Not all SharpHound features are implemented yet but some are existing in RustHound and do not in SharpHound or BloodHound-Python. Please refer to the roadmap for more information.
RustHound is a cross-platform BloodHound collector tool, written in Rust. (Linux,Windows,MacOS)
No anti-virus detection and cross-compiled.
RustHound generate users,groups,computers,ous,gpos,containers,domains json files to analyze it with BloodHound application.
💡 If you can use SharpHound.exe, use it. Rusthound is a backup solution if SharpHound.exe is detected by AV or if SharpHound.exe isn't executable from the system where you have access to.
You can use make command to install Rusthound or to compile it for Linux or Windows.
bash
make install
rusthount -h
More command in the Makefile:
bash
make help
usage: make install
usage: make uninstall
usage: make debug
usage: make release
usage: make windows
usage: make linux_musl
Use RustHound with docker to make sure to have all dependencies.
bash
docker build -t rusthound .
docker run rusthound -h
You need to install rust on your system (Windows/Linux/MacOS).
https://www.rust-lang.org/fr/tools/install
RustHound support Kerberos/GSSAPI but this means that it needs Clang and its development libraries, as well as the Kerberos development libraries. On Debian/Ubuntu, that means clang-N, libclang-N-dev and libkrb5-dev.
For example: ```bash
apt-get -y install gcc libgssapi-krb5-2 libkrb5-dev libsasl2-modules-gssapi-mit ```
Here is how to compile the "release" and "debug" versions from "cargo" command.
```bash git clone https://github.com/OPENCYBER-FR/RustHound cd RustHound cargo build --release
cargo b ```
The result can be found in "target/release" or in "target/debug" folder.
Below you can find the compilation methodology for each of the OS from Linux. If you need another compilation system, please consult the list in this link : https://doc.rust-lang.org/nightly/rustc/platform-support.html
```bash
curl https://sh.rustup.rs -sSf | sh
rustup install stable-x8664-unknown-linux-gnu rustup target add x8664-unknown-linux-gnu
git clone https://github.com/OPENCYBER-FR/RustHound cd RustHound CFLAGS="-lrt";LDFLAGS="-lrt";RUSTFLAGS='-C target-feature=+crt-static';cargo build --release --target x86_64-unknown-linux-gnu ```
The result can be found in "target/x86_64-unknown-linux-gnu/release" folder.
```bash
curl https://sh.rustup.rs -sSf | sh
rustup install stable-x8664-pc-windows-gnu rustup target add x8664-pc-windows-gnu
git clone https://github.com/OPENCYBER-FR/RustHound cd RustHound RUSTFLAGS="-C target-feature=+crt-static" cargo build --release --target x86_64-pc-windows-gnu ```
The result can be found in "target/x86_64-pc-windows-gnu/release" folder.
bash
git clone https://github.com/OPENCYBER-FR/RustHound
cd RustHound
cargo doc --open --no-deps
```bash
USAGE:
rusthound [FLAGS] [OPTIONS] --domain
FLAGS: --adcs [MODULE] Use ADCS module to enumerate Certificate Templates, Certificate Authorities and other configurations. (For the custom-built BloodHound version from @ly4k with PKI support) --dc-only Collects data only from the domain controller. Will not try to retrieve CA security/configuration or check for Web Enrollment. --dns-tcp Use TCP instead of UDP for DNS queries --fqdn-resolver [MODULE] Use fqdn-resolver module to get computers IP address -h, --help Prints help information --ldaps Prepare ldaps request. Like ldaps://G0H4N.LAB/ --old-bloodhound For ADCS only. Output result as BloodHound data for the original BloodHound version from @BloodHoundAD without PKI support. -v Sets the level of verbosity -V, --version Prints version information -z, --zip RustHound will compress the JSON files into a zip archive
OPTIONS:
-d, --domain
Examples are done on the GOADv2 implemented by mayfly:
```bash
rusthound -d north.sevenkingdoms.local -u 'jeor.mormont@north.sevenkingdoms.local' -p 'L0ngCl@w' -o /tmp/demo -z
rusthound -d north.sevenkingdoms.local -i 192.168.56.11 -u 'jeor.mormont@north.sevenkingdoms.local' -p 'L0ngCl@w' -o /tmp/demo -z
rusthound -d north.sevenkingdoms.local --ldaps -u 'jeor.mormont@north.sevenkingdoms.local' -p 'L0ngCl@w' -o /tmp/demo -z
rusthound -d north.sevenkingdoms.local --ldaps -P 3636 -u 'jeor.mormont@north.sevenkingdoms.local' -p 'L0ngCl@w' -o /tmp/demo -z
rusthound -d north.sevenkingdoms.local --ldaps -u 'jeor.mormont@north.sevenkingdoms.local' -p 'L0ngCl@w' -o /tmp/demo --fqdn-resolver > /tmp/rh_output 2>&1
rusthound.exe -d sevenkingdoms.local --ldapfqdn kingslanding
rusthound.exe -d sevenkingdoms.local -u jeor.mormont@north.sevenkingdoms.local -p L0ngCl@w -o output -z ```
```bash
rusthound -d essos.local -u 'daenerys.targaryen@essos.local' -p 'BurnThemAll!' -o /tmp/demo --fqdn-resolver -z
rusthound -d essos.local --ldaps -u 'daenerys.targaryen@essos.local' -p 'BurnThemAll!' -o /tmp/demo --fqdn-resolver --tcp-dns --name-server 192.168.56.12 -z
rusthound.exe -d essos.local -f meereen -o output --fqdn-resolver -z
rusthound.exe -d essos.local -u daenerys.targaryen@essos.local -p BurnThemAll! -o output -z --fqdn-resolver --tcp-dns --name-server 192.168.56.12 ```
Example is done with the @ly4k BloodHound version.
```bash
rusthound -d essos.local -u 'daenerys.targaryen@essos.local' -p 'BurnThemAll!' -o /tmp/adcs --adcs -z
rusthound -d essos.local -u 'daenerys.targaryen@essos.local' -p 'BurnThemAll!' -o /tmp/adcs --adcs --dc-only -z
rusthound -d essos.local -u 'daenerys.targaryen@essos.local' -p 'BurnThemAll!' -o /tmp/adcs --adcs --old-bloodhound -z
rusthound.exe -d essos.local -f meereen -o output -z --adcs
rusthound.exe -d essos.local --ldapfqdn meereen -o output -z --adcs --tcp-dns --name-server 192.168.56.12
rusthound.exe -d essos.local -u daenerys.targaryen@essos.local -p BurnThemAll! -o output -z --adcs --dc-only ```
You can find the custom queries used in the demo, in the resource folder.
Use the following command to install it:
bash
cp resources/customqueries.json ~/.config/bloodhound/customqueries.json
In order to make statistics on a DC with more LDAP objects, we run the BadBlood project on the domain controller ESSOS.local from GOAD. The DC has now around 3500 objects. An execution average time has been done and here are the output:
| Tool | Environment | Objects | Time | Command line |
| -------------------------- | ----------------- | ---------- | ------- | ------- |
| SharpHound.exe | Windows 
| ~3500 | ~51.605s | Measure-Command { sharphound.exe -d essos.local --ldapusername 'khal.drogo' --ldappassword 'horse' --domaincontroller '192.168.56.12' -c All } |
| BloodHound.py | Linux 
| ~3500 | ~9.657s | time python3 bloodhound.py -u khal.drogo -p horse -d essos.local -ns 192.168.56.12 --zip -c all |
| RustHound.exe | Windows | ~3500 | ~5.315s | Measure-Command { rusthound.exe -d essos.local -u khal.drogo@essos.local -p horse -z } |
| RustHound | Linux | ~3500 | ~3.166s | time rusthound -d essos.local -u khal.drogo@essos.local -p horse -z |
BINDNTLMGSSAPI for Windows ok but not tested for LinuxParsing Features
HasSIDHistoryProperties : sfupasswordDCERPC (dependencies)
SessionsLocalAdminsRemoteDesktopUsersDcomUsersPSRemoteUsersUser Specified SANRequest Disposition