Data format for domain trusts

[scaise]

Hello,

Just wondered if I could get some clarification from somebody more in the know than myself. I've recently been working with Domain Trusts and have a similar issue to: dirkjanm/BloodHound.py#84 (comment)

When looking for domain trusts in Bloodhound, I was not seeing anything. I know they exist as I've enumerated trusts using another tool but when loading Sharphound data into Bloodhound the trusts are not displayed.

I came across the issue linked above whereby Bloodhound.py was using int values to identify trust directions and types. This was confirmed as a bug and fixed.

I appear to be having the same issues with Sharphound. The data is displayed as an integer, when bloodhound is looking for a string, see below:

{ "TargetDomainSid": "redacted", "TargetDomainName": "redacted", "IsTransitive": true, "SidFilteringEnabled": false, "TrustDirection": 1, "TrustType": 4 }

When the above is loaded into Bloodhound, the trusts are not displayed. If I manually modify this with the correct string as shown below, Bloodhound displays the trust:

{ "TargetDomainSid": "redacted", "TargetDomainName": "redacted", "IsTransitive": true, "SidFilteringEnabled": false, "TrustDirection": "Inbound", "TrustType": "Forest" }

Is this also a bug in Sharphound, or is there something I'm missing here?

[JonasBK]

Hi @scaise,

Thanks for reporting the issue.

I think someone changed SharpHoundCommon without updating BloodHound 🙃
It will be fixed with this commit: SpecterOps/BloodHound-Legacy@7d3c0fb

I will close this issue when 4.3.1 is released.

[rvazarkar]

Fixed in SharpHound v2.0.1