Network PenTest

RustHound: cross-platform BloodHound collector tool, written in Rust

by do son · December 28, 2022

RustHound

RustHound is a cross-platform BloodHound collector tool, written in Rust. (Linux, Windows, MacOS)

No anti-virus detection and cross-compiled.

RustHound generates users, groups, computers, ous, gpos, containers, domains json files to analyze with the BloodHound application.

💡 If you can use SharpHound.exe, use it. Rusthound is a backup solution if SharpHound.exe is detected by AV or if SharpHound.exe isn’t executable from the system where you have access to.

🚀 Statistics

In order to make statistics on a DC with more LDAP objects, we run the BadBlood project on the domain controller ESSOS.local from GOAD. The DC has now around 3500 objects. An execution average time has been done and here is the output:

Tool	Environment	Objects	Time	Command line
SharpHound.exe	Windows	~3500	~51.605s	Measure-Command { sharphound.exe -d essos.local –ldapusername ‘khal.drogo’ –ldappassword ‘horse’ –domaincontroller ‘192.168.56.12’ -c All }
BloodHound.py	Linux	~3500	~9.657s	time python3 bloodhound.py -u khal.drogo -p horse -d essos.local -ns 192.168.56.12 –zip -c all
RustHound.exe	Windows	~3500	~5.315s	Measure-Command { rusthound.exe -d essos.local -u khal.drogo@essos.local -p horse -z }
RustHound	Linux	~3500	~3.166s	time rusthound -d essos.local -u khal.drogo@essos.local -p horse -z

Roadmap

Authentification

Outputs

Modules

Retrieve LAPS passwords if your user can read them automatic
Resolve FQDN computers found to IP address –fqdn-resolver
Retrieve certificates for ESC exploitation with Certipy –enum-certificates
Kerberos attack module (ASREPROASTING,KERBEROASTING) –attack-kerberos
Retrieve data from trusted domains –follow-trust (Currently working on it, got a beta version of this module)

Bloodhound v4.2

Parsing Features
- AllowedToDelegate
- AllowedToAct
- Properties:sidhistory not tested!
  - HasSIDHistory
- Sessions
  - List users with RPC
Users
- Properties : sfupassword
OUs & Domains
- GPOChanges
  - LocalAdmins
  - RemoteDesktopUsers
  - DcomUsers
  - PSRemoteUsers