So recently I did a box that required running both of these.
When I loaded them from winrm the output kept being in cvs format and for the life of me I could get the Json zip not would it allow the -CollectionMethod All (error saying every other option worked but not all)
Lucky for me I think someone else was on the box at the same time I was and I managed to get the zip to crack the box.
With that said… later I came back even with full access and couldn’t run them local to the device either. I kept getting the error about domain.
Tried -Domain and -DomainController but not exeactly sure how in the world I get SharpHound to actually work.
Method I used…
Import-module ./SharpHound.ps1
Invoke-BloodHound -CollectionMethod All
(basic form and then others for domain/user creds nothing worked to get past the domain error or ldap error)
Nothing I found on google seemed to help me.
Anyone that could help me figure this out would be greatly appreciated!
I think i may know the box your taking about and i used the .py version and gained root that way
The .py gives you multiple json files you have to import Manually. I agree there seemed to be less info from .py version than the .ps1 running directly on the box… but saying that i managed to root the box with the info from .py version
Can someone assist me with the box we are talking about. aka root. I found the path I think I need to take. I cant get powerview working… No way to do it remotely. Or can I run winrm with the script option with powerview? Could use some help with the box that is being referenced
I can only tell you that my evil-winrm is not the problem. Maybe it could be the version you are using from bloodhound.ps1 or sharphound.ps1. Soon we will release version 2.1 of Evil-WinRM. Thanks for using it.
I can only tell you that my evil-winrm is not the problem. Maybe it could be the version you are using from bloodhound.ps1 or sharphound.ps1. Soon we will release version 2.1 of Evil-WinRM. Thanks for using it.
Right on! Love Evil-Win. No, it was 100% the call to use blood and sharp. Didn’t know it needed the creds and such. Based off the info above it works perfect on either version. Also think the box it was used on had a part to play.
Anyone have any idea why i’m getting a:
File “bloodhound.py”, line 5, in
bloodhound.main()
File “/root/BloodHound.py/bloodhound/init.py”, line 286, in main
disable_pooling=args.disable_pooling)
File “/root/BloodHound.py/bloodhound/init.py”, line 72, in run
self.pdc.prefetch_info(‘objectprops’ in collect, ‘acl’ in collect)
File “/root/BloodHound.py/bloodhound/ad/domain.py”, line 385, in prefetch_info
self.get_computers(include_properties=props, acl=acls)
File “/root/BloodHound.py/bloodhound/ad/domain.py”, line 352, in get_computers
for entry in entries:
File “/root/BloodHound.py/bloodhound/ad/domain.py”, line 150, in search
for e in sresult:
File “/usr/local/lib/python2.7/dist-packages/ldap3/extend/standard/PagedSearch.py”, line 64, in paged_search_generator
None if cookie is True else cookie)
File “/usr/local/lib/python2.7/dist-packages/ldap3/core/connection.py”, line 765, in search
raise LDAPAttributeError('invalid attribute type ’ + attribute_name_to_check)
ldap3.core.exceptions.LDAPAttributeError: invalid attribute type ms-mcs-admpwdexpirationtime
error?
I can’t user the GUI because everytime I load the jsons the screen goes white.
The python in your command is going a bit bonkers. I’m just starting to get into python but i’d guess you didn’t use it right… try one of the other options to run it or look up the specific bloodhound.py
Bloodhound just really helps you track down what to do and how.
The first time I did this on windows, the 2nd time on linux only.
Windows was very interesting, linux was pretty easy after windows.
This is why I don’t like being dependent on tools.
took the words right out of my mouth lol I swear the amount of time people spend struggling to get pre made scripts working… better off spending that time just learning how to do it without the pre made tools.
