Empire icon indicating copy to clipboard operation
Empire copied to clipboard

[BUG] Module "powershell/situational_awareness/network/bloodhound3" doesn't produce usable data

Open h49nakxs opened this issue 2 years ago • 1 comments

Note: Please fill out all sections (if applicable) and do not delete the below section headers, otherwise the bot will close the issue.

Empire Version

4.7.1 BC Security Fork

OS Information (Linux flavor, Python version)

  • OS: Linux host 5.18.0-kali5-amd64
  • Python: 3.10.5

Describe the bug

Module "powershell/situational_awareness/network/bloodhound3" does not produce data compatible with latest version of Bloodhound (4.2.0)

To Reproduce

Generate .json files with module "powershell/situational_awareness/network/bloodhound3" with default settings and try to upload them in Bloodhound 4.2.0. The following text error is displayed : File created from incompatible collector

Expected behavior

Data generated by the ingestor correctly uploaded to Bloodhound.

Screenshots

Additional context

I've also tested with the latest version of the SharpHound powershell script (https://github.com/BloodHoundAD/SharpHound) and it works. The JSON structure between the latest script and the version included in Empire is clearly different.

h49nakxs avatar Aug 18 '22 21:08 h49nakxs

The Bloodhound3 is not compatible with the newest version of bloodhound, unfortunately. You can downgrade your version to 3 and the version in Empire will work.

You have a few options if you want to run it.

  1. You can always use invoke-assembly and run the executable directly in Empire without a module. This option will let you run it immediately.
  2. You can create a new module using the info from the Wiki and submit a PR.
  3. We can add it to our board and get it added in a future release (warning: we are in the middle of 5.0 dev, so it might be a while)

Cx01N avatar Aug 26 '22 13:08 Cx01N