search

S3cur3Th1sSh1t / WinPwn

Automation for internal Windows Penetrationtest / AD-Security
BSD 3-Clause "New" or "Revised" License
3.36k stars 521 forks source link

Bloodhound update #8

Closed sp00ks-git closed 4 years ago

sp00ks-git commented 4 years ago

Hi can you update the sharphound collector to the latest version please.

S3cur3Th1sSh1t commented 4 years ago

It is version 3, did they release an significant update?

grafik

sp00ks-git commented 4 years ago

The format of time stamps is dispalyed as TMPSTAMP in Sharphound and doesn't correctly show the last logon time, password changed etc. Also the cypher to pull this wont work either because of the older version.

I confirmed in the bloodhound slack this was the case. Just a bit annoying is all.

sp00ks-git commented 4 years ago

You could pull it directly from the official site, then it would be always up to date?

https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Ingestors/SharpHound.ps1

S3cur3Th1sSh1t commented 4 years ago

Im not using the Powershell Script but my own compiled and string obfuscated version loaded via assembly::load() in another PowerSharpPack binary. Maybe there is some problem with the "obfuscation" so that the .json files broke. I´ll take a loot at it.

S3cur3Th1sSh1t commented 4 years ago

I did build a new version, which is only replacing some basic strings from SharpHound. Can you test the new version for the issue?

I tested both the Powershell script from the official repository and my script - they had the same output files.

sp00ks-git commented 4 years ago

Yeah looks working now, thanks.