SpecterOps / SpecterOps/SharpHound
SharpHound 2.7.2 incomplete domain users enumeration
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 1.3k
- Forks
- 266
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 3
Description
Running SharpHound 2.7.2 with -c all or -c dconly only results in 2000-2500 users being enumerated in our environment when there are actually more than 120,000 users that were reliably enumerated with earlier versions.
Earlier version of Sharphound returning a complete set of users:
% jsonpp 20250715194931_users.json | tail
}
],
"meta": {
"methods": 6583295,
"type": "users",
"count": 146090,
"version": 6,
"collectorversion": "2.6.7.0"
}
}%
Current version:
% jsonpp 20250924134957_users.json | tail
}
],
"meta": {
"methods": 15725567,
"type": "users",
"count": 2516,
"version": 6,
"collectorversion": "2.7.2.0"
}
}
The number of users returned varies significantly from 2000 or 2500 up to 80,000 and 120,000 on some attempts. It seems possible this was introduced by new timeout code.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare SharpHound 2.6.7 and 2.7.2 around domain-user enumeration and the new timeout code. Reproduce with -c all and -c dconly, then verify that the output consistently includes the complete domain-user set rather than varying between 2,000 and 120,000 users.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100