RustHound

Crates.io GitHub Linux supported Windows supported Twitter Follow

Summary

Limitations

Not all SharpHound features are implemented yet but some are existing in RustHound and do not in SharpHound or BloodHound-Python. Please refer to the roadmap for more information.

Description

RustHound is a cross-platform BloodHound collector tool, written in Rust. (Linux,Windows,MacOS)

No anti-virus detection and cross-compiled.

RustHound generate users,groups,computers,ous,gpos,containers,domains json files to analyze it with BloodHound application.

💡 If you can use SharpHound.exe, use it. Rusthound is a backup solution if SharpHound.exe is detected by AV or if SharpHound.exe isn't executable from the system where you have access to.

Usage

```bash USAGE: rusthound [FLAGS] [OPTIONS] --domain

FLAGS: --dns-tcp Use TCP instead of UDP for DNS queries --fqdn-resolver [MODULE] Use fqdn-resolver module to get computers IP address -h, --help Prints help information --ldaps Prepare ldaps request. Like ldaps://G0H4N.LAB/ -v Sets the level of verbosity -V, --version Prints version information -z, --zip RustHound will compress the JSON files into a zip archive (doesn't work with Windows)

OPTIONS: -d, --domain Domain name like: G0H4N.LAB -f, --ldapfqdn Domain Controler FQDN like: DC01.G0H4N.LAB -i, --ldapip Domain Controller IP address -p, --ldappassword Ldap password to use -P, --ldapport Ldap port, default is 389 -u, --ldapusername Ldap username to use -n, --name-server Alternative IP address name server to use for queries -o, --dirpath Path where you would like to save json files ```

How to compile it?

Using Makefile

You can use make command to install Rusthound or to compile it for Linux or Windows.

bash make install rusthount -h

More command in the Makefile:

bash make help usage: make install usage: make uninstall usage: make debug usage: make release usage: make windows

Using Dockerfile

Use RustHound with docker to make sure to have all dependencies.

bash docker build -t rusthound . docker run rusthound -h

Using Cargo

You need to install rust on your system (Windows/Linux/MacOS).

https://www.rust-lang.org/fr/tools/install

RustHound support Kerberos/GSSAPI but this means that it needs Clang and its development libraries, as well as the Kerberos development libraries. On Debian/Ubuntu, that means clang-N, libclang-N-dev and libkrb5-dev.

For example: ```bash

Debian/Ubuntu

apt-get -y install gcc libgssapi-krb5-2 libkrb5-dev libsasl2-modules-gssapi-mit ```

Here is how to compile the "release" and "debug" versions from "cargo" command.

```bash git clone https://github.com/OPENCYBER-FR/RustHound cd RustHound cargo build --release

or debug version

cargo b ```

The result can be found in "target/release" or in "target/debug" folder.

Below you can find the compilation methodology for each of the OS from Linux. If you need another compilation system, please consult the list in this link : https://doc.rust-lang.org/nightly/rustc/platform-support.html

Manually for Linux x86_64 static version

```bash

Install rustup and cargo in Linux

curl https://sh.rustup.rs -sSf | sh

Add Linux deps

rustup install stable-x8664-unknown-linux-gnu rustup target add x8664-unknown-linux-gnu

Static compilation for Linux

git clone https://github.com/OPENCYBER-FR/RustHound cd RustHound CFLAGS="-lrt";LDFLAGS="-lrt";RUSTFLAGS='-C target-feature=+crt-static';cargo build --release --target x86_64-unknown-linux-gnu ```

The result can be found in "target/x86_64-unknown-linux-gnu/release" folder.

Manually for Windows static version from Linux

```bash

Install rustup and cargo in Linux

curl https://sh.rustup.rs -sSf | sh

Add Windows deps

rustup install stable-x8664-pc-windows-gnu rustup target add x8664-pc-windows-gnu

Static compilation for Windows

git clone https://github.com/OPENCYBER-FR/RustHound cd RustHound RUSTFLAGS="-C target-feature=+crt-static" cargo build --release --target x86_64-pc-windows-gnu ```

The result can be found in "target/x86_64-pc-windows-gnu/release" folder.

How to build the documentation?

bash git clone https://github.com/OPENCYBER-FR/RustHound cd RustHound cargo doc --open --no-deps

Demo

Examples are done on the GOADv2 implemented by mayfly:

```bash

Linux with username:password

./rusthound -d north.sevenkingdoms.local -u 'jeor.mormont@north.sevenkingdoms.local' -p 'L0ngCl@w' -o /tmp/demo/rusthound_north -z

Linux with username:password and ldaps

./rusthound -d north.sevenkingdoms.local --ldaps -u 'jeor.mormont@north.sevenkingdoms.local' -p 'L0ngCl@w' -o /tmp/demo/rusthound_north -z

Linux with username:password and ldaps and custom port

./rusthound -d north.sevenkingdoms.local --ldaps -P 3636 -u 'jeor.mormont@north.sevenkingdoms.local' -p 'L0ngCl@w' -o /tmp/demo/rusthound_north -z

Linux with username:password and ldaps and fqdn resolver module

./rusthound -d north.sevenkingdoms.local --ldaps -u 'jeor.mormont@north.sevenkingdoms.local' -p 'L0ngCl@w' -o /tmp/demo/rusthound_north --fqdn-resolver

Linux with username:password and ldaps and fqdn resolver module and tcp dns request and custom name server

./rusthound -d north.sevenkingdoms.local --ldaps -u 'jeor.mormont@north.sevenkingdoms.local' -p 'L0ngCl@w' -o /tmp/demo/rusthound_north --fqdn-resolver --tcp-dns --name-server 192.168.56.10 -z

Tips to redirect and append both standard output and standard error to a file > /tmp/rh_output 2>&1

./rusthound -d north.sevenkingdoms.local --ldaps -u 'jeor.mormont@north.sevenkingdoms.local' -p 'L0ngCl@w' -o /tmp/demo/rusthoundnorth --fqdn-resolver > /tmp/rhoutput 2>&1

Windows with GSSAPI session

rusthound.exe -d sevenkingdoms.local --ldapfqdn kingslanding ```

You can find the custom queries used in the demo, in the resource folder.

Use the following command to install it:

bash cp resources/customqueries.json ~/.config/bloodhound/customqueries.json

🚥 Roadmap

Authentification

Outputs

Modules

Bloodhound v4.2

Optimization

:link: Links