Sharphound 1.0.3 Missing Data

[Zinterax]

I'm attempting to collect LocalAdmin data against a domain but I'm not getting any results. My understanding is that I should be able to collect this information from pre-2016 servers without needing local admin on the remote server. Using SharpView with Get-NetLocalGroupmember I am able to get the results as expected but looking at the JSON from SharpHound 1.0.3 I'm not sure if the collection even ran as everything says Collected:false.

{"data":[{"PrimaryGroupSID":null,"AllowedToDelegate":[],"AllowedToAct":[],"HasSIDHistory":[],"Sessions":{"Results":[],"Collected":false,"FailureReason":null},"PrivilegedSessions":{"Results":[],"Collected":false,"FailureReason":null},"RegistrySessions":{"Results":[],"Collected":false,"FailureReason":null},"LocalAdmins":{"Results":[],"Collected":false,"FailureReason":null},"RemoteDesktopUsers":{"Results":[],"Collected":false,"FailureReason":null},"DcomUsers":{"Results":[],"Collected":false,"FailureReason":null},"PSRemoteUsers":{"Results":[],"Collected":false,"FailureReason":null},"Status":null,"Aces":[] ...snip...

[rvazarkar]

Use the -TrackComputerCalls flag to see why its not giving you any data on this machine

[Zinterax]

Tested against a system and this is the output.

ComputerName,Task,Status Y <target>, CheckAvailability, PortNotOpen Y

However SharpView returns data as expected.

[dev-2null]

I'm getting the same issue, with --TrackComputerCalls flag set, it always tells you "PortNotOpen", Examining Wireshark I see sth like Error: Unknown DOS error 0x00020000 or STATUS_PIPE_NOT_AVAILABLE. Regarding the LocalAdmin enumeration, I only see a ping request/response, no further connection made to the target, but actually using NetLocalGroupGetMember works perfectly.

[yellow-starburst]

Yeah I had this issue too!
It gives me that error yet the host is up and smb accessible.

[rvazarkar]

So when we check if a computer is available, we do a check for port 445 being open with a short timeout. You can up that timeout with --portchecktimeout flag to see if that might help. You can see the code here: https://github.com/BloodHoundAD/SharpHoundCommon/blob/6ee56e89d9333961c04835c4b6984c3157b10d61/src/CommonLib/Processors/PortScanner.cs#L30-L65

[yellow-starburst]

So when we check if a computer is available, we do a check for port 445 being open with a short timeout. You can up that timeout with --portchecktimeout flag to see if that might help. You can see the code here: https://github.com/BloodHoundAD/SharpHoundCommon/blob/6ee56e89d9333961c04835c4b6984c3157b10d61/src/CommonLib/Processors/PortScanner.cs#L30-L65

@rvazarkar Why is the default value 500? Wouldn't that mean 1/2 a second? If that is the case then no wonder if there are false negatives.
What do you think about bumping to the old default of 2 seconds (2000) ?

[rvazarkar]

Its 500 because in our testing, that was good enough. Bumping it to 2000 will increase enumeration time significantly on every env.