BloodHoundAD / SharpHound2

The Old BloodHound C# Ingestor (Deprecated)
509 stars 113 forks source link

SharpHound can hang when using GPOLocalGroup due to bad regex in LocalGroupHelpers.cs #87

Open m0noc opened 4 years ago

m0noc commented 4 years ago

When using the GPOLocalGroup collection method Sharphound threads can hang due to some GPOs having a lowercase "S" in the SID in the GptTmpl.inf file.

The following fixes the issue and is consistent with the previous regex's in the file using 'IgnoreCase':-

paul@kali2017-1:~/tools/SharpHound/Sharphound2/Enumeration$ diff LocalGroupHelpers.cs LocalGroupHelpers.cs.orig
29c29
<         private static readonly Regex ExtractRid = new Regex(@"S-1-5-32-([0-9]{3})", RegexOptions.Compiled | RegexOptions.IgnoreCase);
---
>         private static readonly Regex ExtractRid = new Regex(@"S-1-5-32-([0-9]{3})", RegexOptions.Compiled);