Unhandled exception crashes using Sharphound.exe

[arvchristos]

Hello!

While executing Sharphound.exe =, occasionally I get the following crash and the collection stops:

Application: SharpHound.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.DirectoryServices.Protocols.DirectoryOperationException

Server stack trace: 
   at System.DirectoryServices.Protocols.LdapConnection.ConstructResponse(Int32 messageId, LdapOperation operation, ResultAll resultType, TimeSpan requestTimeOut, Boolean exceptionOnTimeOut)
   at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Object[]& outArgs)
   at System.Runtime.Remoting.Messaging.StackBuilderSink.AsyncProcessMessage(IMessage msg, IMessageSink replySink)
   at System.DirectoryServices.Protocols.LdapConnection.EndSendRequest(System.IAsyncResult)
   at SharpHound3.DirectorySearch+<>c__DisplayClass11_0.<RangedRetrievalAsync>b__0(System.IAsyncResult)
   at System.Threading.Tasks.TaskFactory`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].FromAsyncCoreLogic(System.IAsyncResult, System.Func`2<System.IAsyncResult,System.__Canon>, System.Action`1<System.IAsyncResult>, System.Threading.Tasks.Task`1<System.__Canon>, Boolean)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(System.Threading.Tasks.Task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(System.Threading.Tasks.Task)
   at SharpHound3.DirectorySearch+<RangedRetrievalAsync>d__11.MoveNext()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(System.Threading.Tasks.Task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(System.Threading.Tasks.Task)
   at SharpHound3.Tasks.GroupEnumerationTasks+<GetGroupMembership>d__3.MoveNext()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(System.Threading.Tasks.Task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(System.Threading.Tasks.Task)
   at SharpHound3.Tasks.GroupEnumerationTasks+<ProcessGroupMembership>d__1.MoveNext()

Exception Info: System.AggregateException

Exception Info: System.AggregateException

Exception Info: System.AggregateException

Exception Info: System.AggregateException

Exception Info: System.AggregateException

Exception Info: System.AggregateException

Exception Info: System.AggregateException

Exception Info: System.AggregateException

Exception Info: System.AggregateException
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(System.Threading.Tasks.Task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(System.Threading.Tasks.Task)
   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(System.Threading.Tasks.Task)
   at SharpHound3.SharpHound+<Main>d__0.MoveNext()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(System.Threading.Tasks.Task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(System.Threading.Tasks.Task)
   at SharpHound3.SharpHound.<Main>(System.String[])

I thought of reporting it considering it is an unhandled exception case.

[robertstrom]

SharpHound.exe version 3.0.0.0 downloaded today. Running on Windows 10 2004 19041.985 connecting to the domain using runas /netonly

This has happened twice. Once running a --CollectionMethod Session --Loop and once just running just a Session Collection method

SharpHound.exe -d blah.blah.domain.local --CollectionMethod Session --Loop --Loopduration 1:00:00

[robertstrom]

Hello,

Some more testing reveals that the issue also exists when using the PowerShell SharpHound.ps1 Invoke-BloodHound function and that the point where they error appears to be essentially the same

Starting SharpHound.exe using this command line

.\SharpHound.exe -c All -d blah.blah.local --zipFilename C:\Temp\BloodHound3\SharpHound_Results-All_NOT_Stealth_2021-06-26.zip --WindowsOnly --OutputDirectory C:\Temp\BloodHound3\

SharpHound erroring @ 1867 objects into the process

Invoke-BloodHound starting using this command line

Invoke-BloodHound -CollectionMethod All -Domain blah.blah.local -ZipFilename C:\Temp\BloodHound3\Invoke-BloodHound_Results-All_NOT_Stealth_2021-06-26.zip -WindowsOnly -OutputDirectory C:\Temp\BloodHound3\

Invoke-BloodHound erroring at 1863 / 1864 objects into the process

Invoke-BloodHound appearing to continue on but is eternally stuck at the object 1864

I currently have some other collections going using the Stealth option

Invoke-BloodHound -CollectionMethod All -Domain blah.blah.local -ZipFilename C:\Temp\BloodHound3\Invoke-BloodHound_Results-All_2021-06-26.zip -WindowsOnly -Stealth -OutputDirectory C:\Temp\BloodHound3\

The collection was started a bit over two hours ago and it is still at this state

Invoke-BloodHound collecting Session with Stealth switch started over 3 hours ago and it is still at this state

SharpHound started with Stealth switch. Just started this one a little while ago so we will see how this goes.

Let me know if you need more information or have a new version to test.

Thanks!

Robert

[rvazarkar]

We've completely rewritten SharpHound from the ground up for vnext so hopefully this will be fixed there

[robertstrom]

We've completely rewritten SharpHound from the ground up for vnext so hopefully this will be fixed there

Very much looking forward to it's release and doing some testing ... testing of the network and testing of SharpHound.

Is it available now? Doesn't look like it. Any expected release time frame?

Thanks!!