User Delegation is not Identified
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 42/100
Research direction
Start by comparing SharpHound 2.3.3's delegation collection behavior with the attached GOAD and BloodHound.py datasets, focusing on the missing AllowedToDelegate and Unconstrained Delegation results for sansa.stark and jon.snow. Done means SharpHound correctly reports both delegation cases and the results align with the validated domain permissions and comparison data.
Written by the indexing model from the issue text.
Description
I've noticed that the latest version of SharpHound (2.3.3) appears to not find delegation correctly for BHCE. I've gathered this with data within GOAD and noticed that some of the edges I've seen in the past are no longer there. I've validated that these permissions do exist in the domain still and were not removed from GOAD.
Specifically, I've noticed the AllowedToDelegate edge is missing from users, as well as the Unconstrained Delegation setting.
Additionally, I've been able to gather these edges from the latest version of BloodHound.py (bloodhound-ce branch) which properly shows the delegation.
The images below focus specifically on the user sansa.stark, the user jon.snow is missing the AllowedToDelegate edge as well.
SharpHound.exe (v2.3.3) Collection
The user sansa.stark is marked without Unconstrained Delegation
findDelegation.py Results
The user sansa.stark is labeled with Unconstrained Delegation
BloodHound.py Collection
The user sansa.stark is properly marked with Unconstrained Delegation
Is this a known issue or some other type of deployment issue? Are there any known workarounds for this issue?
I've attached copies of the data collection here as well. Please let me know if you need more data, screenshots, or samples - I would be happy to gather them! Thanks!
- Dominant language
- C#
- Stars
- 1.4k
- Forks
- 266
- Avg merge
- 24m
- Merged PRs (30d)
- 3
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from SpecterOps/SharpHound
-
DNS resolution errorOpen
Difficulty 4/5 3-5 days Newbie friendliness 48/100
SpecterOps/SharpHound#203 · 2 comments · 3 reactions ·
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
SpecterOps/SharpHound#194 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
SpecterOps/SharpHound#185 · 1 comment · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
SpecterOps/SharpHound#177 · 7 comments · 1 reaction ·
-
Difficulty 5/5 Over a week Newbie friendliness 20/100
SpecterOps/SharpHound#169 · 1 comment · 3 reactions ·
All issues in SpecterOps/SharpHound
Similar issues
-
needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
spectreconsole/spectre.console#2221 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
godotengine/godot-docs#12428 ·
Maintainers usually reply within 1 day
-
.NET triage
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
microsoft/semantic-kernel#14526 ·
Maintainers usually reply within 4 days
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100