SpecterOps / SpecterOps/SharpHound

SharpHound 2.7.2 incomplete domain users enumeration

Open
#177 7 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
1.3k
Forks
266
Avg merge
2d 7h
Merged PRs (30d)
3

Description

Running SharpHound 2.7.2 with -c all or -c dconly only results in 2000-2500 users being enumerated in our environment when there are actually more than 120,000 users that were reliably enumerated with earlier versions.

Earlier version of Sharphound returning a complete set of users:

% jsonpp 20250715194931_users.json | tail
    }
  ],
  "meta": {
    "methods": 6583295,
    "type": "users",
    "count": 146090,
    "version": 6,
    "collectorversion": "2.6.7.0"
  }
}%

Current version:

% jsonpp 20250924134957_users.json | tail
    }
  ],
  "meta": {
    "methods": 15725567,
    "type": "users",
    "count": 2516,
    "version": 6,
    "collectorversion": "2.7.2.0"
  }
}

The number of users returned varies significantly from 2000 or 2500 up to 80,000 and 120,000 on some attempts. It seems possible this was introduced by new timeout code.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Compare SharpHound 2.6.7 and 2.7.2 around domain-user enumeration and the new timeout code. Reproduce with -c all and -c dconly, then verify that the output consistently includes the complete domain-user set rather than varying between 2,000 and 120,000 users.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.