Collecting Data with SharpHound
We’ll use BloodHound in the next section to analyze, organize and present the data,
and the companion data collection tool, SharpHound, to collect the data.
Let’s get SharpHound up and running.
SharpHound is available in a few different formats.
We can compile it ourselves, use an already compiled executable,
or use it as a PowerShell script.
In our case, we will use the PowerShell script that is located in
C:\Tools on CLIENT75.
First, let’s import the script to memory:
With SharpHound imported, we can now start collecting domain data.
However, in order to run SharpHound, we must first run Invoke-BloodHound.
This is not intuitive since we’re only running SharpHound at this stage.
Let’s invoke Get-Help to learn more about this command.
We’ll begin with the -CollectionMethod,
which describes the various collection methods.
In our case, we’ll attempt to gather All data,
which will perform all collection methods except for local group policies.
By default, SharpHound will gather the data in JSON files and automatically
zip them for us.
This makes it easy for us to transfer the file to Kali Linux later.
We’ll save this output file on our desktop,
with a “corp audit” prefix as shown:
Note that the data collection may take a few moments to finish,
depending on the size of the environment we are enumerating.
Let’s examine SharpHound’s output:
Based on the output, we scanned a total of 106 objects.
This will obviously vary based on how many objects and sessions exist in the domain.
In this case, SharpHound essentially took a snapshot of the domain from the
stephanie user, and we should be able to analyze everything the user account
has access to.
The collected data is stored in the zip file located on our Desktop:
We’ll use this file in the next section as we analyze the data with BloodHound.
Sharphound created the bin cache file to speed up data collection.
This is not needed for our analysis and we can safely delete it.