SpecterOps / SpecterOps/SharpHound
User Delegation is not Identified
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 1.3k
- Forks
- 266
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 3
Description
I've noticed that the latest version of SharpHound (2.3.3) appears to not find delegation correctly for BHCE. I've gathered this with data within GOAD and noticed that some of the edges I've seen in the past are no longer there. I've validated that these permissions do exist in the domain still and were not removed from GOAD.
Specifically, I've noticed the AllowedToDelegate edge is missing from users, as well as the Unconstrained Delegation setting.
Additionally, I've been able to gather these edges from the latest version of BloodHound.py (bloodhound-ce branch) which properly shows the delegation.
The images below focus specifically on the user sansa.stark, the user jon.snow is missing the AllowedToDelegate edge as well.
SharpHound.exe (v2.3.3) Collection
The user sansa.stark is marked without Unconstrained Delegation
findDelegation.py Results
The user sansa.stark is labeled with Unconstrained Delegation
BloodHound.py Collection
The user sansa.stark is properly marked with Unconstrained Delegation
Is this a known issue or some other type of deployment issue? Are there any known workarounds for this issue?
I've attached copies of the data collection here as well. Please let me know if you need more data, screenshots, or samples - I would be happy to gather them! Thanks!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing SharpHound 2.3.3's delegation collection behavior with the attached GOAD and BloodHound.py datasets, focusing on the missing AllowedToDelegate and Unconstrained Delegation results for sansa.stark and jon.snow. Done means SharpHound correctly reports both delegation cases and the results align with the validated domain permissions and comparison data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100