> **认证支持**：TaskHound 支持大多数主流认证机制，包括密码、NTLM 哈希、Kerberos（也包括 ccache 缓存）以及 AES 密钥认证。

## 配置文件

TaskHound 支持使用 TOML 配置文件来持久化设置。在工作目录或 `~/.config/taskhound/` 下创建 `taskhound.toml`：```toml
[authentication]
username = "svc_taskhound"
domain = "THESIMPSONS.LOCAL"

[target]
dc_ip = "10.0.0.1"
threads = 10
timeout = 30

[bloodhound]
live = true
connector = "http://127.0.0.1:8080"
api_key = "${BH_API_KEY}"      # Use env vars for secrets
api_key_id = "${BH_API_KEY_ID}"
type = "bhce"

[bloodhound.opengraph]
enabled = true
output_dir = "./opengraph"

[laps]
enabled = true

[cache]
enabled = true
ttl = 86400  # 24 hours

                 by 0xr0BIT

---

## BloodHound 集成

TaskHound 同时支持 **Legacy BloodHound**（Neo4j）和 **BloodHound Community Edition (BHCE)**，并具备自动格式检测功能。

### 实时连接```bash
# BHCE with API Key (recommended)
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local -t moe.thesimpsons.local \
  --bh-live --bhce --bh-connector http://127.0.0.1:8080 \
  --bh-api-key "YOUR_API_KEY" --bh-api-key-id "YOUR_KEY_ID"

# BHCE with username/password
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local -t moe.thesimpsons.local \
  --bh-live --bhce --bh-connector http://127.0.0.1:8080 \
  --bh-user admin --bh-password password

# Legacy BloodHound (Neo4j)
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local -t moe.thesimpsons.local \
  --bh-live --legacy --bh-connector bolt://127.0.0.1:7687 \
  --bh-user neo4j --bh-password password

**旧版：**```cypher
MATCH (u:User {highvalue:true})
OPTIONAL MATCH (u)-[:MemberOf*1..]->(g:Group)
WITH u, properties(u) as all_props, collect(g.name) as groups
RETURN u.samaccountname AS SamAccountName, all_props, groups

> **注意**：OpenGraph 仅限 BHCE。旧版 BloodHound 不支持自定义节点类型。

---

## LAPS 集成

TaskHound 可以自动检索并使用 LAPS 密码进行每主机身份验证。支持 Windows LAPS（`msLAPS-Password`）和旧版 LAPS（`ms-Mcs-AdmPwd`），包括通过 MS-GKDI 加密的密码。```bash
# Basic LAPS - auto-retrieves passwords per target
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local --targets-file hosts.txt --laps --threads 10

# Custom local admin username
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local -t moe.thesimpsons.local --laps --laps-user localadmin

# LAPS with OPSEC mode (other noisy operations disabled)
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local -t moe.thesimpsons.local --laps --opsec --force-laps

> **重要提示**：每个主机拥有唯一的 DPAPI_SYSTEM 密钥。对于多目标扫描，请先收集（默认），然后离线解密每个目标。

---

## 凭据验证

TaskHound 通过 RPC 查询任务执行历史并应用启发式规则，评估存储的任务密码是否仍然有效。此功能**默认启用**。```bash
# Credential validation is on by default, no flag needed
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local -t moe.thesimpsons.local

# Disable validation explicitly
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local -t moe.thesimpsons.local --no-validate-creds

### 目录结构```
./output/                           # Base directory (--output-dir)
├── plain/                          # Plain text output
│   └── <hostname>/
│       └── tasks.txt
├── json/                           # JSON export
│   └── taskhound.json
├── csv/                            # CSV export
│   └── taskhound.csv
├── html/                           # HTML security reports
│   └── taskhound.html
├── opengraph/                      # BloodHound OpenGraph files
│   └── taskhound_data.json
└── raw_backups/                    # Raw collection (XML + DPAPI)
    └── <hostname>/
        ├── tasks/                  # Task XML files
        └── dpapi_loot/             # DPAPI credential blobs

---

## 多线程扫描

对于大型环境，请使用带速率限制的并行扫描：```bash
# 20 parallel workers, max 5 targets/second
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local --auto-targets --threads 20 --rate-limit 5

# Auto-discover servers only (uses preset filter)
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local --auto-targets --ldap-filter servers --threads 20

# Include disabled computers and extend stale threshold to 90 days
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local --auto-targets --include-disabled --stale-threshold 90

# Target workstations only, disable stale filtering
taskhound -u homer.simpson -p 'Doh!123' -d thesimpsons.local --auto-targets --ldap-filter workstations --stale-threshold 0

## 离线分析

在没有网络访问的情况下分析任务：```bash
# Previously collected XML backups
taskhound --offline ./backup/moe.thesimpsons.local

# Mounted disk image
taskhound --offline-disk /mnt/disk

# Mounted image with custom hostname
taskhound --offline-disk /mnt/disk --disk-hostname MOE

### 默认行为

TaskHound **默认非常嘈杂** - 所有功能均已启用以获得最大可见性。这使其非常适合不关心OPSEC的审计和综合评估：

- **凭据保护检测** - 默认启用（使用 `--no-credguard` 禁用）
- **凭据验证** - 默认启用（使用 `--no-validate-creds` 禁用）
- **DPAPI掠夺** - 默认启用（使用 `--no-loot` 禁用）
- **LDAP解析** - 默认启用（使用 `--no-ldap` 禁用）
- **RPC操作** - 默认启用（使用 `--no-rpc` 禁用）

> [!WARNING]
> **凭据保护检查极易被检测到。** 由于现代Windows上默认停止了远程注册表服务，TaskHound将通过SCM远程**启动该服务**，执行检查，然后停止它（就像secretsdump一样）。这将使任何像样的SOC像圣诞树一样亮起。**如果希望在任务中避免这种情况，请务必使用 `--no-credguard`！**

说到任务：对于红队/隐蔽操作，请使用 `--opsec` 一次性禁用所有嘈杂功能。（或使用BOF）。

### 使用示例```bash
# Full OPSEC mode (disables: LDAP, RPC, looting, credguard, validation; forces sequential scanning)
taskhound -u user -p 'pass' -d corp.local -t target --opsec

# OPSEC with jitter (random 0-5 second delays between hosts)
taskhound -u user -p 'pass' -d corp.local --targets-file hosts.txt --opsec --jitter 5

# Disable LDAP only (keep LSARPC for SID resolution)
taskhound -u user -p 'pass' -d corp.local -t target --no-ldap

# Disable RPC only (keep LDAP for SID resolution)
taskhound -u user -p 'pass' -d corp.local -t target --no-rpc

# LAPS with OPSEC (force LAPS LDAP queries despite --opsec)
taskhound -u user -p 'pass' -d corp.local --laps --opsec --force-laps

<details>
<summary>点击展开完整用法</summary>```
Usage: taskhound [OPTIONS] [TARGETS]

AUTHENTICATION OPTIONS
  -u, --username        Username (required for online mode)
  -p, --password        Password (omit with -k for Kerberos/ccache)
  -d, --domain          Domain (required for online mode)
  --hashes              NTLM hashes (LM:NT or NT-only)
  -k, --kerberos        Use Kerberos authentication
  --aes-key             AES key for Kerberos (32 or 64 hex chars)

TARGET OPTIONS
  -t, --target          Single target or comma-separated list
  --targets-file        File with targets, one per line
  --dc-ip               Domain controller IP
  --ns, --nameserver    DNS nameserver for lookups
  --timeout             Connection timeout in seconds (default: 5)
  --threads             Parallel worker threads (default: 10)
  --rate-limit          Max targets per second (default: unlimited)
  --jitter SECONDS      Random delay (0-N seconds) between hosts (OPSEC, sequential only)
  --dns-tcp             Force DNS over TCP (for SOCKS proxies)
  --auto-targets        Auto-discover targets (BloodHound first, LDAP fallback)
  --ldap-filter         Filter for auto-targets: 'servers', 'workstations', or raw LDAP
  --include-dcs         Include Domain Controllers in auto-targets
  --include-disabled    Include disabled computer accounts
  --stale-threshold     Exclude computers inactive >N days (default: 60, 0=disable)

SCANNING OPTIONS
  --offline             Parse XMLs from directory
  --offline-disk        Analyze mounted Windows filesystem
  --disk-hostname       Override hostname for offline-disk
  --bh-data             BloodHound export file for HV detection
  --opsec               Stealth mode: --no-ldap --no-rpc --no-loot --no-credguard --no-validate-creds --threads 1
  --no-rpc              Disable RPC operations (LSARPC, CredGuard, validation)
  --include-ms          Include \Microsoft tasks
  --include-local       Include local system accounts
  --include-all         Include ALL tasks
  --unsaved-creds       Show tasks without stored credentials
  --no-credguard        Disable Credential Guard detection (default: enabled)
  --no-validate-creds   Disable credential validation (default: enabled)

BLOODHOUND OPTIONS
  --bh-live             Enable live BloodHound connection
  --bh-connector        BloodHound URI (default: http://127.0.0.1:8080)
  --bh-user             BloodHound username
  --bh-password         BloodHound password
  --bh-api-key          BloodHound API key
  --bh-api-key-id       BloodHound API key ID
  --bh-timeout          API query timeout (default: 120)
  --bhce                Use BHCE (Community Edition)
  --legacy              Use Legacy BloodHound (Neo4j)
  --bh-save             Save query results to file

OPENGRAPH OPTIONS (BHCE ONLY)
  --bh-opengraph        Generate OpenGraph JSON files (saves to {output_dir}/opengraph/)
  --bh-no-upload        Skip automatic upload
  --bh-force-icon       Force icon update
  --bh-icon             Icon name (default: clock)
  --bh-color            Icon color (default: #8B5CF6)
  --bh-allow-orphans    Create edges for missing nodes

DPAPI OPTIONS
  --no-loot             Disable DPAPI credential collection (default: enabled)
  --dpapi-key           DPAPI_SYSTEM userkey (hex format)

LDAP/SID RESOLUTION
  --no-ldap             Disable LDAP/GC operations
  --ldap-user           Alternative LDAP username
  --ldap-password       Alternative LDAP password
  --ldap-hashes         Alternative LDAP hashes
  --ldap-domain         Alternative LDAP domain
  --ldap-tier0          Enable LDAP-based Tier-0 detection
  --gc-server           Global Catalog server IP

LAPS OPTIONS
  --laps                Enable LAPS authentication
  --laps-user           Override local admin username
  --force-laps          Force LAPS in OPSEC mode

CACHE OPTIONS
  --cache-ttl           Cache TTL in seconds (default: 86400)
  --no-cache            Disable caching
  --clear-cache         Clear cache before run
  --cache-file          Cache file path

OUTPUT OPTIONS
  -o, --output          Output formats (comma-separated: plain,json,csv,html)
                        Default: plain
  --output-dir          Base output directory (default: ./output)
  --no-backup           Disable raw XML backup collection
  --no-summary          Disable summary table

  Output directory structure:
    ./output/
    ├── plain/<host>/tasks.txt    # Plain text output
    ├── json/taskhound.json       # JSON export
    ├── csv/taskhound.csv         # CSV export
    ├── html/taskhound.html       # HTML security report
    ├── opengraph/                # BloodHound OpenGraph files
    └── raw_backups/<host>/       # Raw XML + DPAPI files
        ├── tasks/                # Task XML files
        └── dpapi_loot/           # DPAPI credential blobs

MISC
  --verbose             Verbose output
  --debug               Debug output with stack traces