SharpHound icon indicating copy to clipboard operation
SharpHound copied to clipboard

--CollectAllProperties Flag doesn't appear to be working

Open ION28 opened this issue 3 years ago • 1 comments

On the README, the --collectallproperties flag claims to "Collect all LDAP properties from objects"; however, this does not actually appear to be the case.

Test Scenario:

  • Create a new user in Active Directory.
  • Configure this user's homePhone and manager properties within AD
  • Run .\SharpHound.exe --CollectAllProperties

Result: When viewing the TIMESTAMP_users.json file, the JSON object for this new user does not contain the details for the properties set above.

The option to collect all LDAP properties for each object appears to have been introduced in 2020 in the SharpHound3 repository. In my limited testing though, builds from this time/repo were also failing to collect the two aforementioned fields.

Tools such as SysInternals' ADExplorer and @p0dalirius' ldap2json are good examples of projects that are successfully dumping out the details of all LDAP properties.

Use Case: Often times these additional attributes will contain pieces of data relevant to understanding the target's environment, the value of a particular user, etc. Additionally, collecting these attributes would help make the tool more feature-complete for defenders wishing to use BloodHound to create a complete picture of their AD environment.

ION28 avatar May 24 '22 02:05 ION28

I'll have to take a look, I wonder if these are stored in a format that I hadn't considered when going through this.

rvazarkar avatar May 26 '22 22:05 rvazarkar

@rvazarkar any chance you can take another look at this? I tried downloading the new SH release and I'm still not seeing the aforementioned properties in the resulting users json file in my lab environment (running in same setup as described above). Not sure what I might be doing wrong here. Appreciate all the time you've spent investigating this bug already!

ION28 avatar Aug 16 '22 19:08 ION28