BloodHoundAD/SharpHound

Sharphound --CollectionMethods all is not working properly

Closed this issue · 1 comments

After running sharphound command in various ways using ps1 and exe extension on windows to gather information. The gather is mostly not proper. Looking at the below 2 screenshots it can be observed that even after trying several times to run sharp hound in various ways. I failed to receive expected data.

image
Figure 1# Expected Output

image
Figure 2# Getting this Output even after various tries. (Only got once the expected output by luck.)

If we take a look closely the complete jeffadmin path is missing and this can be really a big flaw.
I'm am using all the latest versions and even tried with 4.3.0 but still no luck.

Please fix this ASAP.

Hi @PiyushThePal,

I assume the missing edge from the Computer Client74 to Jeffadmin is a HasSession edge. Collecting that requires:

  • The account running the SharpHound collection is a member of Administrators on Client74 (unless it is an old Windows version)
  • The Client74 computer is running and the computer where SharpHound is running from can reach Client74 on port 455
  • Jeffadmin has a session on Client74

Also, be aware that you need the right collector version:
SharpHound v1.x -> Works with BloodHound 4.x
SharpHound v2.x -> Works with BloodHound 5.x

Let me know if that doesn't help you.