SpecterOps / SpecterOps/SharpHoundCommon
[FEATURE] Add Local Registry Fallback For Machine Running SharpHound
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 104
- Forks
- 56
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 2
Description
Currently, SharpHound always uses RegistryKey.OpenRemoteBaseKey to read registry values
https://github.com/SpecterOps/SharpHoundCommon/blob/2a8e5af6664e1d666a7e913289218741cc5e1837/src/CommonLib/IRegistryKey.cs#L39
However, there are scenarios where a standard user runs SharpHound directly on a Domain Controller or another target machine. In these cases, the call to OpenRemoteBaseKey often fails because it requires the Remote Registry service and appropriate remote permissions, which standard users typically lack.
On the other hand, the same user may have sufficient rights to read the local registry. Therefore, adding a check to determine if machineName refers to the local machine and using RegistryKey.OpenBaseKey instead would significantly improve data collection success rates.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/CommonLib/IRegistryKey.cs at the OpenRemoteBaseKey call linked in the issue, and inspect how machineName is handled. Add the local-machine check so local access uses OpenBaseKey while remote access retains the existing path. Done means local registry reads no longer require the Remote Registry service and remote reads remain unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- operating-systems
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100