SharpHound 的最新构建版本始终可以在此处找到。
要确定与已部署的 BloodHound CE 实例兼容的 SharpHound 版本,请登录 BloodHound CE 的 Web UI,点击 ⚙️(设置)→ 下载收集器。然后,点击用户界面中的“下载 SharpHound”按钮,或使用显示的 SharpHound 版本下载相应的发布二进制文件。或者,从相应的发布提交编译 SharpHound 二进制文件。
请参阅 SharpHound 部分,它是 BloodHound Community Edition 文档 的一部分。
要构建此项目,请使用 .NET SDK 运行以下命令:
dotnet restore
dotnet build
默认情况下,项目会针对 SharpHoundCommon 库 的下一个预发布 -dev 版本进行构建(跟踪 v4 分支)。
如果希望针对库的本地副本进行构建,请确保 _CommonLibPath 和 _RPCPath 属性指向正确的 DLL,然后运行 dotnet build -p:CommonSource=Local。
如果 CommonLibsVersion 已包含预发布标记(例如 4.6.0-rc1),则该确切版本将原样用于 Stable 和 Dev 源。
dotnet build # Dev (default)
dotnet build -p:CommonSource=Stable
dotnet build -p:CommonSource=Local
dotnet build --tl:off # To view CommonLib resolution logs
SharpHound 面向 .Net 4.7.2 设计。SharpHound 必须在域用户的上下文中运行,无论是直接通过登录还是通过 RUNAS 等其他方法。
下面的列表详细介绍了 SharpHound 支持的 CLI 参数。有关这些选项的更多详细信息,请参阅 BloodHound CE 收集文档。
-c, --collectionmethods (Default: Default) Collection Methods: Container, Group, LocalGroup, GPOLocalGroup,
Session, LoggedOn, ObjectProps, ACL, ComputerOnly, Trusts, Default, RDP, DCOM, DCOnly, UserRights,
CARegistry, DCRegistry, CertServices, WebClientService, NTLMRegistry,SMBInfo,LdapServices
-d, --domain Specify domain to enumerate
-s, --searchforest (Default: false) Search all available domains in the forest
--stealth Stealth Collection (Prefer DCOnly whenever possible!)
-f Add an LDAP filter to the pregenerated filter.
--distinguishedname Base DistinguishedName to start the LDAP search at
--computerfile Path to file containing computer names to enumerate
--outputdirectory (Default: .) Directory to output file too
--outputprefix String to prepend to output file names
--cachename Filename for cache (Defaults to a machine specific identifier)
--memcache Keep cache in memory and don't write to disk
--rebuildcache (Default: false) Rebuild cache and remove all entries
--randomfilenames (Default: false) Use random filenames for output
--zipfilename Filename for the zip
--nozip (Default: false) Don't zip files
--trackcomputercalls (Default: false) Adds a CSV tracking requests to computers
--zippassword Password protects the zip with the specified password
--prettyprint (Default: false) Pretty print JSON
--ldapusername Username for LDAP
--ldappassword Password for LDAP
--domaincontroller Override domain controller to pull LDAP from. This option can result in data loss
--ldapport (Default: 0) Override port for LDAP
--secureldap (Default: false) Connect to LDAP SSL instead of regular LDAP
--disablecertverification (Default: false) Disable certificate verification for secure LDAP
--disablesigning (Default: false) Disables Kerberos Signing/Sealing
--skipportcheck (Default: false) Skip checking if 445 is open
--portchecktimeout (Default: 500) Timeout for port checks in milliseconds
--skippasswordcheck (Default: false) Skip PwdLastSet age check when checking computers
--excludedcs (Default: false) Exclude domain controllers from session/localgroup enumeration (mostly for
ATA/ATP)
--throttle Add a delay after computer requests in milliseconds
--jitter Add jitter to throttle (percent)
--threads (Default: 50) Number of threads to run enumeration with
--skipregistryloggedon Skip registry session enumeration
--overrideusername Override the username to filter for NetSessionEnum
--realdnsname Override DNS suffix for API calls
--collectallproperties Collect all LDAP properties from objects
-l, --Loop Loop computer collection
--loopduration Loop duration (hh:mm:ss - 05:00:00 is 5 hours, default: 2 hrs)
--loopinterval Add delay between loops (hh:mm:ss - 00:03:00 is 3 minute)
--statusinterval (Default: 30000) Interval in which to display status in milliseconds
--localadminsessionenum Specify if you want to use a dedicated LOCAL user for session enumeration
--localadminusername Specify the username of the localadmin for session enumeration
--localadminpassword Specify the password of the localadmin for session enumeration
-v (Default: 2) Enable verbose output. Lower is more verbose
--help Display this help screen.
--version Display version information.
CommonSource (default: Dev) | 已解析的包 |
|---|
Dev | 预发布(例如 4.6.0-rc1)或下一个补丁 -dev*(例如 4.6.1-dev*) |
Stable | 当前 CommonLibsVersion(例如 4.6.0) |
Local | 本地 SharpHoundCommon DLL |