Comments (4)
I just tested this in my own lab. Created a new user and marked it with unconstrained delegation and got the following results:
"Properties": {
"domain": "TESTLAB.LOCAL",
"name": "[email protected]",
"distinguishedname": "CN=UCTEST,CN=USERS,DC=TESTLAB,DC=LOCAL",
"domainsid": "S-1-5-21-318463681-1533741871-3192839656",
"samaccountname": "uctest",
"isaclprotected": false,
"description": null,
"whencreated": 1712910813,
"sensitive": false,
"dontreqpreauth": false,
"passwordnotreqd": false,
"unconstraineddelegation": true,
"pwdneverexpires": true,
"enabled": true,
"trustedtoauth": false,
"lastlogon": 0,
"lastlogontimestamp": -1,
"pwdlastset": 1712936013,
"serviceprincipalnames": [
"TEST/abc"
],
"hasspn": true,
"displayname": "UCTest",
"email": null,
"title": null,
"homedirectory": null,
"userpassword": null,
"unixpassword": null,
"unicodepassword": null,
"sfupassword": null,
"logonscript": null,
"admincount": false,
"sidhistory": []
},
Ran with:
.\SharpHound.exe -c All --PrettyPrint --nozip
So I'm not sure whats going off the rails here, but at least the check for unconstrained delegation appears to be working fine on a binary built off main
. Can you try building from source to see if you hit the same issue?
from sharphound.
What collection method was used to gather the info?
from sharphound.
This was collected with -c All
and I was running it from WINTERFELL.NORTH.SEVENKINGDOMS.LOCAL
using the hodor
account via an RDP session. Windows Defender was disabled.
The full command used to gather this info is below:
.\SharpHound.exe -c All --outputprefix NORTH
from sharphound.
I've built from source and had the same issue, here's a copy of the information generated if it helps. I used the same flags to run the command: .\SharpHound_local.exe -c All --outputprefix NORTH
for this.
NORTH_localbuild_20240417031536_BloodHound.zip
Information gathered via local build of SharpHound.exe
{
"Properties": {
"domain": "NORTH.SEVENKINGDOMS.LOCAL",
"name": "[email protected]",
"distinguishedname": "CN=SANSA.STARK,CN=USERS,DC=NORTH,DC=SEVENKINGDOMS,DC=LOCAL",
"domainsid": "S-1-5-21-1252223512-2665318757-2669098637",
"samaccountname": "sansa.stark",
"isaclprotected": false,
"description": "Sansa Stark",
"whencreated": 0,
"sensitive": false,
"dontreqpreauth": false,
"passwordnotreqd": false,
"unconstraineddelegation": false,
"pwdneverexpires": false,
"enabled": true,
"trustedtoauth": false,
"lastlogon": -1,
"lastlogontimestamp": -1,
"pwdlastset": -1,
"serviceprincipalnames": [
"HTTP/eyrie.north.sevenkingdoms.local"
],
"hasspn": true,
"displayname": null,
"email": null,
"title": null,
"homedirectory": null,
"userpassword": null,
"unixpassword": null,
"unicodepassword": null,
"sfupassword": null,
"logonscript": null,
"admincount": false,
"sidhistory": []
}
Sansa.stark is set with unconstrained delegation
What's strange is I know the Bloodhound.py (ce-branch) is gathering this information and I know the condition exists within the domain. I can try to cross reference between both projects to see how they both collect this information and come back, it might be a few weeks since I have a lot of other projects going on :)
from sharphound.
Related Issues (20)
- Sharphound 2.4.1 declared some users as a group, e.g. the MSOL_ accounts (in Neo4J)
- WriteSPN not working
- Error
- Throttle and jitter cli parameters not working HOT 1
- RFE: --ldappassword option to have SharpHound request the password interactively
- Collector does not always complete HOT 2
- Bloodhound-python KRB_AP_ERR_BAD_INTEGRITY(Integrity check on decrypted field failed) HOT 2
- CollectAllProperties Does not Appear To Collect All Properties HOT 2
- User Name is Not Representive of the AD Object
- SkipRegistryLoggedOn option not used HOT 1
- SharpHound v2.0.0 not compatible bloodhound v4.3.1 HOT 2
- Login attempt with wrong domain name with trusted domain can lead to account lockout HOT 1
- Stuck at upload 0% HOT 6
- Illegal Characters in Path
- Microsoft Defender Reporting Successful Login Attempts HOT 4
- Failed to setup LDAP Query Filter HOT 5
- Build issue - ComputerSesionProcessor does not have a parameter named doLocalAdminSessionEnum HOT 2
- Sharphound --CollectionMethods all is not working properly HOT 1
- Feature request: Put domain name in output zip filename
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sharphound.