Skip to content

SharpHound 2.7.2 incomplete domain users enumeration #177

@hubert3

Description

@hubert3

Running SharpHound 2.7.2 with -c all or -c dconly only results in 2000-2500 users being enumerated in our environment when there are actually more than 120,000 users that were reliably enumerated with earlier versions.

Earlier version of Sharphound returning a complete set of users:

% jsonpp 20250715194931_users.json | tail
    }
  ],
  "meta": {
    "methods": 6583295,
    "type": "users",
    "count": 146090,
    "version": 6,
    "collectorversion": "2.6.7.0"
  }
}%

Current version:

% jsonpp 20250924134957_users.json | tail
    }
  ],
  "meta": {
    "methods": 15725567,
    "type": "users",
    "count": 2516,
    "version": 6,
    "collectorversion": "2.7.2.0"
  }
}

The number of users returned varies significantly from 2000 or 2500 up to 80,000 and 120,000 on some attempts. It seems possible this was introduced by new timeout code.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions