You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Sep 2, 2022. It is now read-only.
I have encounted following issue:
Having a user from a foreign Domain (doesnt matter if same/foreign Forest) in a security group, SharpHound does not collect that user and write it into the .json file, thus not showing up in the database.
To be precise, my case looks like this:
I have Forest A with domain1.com and subdomain sub.domain1.com
And Forest B with domain2.com.
Theres a 2-way trust configured between both Forests.
User john from domain2.com is member of the Administrators group in sub.domain1.com.
SharpHound does not collect any informations about user john being in the Administrators group.
Running Sharphound with --debug -c Group --LdapFilter "(distinguishedname=CN=Administrators,CN=Builtin,DC=sub,DC=domain1,DC=com)" shows that SharpHound is actually fetching the informations ("Creating SecurityIdentifier from SID" and next resolving the foreign domain), but does not write it into the .json.
According to BlueCookieMonster from Slack, ForeignSecurityPrincipal collection is only working if its done in a user context from the parent domain.
The text was updated successfully, but these errors were encountered:
I did some further testing, here are my results:
Running SharpHound with the aforementioned parameters gives following output: Debug: Creating SecurityIdentifier from <User_SID>
Debug: Got Domain Sid <Domain_SID>
Debug: Cache hit for SidToDomainName: <Domain_FQDN>
Debug: Creating connection
Debug: Connection null
When running SharpHound with the --Verbose parameter instead of --Debug, i can see following output: Unable to contact domain <Domain_FQDN
I have encounted following issue:
Having a user from a foreign Domain (doesnt matter if same/foreign Forest) in a security group, SharpHound does not collect that user and write it into the .json file, thus not showing up in the database.
To be precise, my case looks like this:
I have Forest A with domain1.com and subdomain sub.domain1.com
And Forest B with domain2.com.
Theres a 2-way trust configured between both Forests.
User john from domain2.com is member of the Administrators group in sub.domain1.com.
SharpHound does not collect any informations about user john being in the Administrators group.
Running Sharphound with --debug -c Group --LdapFilter "(distinguishedname=CN=Administrators,CN=Builtin,DC=sub,DC=domain1,DC=com)" shows that SharpHound is actually fetching the informations ("Creating SecurityIdentifier from SID" and next resolving the foreign domain), but does not write it into the .json.
According to BlueCookieMonster from Slack, ForeignSecurityPrincipal collection is only working if its done in a user context from the parent domain.
The text was updated successfully, but these errors were encountered: