusername Override the username to filter for NetSessionEnum --realdnsname Override DNS suffix for API calls --collectallproperties Collect all LDAP properties from objects -l, --Loop Loop computer collection --loopduration Loop duration (hh:mm:ss - 05:00:00 is 5 hours, default: 2 hrs) --loopinterval Add delay between loops (hh:mm:ss - 00:03:00 is 3 minute) --statusinterval (Default: 30000) Interval in which to display status in milliseconds --localadminsessionenum Specify if you want to use a dedicated LOCAL user for session enumeration --localadminusername Specify the username of the localadmin for session enumeration --localadminpassword Specify the password of the localadmin for session enumeration -v (Default: 2) Enable verbose output. Lower is more verbose --help Display this help screen. --version Display version information. ```

标签：Active Directory, BloodHound, Checkov, Plaso, 域渗透, 数据采集器, 电子数据取证