Commonlib v4

Sharphound.csproj

@@ -6,8 +6,8 @@
         <LangVersion>latest</LangVersion>
         <DebugType>full</DebugType>
         <ApplicationIcon>favicon.ico</ApplicationIcon>
-        <Version>2.4.1</Version>
-        <FileVersion>2.4.1</FileVersion>
+        <Version>2.5.1</Version>
+        <FileVersion>2.5.1</FileVersion>
         <Company>SpecterOps</Company>
         <Product>SharpHound</Product>
         <AssemblyName>SharpHound</AssemblyName>
@@ -21,19 +21,19 @@
         <PackageReference Include="Fody" Version="6.6.0">
           <PrivateAssets>all</PrivateAssets>
         </PackageReference>
-        <PackageReference Include="Microsoft.Bcl.AsyncInterfaces" Version="5.0.0" />
-        <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="5.0.0" />
+        <PackageReference Include="Microsoft.Bcl.AsyncInterfaces" Version="8.0.0" />
+        <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.0" />
         <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
-        <PackageReference Include="SharpHoundCommon" Version="3.1.8" />
-        <PackageReference Include="SharpHoundRPC" Version="3.1.8" />
+        <PackageReference Include="SharpHoundCommon" Version="4.0.1" />
+        <PackageReference Include="SharpHoundRPC" Version="4.0.1" />
         <PackageReference Include="SharpZipLib" Version="1.3.3" />
         <PackageReference Include="System.Runtime.CompilerServices.Unsafe" Version="6.0.0" />
-        <PackageReference Include="System.Threading.Channels" Version="6.0.0" />
+        <PackageReference Include="System.Threading.Channels" Version="8.0.0" />
         <PackageReference Include="System.ValueTuple" Version="4.5.0" />
     </ItemGroup>
 
     <ItemGroup>
-<!--        <Reference Include="SharpHoundCommonLib, Version=3.1.5.0, Culture=neutral, PublicKeyToken=null">-->
+<!--        <Reference Include="SharpHoundCommonLib">-->
 <!--            <HintPath>..\SharpHoundCommon\src\CommonLib\bin\Debug\net462\SharpHoundCommonLib.dll</HintPath>-->
 <!--        </Reference>-->
         <Reference Include="System.DirectoryServices" />

src/BaseContext.cs

@@ -22,18 +22,18 @@ public sealed class BaseContext : IDisposable, IContext
 
         private bool disposedValue;
 
-        public BaseContext(ILogger logger, LDAPConfig ldapConfig, Flags flags)
+        public BaseContext(ILogger logger, LdapConfig ldapConfig, Flags flags)
         {
             Logger = logger;
             Flags = flags;
-            LDAPUtils = new LDAPUtils();
-            LDAPUtils.SetLDAPConfig(ldapConfig);
+            LDAPUtils = new LdapUtils();
+            LDAPUtils.SetLdapConfig(ldapConfig);
             CancellationTokenSource = new CancellationTokenSource();
         }
 
         public bool IsFaulted { get; set; }
 
-        public ResolvedCollectionMethod ResolvedCollectionMethods { get; set; }
+        public CollectionMethod ResolvedCollectionMethods { get; set; }
         public string LdapFilter { get; set; }
         public string SearchBase { get; set; }
         public string DomainName { get; set; }
@@ -56,7 +56,7 @@ public BaseContext(ILogger logger, LDAPConfig ldapConfig, Flags flags)
         public int Jitter { get; set; }
         public int PortScanTimeout { get; set; } = 500;
         public CancellationTokenSource CancellationTokenSource { get; set; }
-        public ILDAPUtils LDAPUtils { get; set; }
+        public ILdapUtils LDAPUtils { get; set; }
         public Task CollectionTask { get; set; }
         public Flags Flags { get; set; }
 
@@ -90,12 +90,12 @@ public string GetCachePath()
             return path;
         }
 
-        public ResolvedCollectionMethod SetupMethodsForLoop()
+        public CollectionMethod SetupMethodsForLoop()
         {
             var original = ResolvedCollectionMethods;
-            const ResolvedCollectionMethod computerCollectionMethods =
-                ResolvedCollectionMethod.LocalGroups | ResolvedCollectionMethod.LoggedOn |
-                ResolvedCollectionMethod.Session;
+            const CollectionMethod computerCollectionMethods =
+                CollectionMethod.LocalGroups | CollectionMethod.LoggedOn |
+                CollectionMethod.Session;
             return original & computerCollectionMethods;
         }
 

src/Client/Context.cs

@@ -47,7 +47,7 @@ public interface IContext
         CancellationTokenSource CancellationTokenSource { get; set; }
 
         ILogger Logger { get; set; }
-        ILDAPUtils LDAPUtils { get; set; }
+        ILdapUtils LDAPUtils { get; set; }
 
         string OutputPrefix { get; set; }
         string OutputDirectory { get; set; }
@@ -62,7 +62,7 @@ public interface IContext
 
         public string LocalAdminPassword { get; set; }
 
-        ResolvedCollectionMethod ResolvedCollectionMethods { get; set; }
+        CollectionMethod ResolvedCollectionMethods { get; set; }
 
         /// <summary>
         ///     Does throttle and jitter for computer requests
@@ -71,7 +71,7 @@ public interface IContext
         Task DoDelay();
 
         string GetCachePath();
-        ResolvedCollectionMethod SetupMethodsForLoop();
+        CollectionMethod SetupMethodsForLoop();
         string ResolveFileName(string filename, string extension, bool addTimestamp);
         EnumerationDomain[] Domains { get; set; }
         void UpdateLoopTime();

src/Client/Flags.cs

@@ -27,5 +27,6 @@ public class Flags
         public bool SearchForest { get; set; }
         public bool RecurseDomains { get; set; }
         public bool DoLocalAdminSessionEnum { get; set; }
+        public bool ParititonLdapQueries { get; set; }
     }
 }

src/Client/Links.cs

@@ -9,15 +9,15 @@ namespace Sharphound.Client
     /// <typeparam name="T">A context to be populated.</typeparam>
     public interface Links<T>
     {
-        IContext Initialize(IContext context, LDAPConfig options);
+        IContext Initialize(IContext context, LdapConfig options);
 
-        IContext
+        Task<IContext>
             TestConnection(
                 T context); //Initial LDAP connection test. Search for the well known administrator SID to make sure we can connect successfully.
 
         IContext SetSessionUserName(string overrideUserName, T context);
         IContext InitCommonLib(T context);
-        IContext GetDomainsForEnumeration(T context);
+        Task<IContext> GetDomainsForEnumeration(T context);
         IContext StartBaseCollectionTask(T context);
         Task<IContext> AwaitBaseRunCompletion(T context);
         IContext StartLoopTimer(T context);

src/EnumerationDomain.cs

@@ -1,9 +1,12 @@
+using System.DirectoryServices.ActiveDirectory;
+
 namespace Sharphound
 {
     public class EnumerationDomain
     {
         public string Name { get; set; }
         public string DomainSid { get; set; }
+        public string TrustType { get; set; }
     }
 }
 

src/Extensions.cs

@@ -24,7 +24,7 @@ internal static void Merge<TKey, TValue>(this Dictionary<TKey, TValue> s, Dictio
             }
         }
 
-        public static string GetDNSName(this ISearchResultEntry entry, string overrideDNSName)
+        public static string GetDNSName(this IDirectoryObject entry, string overrideDNSName)
         {
             var shortName = entry.GetProperty("samaccountname")?.TrimEnd('$');
             var dns = entry.GetProperty("dnshostname");
@@ -111,10 +111,10 @@ internal static async IAsyncEnumerable<T> ReadAllAsync<T>(this ChannelReader<T>
         /// Removes non-computer collection methods from specified ones for looping
         /// </summary>
         /// <returns></returns>
-        internal static ResolvedCollectionMethod GetLoopCollectionMethods(this ResolvedCollectionMethod methods)
+        internal static CollectionMethod GetLoopCollectionMethods(this CollectionMethod methods)
         {
-            const ResolvedCollectionMethod computerCollectionMethods = ResolvedCollectionMethod.LocalGroups | ResolvedCollectionMethod.LoggedOn |
-                                                                       ResolvedCollectionMethod.Session;
+            const CollectionMethod computerCollectionMethods = CollectionMethod.LocalGroups | CollectionMethod.LoggedOn |
+                                                                       CollectionMethod.Session;
             return methods & computerCollectionMethods;
         }
     }

src/Options.cs

@@ -92,9 +92,12 @@ public class Options
 
         [Option(HelpText = "Override port for LDAP", Default = 0)]
         public int LDAPPort { get; set; }
+
+        [Option(HelpText = "Override port for LDAPS", Default = 0)]
+        public int LDAPSSLPort { get; set; }
 
-        [Option(HelpText = "Connect to LDAP SSL instead of regular LDAP", Default = false)]
-        public bool SecureLDAP { get; set; }
+        [Option(HelpText = "Only connect to LDAP SSL, disallowing fallback", Default = false)]
+        public bool ForceSecureLDAP { get; set; }
 
         [Option(HelpText = "Disables certificate verification when using LDAPS", Default = false)]
         public bool DisableCertVerification { get; set; }
@@ -136,6 +139,9 @@ public class Options
 
         [Option(HelpText = "Collect all LDAP properties from objects")]
         public bool CollectAllProperties { get; set; }
+
+        [Option(HelpText = "Split the main ldap query into smaller chunks to attempt to reduce server load")]
+        public bool PartitionLdapQueries { get; set; }
 
         //Loop Options
         [Option('l', "Loop", HelpText = "Loop computer collection")]
@@ -153,13 +159,13 @@ public class Options
         [Option('v', HelpText = "Enable verbose output", Default = (int)LogLevel.Information)]
         public int Verbosity { get; set; }
 
-        internal bool ResolveCollectionMethods(ILogger logger, out ResolvedCollectionMethod resolved, out bool dconly)
+        internal bool ResolveCollectionMethods(ILogger logger, out CollectionMethod resolved, out bool dconly)
         {
             var arr = CollectionMethods.Count() == 1
                 ? CollectionMethods.First().Split(',')
                 : CollectionMethods.ToArray();
 
-            resolved = ResolvedCollectionMethod.None;
+            resolved = CollectionMethod.None;
             dconly = false;
 
             foreach (var baseMethod in arr)
@@ -177,29 +183,29 @@ internal bool ResolveCollectionMethods(ILogger logger, out ResolvedCollectionMet
 
                 resolved |= option switch
                 {
-                    CollectionMethodOptions.Group => ResolvedCollectionMethod.Group,
-                    CollectionMethodOptions.Session => ResolvedCollectionMethod.Session,
-                    CollectionMethodOptions.LoggedOn => ResolvedCollectionMethod.LoggedOn,
-                    CollectionMethodOptions.Trusts => ResolvedCollectionMethod.Trusts,
-                    CollectionMethodOptions.ACL => ResolvedCollectionMethod.ACL,
-                    CollectionMethodOptions.ObjectProps => ResolvedCollectionMethod.ObjectProps,
-                    CollectionMethodOptions.RDP => ResolvedCollectionMethod.RDP,
-                    CollectionMethodOptions.DCOM => ResolvedCollectionMethod.DCOM,
-                    CollectionMethodOptions.LocalAdmin => ResolvedCollectionMethod.LocalAdmin,
-                    CollectionMethodOptions.PSRemote => ResolvedCollectionMethod.PSRemote,
-                    CollectionMethodOptions.SPNTargets => ResolvedCollectionMethod.SPNTargets,
-                    CollectionMethodOptions.Container => ResolvedCollectionMethod.Container,
-                    CollectionMethodOptions.GPOLocalGroup => ResolvedCollectionMethod.GPOLocalGroup,
-                    CollectionMethodOptions.LocalGroup => ResolvedCollectionMethod.LocalGroups,
-                    CollectionMethodOptions.UserRights => ResolvedCollectionMethod.UserRights,
-                    CollectionMethodOptions.Default => ResolvedCollectionMethod.Default,
-                    CollectionMethodOptions.DCOnly => ResolvedCollectionMethod.DCOnly,
-                    CollectionMethodOptions.ComputerOnly => ResolvedCollectionMethod.ComputerOnly,
-                    CollectionMethodOptions.CARegistry => ResolvedCollectionMethod.CARegistry,
-                    CollectionMethodOptions.DCRegistry => ResolvedCollectionMethod.DCRegistry,
-                    CollectionMethodOptions.CertServices => ResolvedCollectionMethod.CertServices,
-                    CollectionMethodOptions.All => ResolvedCollectionMethod.All,
-                    CollectionMethodOptions.None => ResolvedCollectionMethod.None,
+                    CollectionMethodOptions.Group => CollectionMethod.Group,
+                    CollectionMethodOptions.Session => CollectionMethod.Session,
+                    CollectionMethodOptions.LoggedOn => CollectionMethod.LoggedOn,
+                    CollectionMethodOptions.Trusts => CollectionMethod.Trusts,
+                    CollectionMethodOptions.ACL => CollectionMethod.ACL,
+                    CollectionMethodOptions.ObjectProps => CollectionMethod.ObjectProps,
+                    CollectionMethodOptions.RDP => CollectionMethod.RDP,
+                    CollectionMethodOptions.DCOM => CollectionMethod.DCOM,
+                    CollectionMethodOptions.LocalAdmin => CollectionMethod.LocalAdmin,
+                    CollectionMethodOptions.PSRemote => CollectionMethod.PSRemote,
+                    CollectionMethodOptions.SPNTargets => CollectionMethod.SPNTargets,
+                    CollectionMethodOptions.Container => CollectionMethod.Container,
+                    CollectionMethodOptions.GPOLocalGroup => CollectionMethod.GPOLocalGroup,
+                    CollectionMethodOptions.LocalGroup => CollectionMethod.LocalGroups,
+                    CollectionMethodOptions.UserRights => CollectionMethod.UserRights,
+                    CollectionMethodOptions.Default => CollectionMethod.Default,
+                    CollectionMethodOptions.DCOnly => CollectionMethod.DCOnly,
+                    CollectionMethodOptions.ComputerOnly => CollectionMethod.ComputerOnly,
+                    CollectionMethodOptions.CARegistry => CollectionMethod.CARegistry,
+                    CollectionMethodOptions.DCRegistry => CollectionMethod.DCRegistry,
+                    CollectionMethodOptions.CertServices => CollectionMethod.CertServices,
+                    CollectionMethodOptions.All => CollectionMethod.All,
+                    CollectionMethodOptions.None => CollectionMethod.None,
                     _ => throw new ArgumentOutOfRangeException()
                 };
 
@@ -209,56 +215,56 @@ internal bool ResolveCollectionMethods(ILogger logger, out ResolvedCollectionMet
             if (Stealth)
             {
                 var updates = new List<string>();
-                if ((resolved & ResolvedCollectionMethod.LoggedOn) != 0)
+                if ((resolved & CollectionMethod.LoggedOn) != 0)
                 {
-                    resolved ^= ResolvedCollectionMethod.LoggedOn;
+                    resolved ^= CollectionMethod.LoggedOn;
                     updates.Add("[-] Removed LoggedOn");
                 }
 
                 var localGroupRemoved = false;
-                if ((resolved & ResolvedCollectionMethod.RDP) != 0)
+                if ((resolved & CollectionMethod.RDP) != 0)
                 {
                     localGroupRemoved = true;
-                    resolved ^= ResolvedCollectionMethod.RDP;
+                    resolved ^= CollectionMethod.RDP;
                     updates.Add("[-] Removed RDP Collection");
                 }
 
-                if ((resolved & ResolvedCollectionMethod.DCOM) != 0)
+                if ((resolved & CollectionMethod.DCOM) != 0)
                 {
                     localGroupRemoved = true;
-                    resolved ^= ResolvedCollectionMethod.DCOM;
+                    resolved ^= CollectionMethod.DCOM;
                     updates.Add("[-] Removed DCOM Collection");
                 }
 
-                if ((resolved & ResolvedCollectionMethod.PSRemote) != 0)
+                if ((resolved & CollectionMethod.PSRemote) != 0)
                 {
                     localGroupRemoved = true;
-                    resolved ^= ResolvedCollectionMethod.PSRemote;
+                    resolved ^= CollectionMethod.PSRemote;
                     updates.Add("[-] Removed PSRemote Collection");
                 }
 
-                if ((resolved & ResolvedCollectionMethod.LocalAdmin) != 0)
+                if ((resolved & CollectionMethod.LocalAdmin) != 0)
                 {
                     localGroupRemoved = true;
-                    resolved ^= ResolvedCollectionMethod.LocalAdmin;
+                    resolved ^= CollectionMethod.LocalAdmin;
                     updates.Add("[-] Removed LocalAdmin Collection");
                 }
 
-                if ((resolved & ResolvedCollectionMethod.CARegistry) != 0)
+                if ((resolved & CollectionMethod.CARegistry) != 0)
                 {
-                    resolved ^= ResolvedCollectionMethod.CARegistry;
+                    resolved ^= CollectionMethod.CARegistry;
                     updates.Add("[-] Removed CARegistry Collection");
                 }
 
-                if ((resolved & ResolvedCollectionMethod.DCRegistry) != 0)
+                if ((resolved & CollectionMethod.DCRegistry) != 0)
                 {
-                    resolved ^= ResolvedCollectionMethod.DCRegistry;
+                    resolved ^= CollectionMethod.DCRegistry;
                     updates.Add("[-] Removed DCRegistry Collection");
                 }
 
                 if (localGroupRemoved)
                 {
-                    resolved |= ResolvedCollectionMethod.GPOLocalGroup;
+                    resolved |= CollectionMethod.GPOLocalGroup;
                     updates.Add("[+] Added GPOLocalGroup");
                 }