SharpHound icon indicating copy to clipboard operation
SharpHound copied to clipboard

Scan time is too long

Open Asn0w opened this issue 11 months ago • 3 comments

The command I used was "execute-assembly sharpHound.exe -c all -d target.cn --OutputDirectory C:\Users\Public\Music ". There are about 100,000 users in the domain, and the scan got stuck after a few hours,Waiting time exceeds 10 hours, and it keeps getting stuck,I tried scanning with servers in other domains, but the result was the same. image

Asn0w avatar Jan 09 '25 12:01 Asn0w

I also used "-c sessions" and it got stuck. Using "-c acl" was very fast and the scan was completed in 10 minutes.

Asn0w avatar Jan 09 '25 12:01 Asn0w

I can replicate the above with SharpHound 2.5.13, but with a different set of arguments. --collectionMethods DCOnly indeed gets stuck indefinitely, but --collectionMethods GPOLocalGroup,Trusts,Container,ACL,ObjectProps (DCOnly, but without groups) completes just fine. I can upload debug logs of both runs if needed, just need to sanitize them.

obvious-burner avatar Feb 17 '25 12:02 obvious-burner

Could be related to this https://github.com/SpecterOps/BloodHound/issues/1528

hubert3 avatar Jun 02 '25 15:06 hubert3