HackingScripts/win/SharpHound.ps1

function Invoke-BloodHound
{
    <#
    .SYNOPSIS

        Runs the BloodHound C# Ingestor using reflection. The assembly is stored in this file.

    .DESCRIPTION

        Using reflection and assembly.load, load the compiled BloodHound C# ingestor into memory
        and run it without touching disk. Parameters are converted to the equivalent CLI arguments
        for the SharpHound executable and passed in via reflection. The appropriate function
        calls are made in order to ensure that assembly dependencies are loaded properly.

    .PARAMETER CollectionMethods

        Specifies the CollectionMethods being used. Possible value are:
            Group - Collect group membership information
            LocalGroup - Collect local group information for computers
            LocalAdmin - Collect local admin users for computers
            RDP - Collect remote desktop users for computers
            DCOM - Collect distributed COM users for computers
            PSRemote - Collected members of the Remote Management Users group for computers
            Session - Collect session information for computers
            Trusts - Enumerate domain trust data
            ACL - Collect ACL (Access Control List) data
            Container - Collect GPO/OU Data
            ComputerOnly - Collects Local Group and Session data
            GPOLocalGroup - Collects Local Group information using GPO (Group Policy Objects)
            LoggedOn - Collects session information using privileged methods (needs admin!)
            ObjectProps - Collects node property information for users and computers
            SPNTargets - Collects SPN targets (currently only MSSQL)
            Default - Collects Group Membership, Local Admin, Sessions, Containers, ACLs and Domain Trusts
            DcOnly - Collects Group Membership, ACLs, ObjectProps, Trusts, Containers, and GPO Admins
            All - Collect all data

        This can be a list of comma separated valued as well to run multiple collection methods!
        
    .PARAMETER Domain
    
        Specifies the domain to enumerate. If not specified, will enumerate the current
        domain your user context specifies.

    .PARAMETER SearchForest
            
        Search all trusted domains in the forest. 

    .PARAMETER Stealth

        Use stealth collection options, will sacrifice data quality in favor of much reduced
        network impact

    .PARAMETER LdapFilter
    
        Append this ldap filter to the search filter to further filter the results enumerated
            
    .PARAMETER DistinguishedName
    
        DistinguishedName to start LDAP searches at. Equivalent to the old -Ou option
            
    .PARAMETER ComputerFile
    
        A file containing a list of computers to enumerate. This option can only be used with the following Collection Methods:
        Session, Session, LocalGroup, ComputerOnly, LoggedOn
            
    .PARAMETER OutputDirectory
    
        Folder to output files too
    
    .PARAMETER OutputPrefix

        Prefix to add to output files
        
    .PARAMETER CacheName
    
        Name for the cache file dropped to disk (default: unique hash generated per machine)
            
    .PARAMETER MemCache
    
        Don't write the cache file to disk. Caching will still be performed in memory.
            
    .PARAMETER RebuildCache
    
        Invalidate and rebuild the cache file
            
    .PARAMETER RandomFileNames
    
        Randomize file names completely
            
    .PARAMETER ZipFilename
    
        Name for the zip file output by data collection
            
    .PARAMETER NoZip
    
        Do NOT zip the json files
            
    .PARAMETER ZipPassword
    
        Encrypt the zip file with the specified password
            
    .PARAMETER TrackComputerCalls
    
        Write a CSV file with the results of each computer API call to disk
            
    .PARAMETER PrettyPrint
    
        Output "pretty" json with formatting for readability

    
    .PARAMETER LdapUsername
    
        Username for connecting to LDAP. Use this if you're using a non-domain account for connecting to computers
    
    .PARAMETER LdapPassword

        Password for connecting to LDAP. Use this if you're using a non-domain account for connecting to computers
    

    .PARAMETER DomainController

        Domain Controller to connect too. Specifiying this can result in data loss

    .PARAMETER LdapPort

        Port LDAP is running on. Defaults to 389/686 for LDAPS

    .PARAMETER SecureLDAP

        Connect to LDAPS (LDAP SSL) instead of regular LDAP
        
    .PARAMETER DisableCertVerification
        
        Disable certificate verification for secure LDAP

    .PARAMETER DisableSigning

        Disables keberos signing/sealing, making LDAP traffic viewable

    .PARAMETER SkipPortCheck

        Skip SMB port checks when connecting to computers
        
    .PARAMETER PortScanTimeout
    
        Timeout for port checks
        
    .PARAMETER SkipPasswordCheck
    
        Skip checking of PwdLastSet time for computer scanning
        
    .PARAMETER ExcludeDCs
    
        Exclude domain controllers from enumeration (usefult o avoid Microsoft ATP/ATA)

    .PARAMETER Throttle

        Throttle requests to computers (in milliseconds)

    .PARAMETER Jitter

        Add jitter to throttle
        
    .PARAMETER Threads
    
        Number of threads to run enumeration with (Default: 50)
        
    .PARAMETER SkipRegistryLoggedOn
    
        Disable remote registry check in LoggedOn collection
        
    .PARAMETER OverrideUserName

        Override username to filter for NetSessionEnum

    .PARAMETER RealDNSName

        Overrides the DNS name used for API calls

    .PARAMETER CollectAllProperties

        Collect all string LDAP properties on objects
        
    .PARAMETER Loop
    
        Perform looping for computer collection
    
    .PARAMETER LoopDuration

        Duration to perform looping (Default 02:00:00)

    .PARAMETER LoopInterval

        Interval to sleep between loops (Default 00:05:00)

    .PARAMETER StatusInterval

        Interval for displaying status in milliseconds

    .PARAMETER Verbosity

        Change verbosity of output. Default 2 (lower is more)

    .PARAMETER Help

        Display this help screen

    .PARAMETER Version

        Display version information

    .EXAMPLE

        PS C:\> Invoke-BloodHound

        Executes the default collection options and exports JSONs to the current directory, compresses the data to a zip file,
        and then removes the JSON files from disk

    .EXAMPLE

        PS C:\> Invoke-BloodHound -Loop -LoopInterval 00:01:00 -LoopDuration 00:10:00

        Executes session collection in a loop. Will wait 1 minute after each run to continue collection
        and will continue running for 10 minutes after which the script will exit

    .EXAMPLE

        PS C:\> Invoke-BloodHound -CollectionMethods All

        Runs ACL, ObjectProps, Container, and Default collection methods, compresses the data to a zip file,
        and then removes the JSON files from disk

    .EXAMPLE

        PS C:\> Invoke-BloodHound -CollectionMethods DCOnly -NoSaveCache -RandomizeFilenames -EncryptZip

        (Opsec!) Run LDAP only collection methods (Groups, Trusts, ObjectProps, ACL, Containers, GPO Admins) without outputting the cache file to disk.
        Randomizes filenames of the JSON files and the zip file and adds a password to the zip file
    #>

    [CmdletBinding(PositionalBinding = $false)]
    param(
        [Alias("c")]
        [String[]]
        $CollectionMethods = [String[]]@('Default'),

        [Alias("d")]
        [String]
        $Domain,
        
        [Alias("s")]
        [Switch]
        $SearchForest,

        [Switch]
        $Stealth,

        [String]
        $LdapFilter,

        [String]
        $DistinguishedName,

        [String]
        $ComputerFile,

        [ValidateScript({ Test-Path -Path $_ })]
        [String]
        $OutputDirectory = $( Get-Location ),

        [ValidateNotNullOrEmpty()]
        [String]
        $OutputPrefix,

        [String]
        $CacheName,

        [Switch]
        $MemCache,

        [Switch]
        $RebuildCache,

        [Switch]
        $RandomFilenames,

        [String]
        $ZipFilename,
        
        [Switch]
        $NoZip,
        
        [String]
        $ZipPassword,
        
        [Switch]
        $TrackComputerCalls,
        
        [Switch]
        $PrettyPrint,

        [String]
        $LdapUsername,

        [String]
        $LdapPassword,

        [string]
        $DomainController,

        [ValidateRange(0, 65535)]
        [Int]
        $LdapPort,

        [Switch]
        $SecureLdap,
        
        [Switch]
        $DisableCertVerification,

        [Switch]
        $DisableSigning,

        [Switch]
        $SkipPortCheck,

        [ValidateRange(50, 5000)]
        [Int]
        $PortCheckTimeout = 500,

        [Switch]
        $SkipPasswordCheck,

        [Switch]
        $ExcludeDCs,

        [Int]
        $Throttle,

        [ValidateRange(0, 100)]
        [Int]
        $Jitter,

        [Int]
        $Threads,

        [Switch]
        $SkipRegistryLoggedOn,

        [String]
        $OverrideUsername,

        [String]
        $RealDNSName,

        [Switch]
        $CollectAllProperties,

        [Switch]
        $Loop,

        [String]
        $LoopDuration,

        [String]
        $LoopInterval,

        [ValidateRange(500, 60000)]
        [Int]
        $StatusInterval,
        
        [Alias("v")]
        [ValidateRange(0, 5)]
        [Int]
        $Verbosity,

        [Alias("h")]
        [Switch]
        $Help,

        [Switch]
        $Version
    )

    $vars = New-Object System.Collections.Generic.List[System.Object]
    
    if(!($PSBoundParameters.ContainsKey("help") -or $PSBoundParameters.ContainsKey("version"))){
        $PSBoundParameters.Keys | % {
            if ($_ -notmatch "verbosity"){
                $vars.add("--$_")
                if($PSBoundParameters.item($_).gettype().name -notmatch "switch"){
                    $vars.add($PSBoundParameters.item($_))
                }
            }
            elseif ($_ -match "verbosity") {
                $vars.add("-v")
                $vars.add($PSBoundParameters.item($_))
            }
        }
    }
    else {
        $PSBoundParameters.Keys |? {$_ -match "help" -or $_ -match "version"}| % {
            $vars.add("--$_")
        }
    }
    
    $passed = [string[]]$vars.ToArray()

    	$EncodedCompressedFile = 'zP0HdBNH9wcMr1ayqgtykVxwodgsko1pAWN66GDTuwHTu1mQ6LJMDx0ChITeew2hhg6hEwgdAtj0HloglADmm3tnVloZQ3j+33vO+3Kwduc3s3dm7swtU3Y2ueX3nJLjOBX5+/iR47Zx9F8l7r//DSV/vpHbfblNuhP5timSTuRr3LWbPaq3Texia5cW1aFdr15i36j2naJs/XpFdesVVbVeo6g0sWOnIj4++oKMRv1qHJekUHLXV/25X6J7ncuvMCiKctzdPBwXSjFflZHjoqQUleg9T8sN/9RSVFsj4vBPybUdxXF58L/76rrgv01KI9cMbqKM3BpTLpWsZOS8yaUgSZfwFTxx/SPl08qCWhKuKQsX6dtpYF9yDbydh9YF6sp/QqJtEZvd1oHcY9lIGblgcr2fxyNdJfK/iK1TT5Ek9GZlprSMOdN9m7OYz5Q0DZSN57y4mjf8uKv5FJyChF8Rtgbv4LiiMX5fXe1Q4YOCU1u4gKK8KzM+6iUh5yQtqeIFUi49rxRINdS8l5AAFzvpgHqhJNwKJcivSlRBIrsXwMUJYIngHQRSWfLzSifeEMBLArwYoJYANQM0EqBhgFYCtAzQSYCOAXoJ0DPAIAEGBnhLgDcDfCTAhwG+EuDLAD8J8GNAHgnIwwCjBBgZ4C8B/gwIkIAABgRKQCADgiQgiAEmCTAxwCwBZgYES0AwA0IkIIQBoRIQyoAwCQhjQF4JyMuAcAkIZ0CEBOBNdxvpC70F0kb6CYTrCoE0jn6oAqKgz5Qm/YUEjP6cQBpJ78xHIvw53pkfr0HOKLymU1ggKa0sJJAW09N+Vwj7MmfkBdIk6ui4PDFCJOmUtkKQMWk2vZ4XCpMYNcTrLaV4gXQhdVRoA45LtZBnA4oqubGMhlKvVImkIfVxPkpbMUJAJfgBBZXtG6CWB2NUtopSIDYvL5A6qMVDJMdYP4E0qD46Th1jq0FS6L1ijRlQVVstElJTSrxAyqWO9adXzxhZKQkjIyVG4k0ibxYqo8z4Q3xt3kHESBWnU8bwZifcWqZ+ltX2ALgD9Qn1DSuq4mopUJcaeQdwWM87gOEGdWwLtbnsNZJGI1hJXnFemXkUEIiDQCcKCqQH6kXS6/Q+/krBBBypyJui9dhWvM5ZAC60xZQo/9bMLOCuAyJ8+HS4ZAeRLqjgg9hT/qgg9JmLOSkzmlVkx5SWPQXSOfXdvCmSAZUQSe/UaztpRdIp9c1zKU853vyl8mQ1+IrCZIUEqPjIbEoFHzeqhLwQEeAJC+HYEzmucl6q/3zhj7AtL/kjZYc/RSmaVilEssYtKDVuQSY20RIQTQHUnBZoq8mEBumxRnt+6CVqHmqkV0MN9LFKZZzColQDOdLvTDFqdbaaENDbYwDwBup6rUC6h1UUyK3BWlIjFgZW0edJXS3APStwLcQDI5dYiCKtodeIRSDBgSy9JlatEeNJ4KqFU6AJq8pVGsnpOZQjL07k0DYbeVsy6YtiMSyWKibQmsc8kZRLEW2KLDgXlDzp7rYeUhIDbxsh3XtrYnmNRR3np43zthGx7K1EGbaoY33UKJFKlBaLVh6w8bxYglkVvUA6thVk3CrUBWvSRoqsB73XjYPcp0OPQ91RGspkT4DSKCd1M7fwtsYotbMQ9tHGKXWxYWpdqq6Ej4agYhloAV0LvZak05riL6hj1SB3VgulE6vRgPBZLWoaLmFSTor1V5oouTit0gzazmqhz1SIzLY3Ac3FO2MlvUgUDPgToBcrgF6sCC1C9GIlvCqdlfEa5PwWr+k0WtBR/QghoSrwpSUhXQ3agHdWh4vSWQPg/DzTfi15R20C+CmEOtDWSeTHlK2wdJbstlNAI54MRbBA2cJI2YjUQYMT3QGxenXkhyIqtbmEnsvS8EJzUhFX3zByfACwF3SOkjtIrgbXcwZNrK/GXJZ4bJxJn7kaNEQQzc7c3RkHV95hBfFyNalYF4pRBKIiP2BSa0PeAWGxHnQcLW0sXVweayJ5GGiY21NSGNCVfsBuSoTyWmdhzAvpmPVZcRJNRhE7/EJaHz4QczXpoYJNoYJqkHeoI/ijO3fSOvaSKoAUYg2MUjyTeMjPEmqvT4KDOcn2ebv4EZldIph3AJOR3SUMvIlS01s1JuwfRPQd0EGcwBZwkoRW0I2Rt6eJrvFBWo1RScTWJIocFBAPj+qdTaE5eUczuDiaA0dJC1q9/XmT0BJ4R8xRCqRrBQkCna3hYnK2gYZWx7a2BvPpECOkAoN5B1DTiW0hEcXbkZ8AL38voT3cqPxVQgfgX2W0C1Ai3qhydsT0naCrkj5lAMMQDiV0dMSH+HS4ZgcRDR6GyrgxphS6kEti+sePH7O8A9S8UY2Fy+JYzl3hWa2/VugGNxp/jdCd5mx25axx9nDnTFrQG3JejCapBz7Ep/fAnBMlM4A5a4SeyC3ILkBtVMeajep+oMuj45RG9WAhDSSml4xfWKDsoEAoP7JIFEGbZEUF6MBiNKZJm7rKYtQJvaEqYbnGaoQ+kl0pSe1KI/I3nvxl0X4DfhO47dj5JpG76Qo6tGD2BogoBRsQmcrkWbBDG/elot0PERTt/pgT9KPBCrRfpB/1w34U+b5FNaIxufI5/P7lyL4BoOu8MnloReAbPGMtyzsGAv8U4iCIJtrcORiyinzPUmR6y9MzKscydyLJgQg5gHvpHJp0k+CUOlV71lWxc1XBzoUktM4MuAR48elQOX+e9EQfaOV1SBMivfn0DM/u1Q9T0u5VC7pXBdK9SEvQQg2FQvnTqziMNs5QbBzIQRiOtyOgFdXCSGjF6v+HZ03CKOA8DZhpgOoVaNUn/3AVoC1B2YCtAgb5udqG6Asr74CWo/oiAhRYvxytbHICc4kK0UZ+sH+HLco7RkM08jl9DDZUdhBRVAqNMBbKrVMrncB+a0M/Be+ABIjH+fspcqT0VdN4mrwAT0NKYRxgUF81Y8F4KZEabRuMb/PI60GaITuIeFFhWsYKYSKWmrUmJ5AeaWUxk0Gk6L1G+B7YVsJfCk4hv/apyFGNfRpH1S70PeLzYxIlJnGH4HlLdRZSefmqhBmAJMpTx2CZiVzC6JqVOai4mupxWRUIb2oAbyzEpgxwtXCuNZFVxT6Xtjm0LxlhcP6Qh1IlzMe2EhcA5/Mr+yWj2gE/Sm0WFxIwUFgETaAhwcXIWGINlgCp4XaiktRDq4HXv5QA0RlwKy4jt0OrgwVqqPTjs03E+ivE5dA4KzhpHAVTDQEwBhJXEqwvaSIFKTHpcdZYXm0xQRarGVNrSM5qDea91pSAmgyoJQG1GFBbAmozoI4E1GFAkgQkMSBZApIZUFcC6jKgngTUY0B9CajPgAYS0IABDSWgIQMaSUAjBjSWgMYMaCIBTRjQVAKaMqCZBDRjQHMJaM6AFhLQggEtJaAlA1IkIIUBrSSgFQNaS0BrBrSRgDYMSJWAVAa0lYC2DGgnAe0Y0F4C2jOggwR0YEBHCejIgE4S0IkBnSWgMwO6SEAXBnSVgK4M6CYB3RjQXQK6M6CHBPRgQE8J6MmANAlIY0AvCejFAFECRAb0lgC8Ab9UTUZlHBeIYwA7DBBIv7eai/iwEBF6qzWMBfwhShrHxM4ViXnRq0yNvUwN9SZDQgsFDFxneZ8iEscL60mc1iz8TC5LAfDJiohR2maTMYt5ogIpaBcJG8AIBKgyh8OwtnaAl64aKQi3jA74wKHjyLiWiyB/MMlRlPyRkQdOtBGh4Ugf50h34kjLcYRJHKkTR2wuN5w5Cj+QP6JfuAQgaA5QJywBYuQ6h1wj85CbaXATRW7GwU0lckPMFXEiSHEC1NaBUeBgkBsxChQ2uekcTH7aRcHUIrlpHgX+BrmpFzWUw5vqoeSnchTfAEMJUTBnTG7iox7Z8SYm6g4lHR6lP403gVEfX+CNwUR+1PZfQK2qjF5GddvGukhjCaWXuaHG3NygUU/qVnFe9sePvEAsibpMEVIy+0ZwDDSq2pF5UmMDVHBt19iosb2FseQmZK1WVRsrkRobYiYBFsJUBRQsFYB5PJLkYUlayJNU8khSiSWZ4k4SnBobRKOD
	$DeflatedStream = New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($EncodedCompressedFile),[IO.Compression.CompressionMode]::Decompress)
	$UncompressedFileBytes = New-Object Byte[](1114624)
	$DeflatedStream.Read($UncompressedFileBytes, 0, 1114624) | Out-Null
	$Assembly = [Reflection.Assembly]::Load($UncompressedFileBytes)
	$BindingFlags = [Reflection.BindingFlags] "Public,Static"
	$a = @()
	$Assembly.GetType("Costura.AssemblyLoader", $false).GetMethod("Attach", $BindingFlags).Invoke($Null, @())
	$Assembly.GetType("Sharphound.Program").GetMethod("InvokeSharpHound").Invoke($Null, @(,$passed))
}