SharpHound

fileserver.py

@@ -236,13 +236,20 @@ class HttpFileServer(HTTPServer):
         self.listen_thread.start()
         return self.listen_thread
 
-    def get_base_url():
+    def get_base_url(self, ip_addr=None):
         addr, port = self.server_address
         if port != 80:
             port = f":{port}"
-        protocol = "https" if gettype(self.socket) == ssl.SSLSocket else "http"
+        if ip_addr is not None:
+            addr = ip_addr
+        protocol = "https" if type(self.socket) == ssl.SSLSocket else "http"
         return f"{protocol}://{addr}{port}"
 
+    def get_full_url(self, uri):
+        if not uri.startswith("/"):
+            uri = "/" + uri
+        return self.get_base_url() + uri
+
     def stop(self):
         self.is_running = False
         time.sleep(1)       
@@ -278,4 +285,4 @@ if __name__ == "__main__":
         print("Exfiltrate data using:")
         print(xss)
 
-    fileServer.start()
+    fileServer.serve_forever()

update.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 
+# Usage: download_zip <url> <destination file>
 download () {
   tmpfile=$(mktemp /tmp/wget.XXXXXX)
   wget --no-verbose "$1" -O "$tmpfile"
@@ -15,6 +16,17 @@ download () {
   fi
 }
 
+# Usage: download_zip <url> <destination directory> [files]
+download_zip () {
+  tmpfile=$(mktemp /tmp/wget.XXXXXX)
+  wget --no-verbose "$1" -O "$tmpfile"
+  status=$?
+  if [ $status -eq 0 ]; then
+    unzip -o "$tmpfile" -d $2 "${@:3}"
+  fi
+}
+
+# Usage: get_latest_version <url> <version prefix>
 get_latest_version () {
   repository=$1
   prefix=$2
@@ -69,3 +81,4 @@ download https://github.com/k4sth4/Juicy-Potato/raw/main/x86/jp32.exe win/JuicyP
 download https://github.com/k4sth4/Juicy-Potato/raw/main/x64/jp.exe win/JuicyPotato64.exe
 download https://github.com/uknowsec/SweetPotato/raw/master/SweetPotato-Webshell-new/bin/Release/SweetPotato.exe win/SweetPotato.exe
 download https://github.com/BeichenDream/GodPotato/releases/latest/download/GodPotato-NET4.exe win/GodPotato.exe
+download_zip https://github.com/BloodHoundAD/SharpHound/releases/download/v2.0.1/SharpHound-v2.0.1.zip win/ SharpHound.exe SharpHound.ps1

win/SharpHound.ps1

@@ -0,0 +1,418 @@
+function Invoke-BloodHound
+{
+    <#
+    .SYNOPSIS
+
+        Runs the BloodHound C# Ingestor using reflection. The assembly is stored in this file.
+
+    .DESCRIPTION
+
+        Using reflection and assembly.load, load the compiled BloodHound C# ingestor into memory
+        and run it without touching disk. Parameters are converted to the equivalent CLI arguments
+        for the SharpHound executable and passed in via reflection. The appropriate function
+        calls are made in order to ensure that assembly dependencies are loaded properly.
+
+    .PARAMETER CollectionMethods
+
+        Specifies the CollectionMethods being used. Possible value are:
+            Group - Collect group membership information
+            LocalGroup - Collect local group information for computers
+            LocalAdmin - Collect local admin users for computers
+            RDP - Collect remote desktop users for computers
+            DCOM - Collect distributed COM users for computers
+            PSRemote - Collected members of the Remote Management Users group for computers
+            Session - Collect session information for computers
+            Trusts - Enumerate domain trust data
+            ACL - Collect ACL (Access Control List) data
+            Container - Collect GPO/OU Data
+            ComputerOnly - Collects Local Group and Session data
+            GPOLocalGroup - Collects Local Group information using GPO (Group Policy Objects)
+            LoggedOn - Collects session information using privileged methods (needs admin!)
+            ObjectProps - Collects node property information for users and computers
+            SPNTargets - Collects SPN targets (currently only MSSQL)
+            Default - Collects Group Membership, Local Admin, Sessions, Containers, ACLs and Domain Trusts
+            DcOnly - Collects Group Membership, ACLs, ObjectProps, Trusts, Containers, and GPO Admins
+            All - Collect all data
+
+        This can be a list of comma separated valued as well to run multiple collection methods!
+        
+    .PARAMETER Domain
+    
+        Specifies the domain to enumerate. If not specified, will enumerate the current
+        domain your user context specifies.
+
+    .PARAMETER SearchForest
+            
+        Search all trusted domains in the forest. 
+
+    .PARAMETER Stealth
+
+        Use stealth collection options, will sacrifice data quality in favor of much reduced
+        network impact
+
+    .PARAMETER LdapFilter
+    
+        Append this ldap filter to the search filter to further filter the results enumerated
+            
+    .PARAMETER DistinguishedName
+    
+        DistinguishedName to start LDAP searches at. Equivalent to the old -Ou option
+            
+    .PARAMETER ComputerFile
+    
+        A file containing a list of computers to enumerate. This option can only be used with the following Collection Methods:
+        Session, Session, LocalGroup, ComputerOnly, LoggedOn
+            
+    .PARAMETER OutputDirectory
+    
+        Folder to output files too
+    
+    .PARAMETER OutputPrefix
+
+        Prefix to add to output files
+        
+    .PARAMETER CacheName
+    
+        Name for the cache file dropped to disk (default: unique hash generated per machine)
+            
+    .PARAMETER MemCache
+    
+        Don't write the cache file to disk. Caching will still be performed in memory.
+            
+    .PARAMETER RebuildCache
+    
+        Invalidate and rebuild the cache file
+            
+    .PARAMETER RandomFileNames
+    
+        Randomize file names completely
+            
+    .PARAMETER ZipFilename
+    
+        Name for the zip file output by data collection
+            
+    .PARAMETER NoZip
+    
+        Do NOT zip the json files
+            
+    .PARAMETER ZipPassword
+    
+        Encrypt the zip file with the specified password
+            
+    .PARAMETER TrackComputerCalls
+    
+        Write a CSV file with the results of each computer API call to disk
+            
+    .PARAMETER PrettyPrint
+    
+        Output "pretty" json with formatting for readability
+
+    
+    .PARAMETER LdapUsername
+    
+        Username for connecting to LDAP. Use this if you're using a non-domain account for connecting to computers
+    
+    .PARAMETER LdapPassword
+
+        Password for connecting to LDAP. Use this if you're using a non-domain account for connecting to computers
+    
+
+    .PARAMETER DomainController
+
+        Domain Controller to connect too. Specifiying this can result in data loss
+
+    .PARAMETER LdapPort
+
+        Port LDAP is running on. Defaults to 389/686 for LDAPS
+
+    .PARAMETER SecureLDAP
+
+        Connect to LDAPS (LDAP SSL) instead of regular LDAP
+        
+    .PARAMETER DisableCertVerification
+        
+        Disable certificate verification for secure LDAP
+
+    .PARAMETER DisableSigning
+
+        Disables keberos signing/sealing, making LDAP traffic viewable
+
+    .PARAMETER SkipPortCheck
+
+        Skip SMB port checks when connecting to computers
+        
+    .PARAMETER PortScanTimeout
+    
+        Timeout for port checks
+        
+    .PARAMETER SkipPasswordCheck
+    
+        Skip checking of PwdLastSet time for computer scanning
+        
+    .PARAMETER ExcludeDCs
+    
+        Exclude domain controllers from enumeration (usefult o avoid Microsoft ATP/ATA)
+
+    .PARAMETER Throttle
+
+        Throttle requests to computers (in milliseconds)
+
+    .PARAMETER Jitter
+
+        Add jitter to throttle
+        
+    .PARAMETER Threads
+    
+        Number of threads to run enumeration with (Default: 50)
+        
+    .PARAMETER SkipRegistryLoggedOn
+    
+        Disable remote registry check in LoggedOn collection
+        
+    .PARAMETER OverrideUserName
+
+        Override username to filter for NetSessionEnum
+
+    .PARAMETER RealDNSName
+
+        Overrides the DNS name used for API calls
+
+    .PARAMETER CollectAllProperties
+
+        Collect all string LDAP properties on objects
+        
+    .PARAMETER Loop
+    
+        Perform looping for computer collection
+    
+    .PARAMETER LoopDuration
+
+        Duration to perform looping (Default 02:00:00)
+
+    .PARAMETER LoopInterval
+
+        Interval to sleep between loops (Default 00:05:00)
+
+    .PARAMETER StatusInterval
+
+        Interval for displaying status in milliseconds
+
+    .PARAMETER Verbosity
+
+        Change verbosity of output. Default 2 (lower is more)
+
+    .PARAMETER Help
+
+        Display this help screen
+
+    .PARAMETER Version
+
+        Display version information
+
+    .EXAMPLE
+
+        PS C:\> Invoke-BloodHound
+
+        Executes the default collection options and exports JSONs to the current directory, compresses the data to a zip file,
+        and then removes the JSON files from disk
+
+    .EXAMPLE
+
+        PS C:\> Invoke-BloodHound -Loop -LoopInterval 00:01:00 -LoopDuration 00:10:00
+
+        Executes session collection in a loop. Will wait 1 minute after each run to continue collection
+        and will continue running for 10 minutes after which the script will exit
+
+    .EXAMPLE
+
+        PS C:\> Invoke-BloodHound -CollectionMethods All
+
+        Runs ACL, ObjectProps, Container, and Default collection methods, compresses the data to a zip file,
+        and then removes the JSON files from disk
+
+    .EXAMPLE
+
+        PS C:\> Invoke-BloodHound -CollectionMethods DCOnly -NoSaveCache -RandomizeFilenames -EncryptZip
+
+        (Opsec!) Run LDAP only collection methods (Groups, Trusts, ObjectProps, ACL, Containers, GPO Admins) without outputting the cache file to disk.
+        Randomizes filenames of the JSON files and the zip file and adds a password to the zip file
+    #>
+
+    [CmdletBinding(PositionalBinding = $false)]
+    param(
+        [Alias("c")]
+        [String[]]
+        $CollectionMethods = [String[]]@('Default'),
+
+        [Alias("d")]
+        [String]
+        $Domain,
+        
+        [Alias("s")]
+        [Switch]
+        $SearchForest,
+
+        [Switch]
+        $Stealth,
+
+        [String]
+        $LdapFilter,
+
+        [String]
+        $DistinguishedName,
+
+        [String]
+        $ComputerFile,
+
+        [ValidateScript({ Test-Path -Path $_ })]
+        [String]
+        $OutputDirectory = $( Get-Location ),
+
+        [ValidateNotNullOrEmpty()]
+        [String]
+        $OutputPrefix,
+
+        [String]
+        $CacheName,
+
+        [Switch]
+        $MemCache,
+
+        [Switch]
+        $RebuildCache,
+
+        [Switch]
+        $RandomFilenames,
+
+        [String]
+        $ZipFilename,
+        
+        [Switch]
+        $NoZip,
+        
+        [String]
+        $ZipPassword,
+        
+        [Switch]
+        $TrackComputerCalls,
+        
+        [Switch]
+        $PrettyPrint,
+
+        [String]
+        $LdapUsername,
+
+        [String]
+        $LdapPassword,
+
+        [string]
+        $DomainController,
+
+        [ValidateRange(0, 65535)]
+        [Int]
+        $LdapPort,
+
+        [Switch]
+        $SecureLdap,
+        
+        [Switch]
+        $DisableCertVerification,
+
+        [Switch]
+        $DisableSigning,
+
+        [Switch]
+        $SkipPortCheck,
+
+        [ValidateRange(50, 5000)]
+        [Int]
+        $PortCheckTimeout = 500,
+
+        [Switch]
+        $SkipPasswordCheck,
+
+        [Switch]
+        $ExcludeDCs,
+
+        [Int]
+        $Throttle,
+
+        [ValidateRange(0, 100)]
+        [Int]
+        $Jitter,
+
+        [Int]
+        $Threads,
+
+        [Switch]
+        $SkipRegistryLoggedOn,
+
+        [String]
+        $OverrideUsername,
+
+        [String]
+        $RealDNSName,
+
+        [Switch]
+        $CollectAllProperties,
+
+        [Switch]
+        $Loop,
+
+        [String]
+        $LoopDuration,
+
+        [String]
+        $LoopInterval,
+
+        [ValidateRange(500, 60000)]
+        [Int]
+        $StatusInterval,
+        
+        [Alias("v")]
+        [ValidateRange(0, 5)]
+        [Int]
+        $Verbosity,
+
+        [Alias("h")]
+        [Switch]
+        $Help,
+
+        [Switch]
+        $Version
+    )
+
+    $vars = New-Object System.Collections.Generic.List[System.Object]
+    
+    if(!($PSBoundParameters.ContainsKey("help") -or $PSBoundParameters.ContainsKey("version"))){
+        $PSBoundParameters.Keys | % {
+            if ($_ -notmatch "verbosity"){
+                $vars.add("--$_")
+                if($PSBoundParameters.item($_).gettype().name -notmatch "switch"){
+                    $vars.add($PSBoundParameters.item($_))
+                }
+            }
+            elseif ($_ -match "verbosity") {
+                $vars.add("-v")
+                $vars.add($PSBoundParameters.item($_))
+            }
+        }
+    }
+    else {
+        $PSBoundParameters.Keys |? {$_ -match "help" -or $_ -match "version"}| % {
+            $vars.add("--$_")
+        }
+    }
+    
+    $passed = [string[]]$vars.ToArray()
+
+    	$EncodedCompressedFile = 'zP0HdBNH9wcMr1ayqgtykVxwodgsko1pAWN66GDTuwHTu1mQ6LJMDx0ChITeew2hhg6hEwgdAtj0HloglADmm3tnVloZQ3j+33vO+3Kwduc3s3dm7swtU3Y2ueX3nJLjOBX5+/iR47Zx9F8l7r//DSV/vpHbfblNuhP5timSTuRr3LWbPaq3Texia5cW1aFdr15i36j2naJs/XpFdesVVbVeo6g0sWOnIj4++oKMRv1qHJekUHLXV/25X6J7ncuvMCiKctzdPBwXSjFflZHjoqQUleg9T8sN/9RSVFsj4vBPybUdxXF58L/76rrgv01KI9cMbqKM3BpTLpWsZOS8yaUgSZfwFTxx/SPl08qCWhKuKQsX6dtpYF9yDbydh9YF6sp/QqJtEZvd1oHcY9lIGblgcr2fxyNdJfK/iK1TT5Ek9GZlprSMOdN9m7OYz5Q0DZSN57y4mjf8uKv5FJyChF8Rtgbv4LiiMX5fXe1Q4YOCU1u4gKK8KzM+6iUh5yQtqeIFUi49rxRINdS8l5AAFzvpgHqhJNwKJcivSlRBIrsXwMUJYIngHQRSWfLzSifeEMBLArwYoJYANQM0EqBhgFYCtAzQSYCOAXoJ0DPAIAEGBnhLgDcDfCTAhwG+EuDLAD8J8GNAHgnIwwCjBBgZ4C8B/gwIkIAABgRKQCADgiQgiAEmCTAxwCwBZgYES0AwA0IkIIQBoRIQyoAwCQhjQF4JyMuAcAkIZ0CEBOBNdxvpC70F0kb6CYTrCoE0jn6oAqKgz5Qm/YUEjP6cQBpJ78xHIvw53pkfr0HOKLymU1ggKa0sJJAW09N+Vwj7MmfkBdIk6ui4PDFCJOmUtkKQMWk2vZ4XCpMYNcTrLaV4gXQhdVRoA45LtZBnA4oqubGMhlKvVImkIfVxPkpbMUJAJfgBBZXtG6CWB2NUtopSIDYvL5A6qMVDJMdYP4E0qD46Th1jq0FS6L1ijRlQVVstElJTSrxAyqWO9adXzxhZKQkjIyVG4k0ibxYqo8z4Q3xt3kHESBWnU8bwZifcWqZ+ltX2ALgD9Qn1DSuq4mopUJcaeQdwWM87gOEGdWwLtbnsNZJGI1hJXnFemXkUEIiDQCcKCqQH6kXS6/Q+/krBBBypyJui9dhWvM5ZAC60xZQo/9bMLOCuAyJ8+HS4ZAeRLqjgg9hT/qgg9JmLOSkzmlVkx5SWPQXSOfXdvCmSAZUQSe/UaztpRdIp9c1zKU853vyl8mQ1+IrCZIUEqPjIbEoFHzeqhLwQEeAJC+HYEzmucl6q/3zhj7AtL/kjZYc/RSmaVilEssYtKDVuQSY20RIQTQHUnBZoq8mEBumxRnt+6CVqHmqkV0MN9LFKZZzColQDOdLvTDFqdbaaENDbYwDwBup6rUC6h1UUyK3BWlIjFgZW0edJXS3APStwLcQDI5dYiCKtodeIRSDBgSy9JlatEeNJ4KqFU6AJq8pVGsnpOZQjL07k0DYbeVsy6YtiMSyWKibQmsc8kZRLEW2KLDgXlDzp7rYeUhIDbxsh3XtrYnmNRR3np43zthGx7K1EGbaoY33UKJFKlBaLVh6w8bxYglkVvUA6thVk3CrUBWvSRoqsB73XjYPcp0OPQ91RGspkT4DSKCd1M7fwtsYotbMQ9tHGKXWxYWpdqq6Ej4agYhloAV0LvZak05riL6hj1SB3VgulE6vRgPBZLWoaLmFSTor1V5oouTit0gzazmqhz1SIzLY3Ac3FO2MlvUgUDPgToBcrgF6sCC1C9GIlvCqdlfEa5PwWr+k0WtBR/QghoSrwpSUhXQ3agHdWh4vSWQPg/DzTfi15R20C+CmEOtDWSeTHlK2wdJbstlNAI54MRbBA2cJI2YjUQYMT3QGxenXkhyIqtbmEnsvS8EJzUhFX3zByfACwF3SOkjtIrgbXcwZNrK/GXJZ4bJxJn7kaNEQQzc7c3RkHV95hBfFyNalYF4pRBKIiP2BSa0PeAWGxHnQcLW0sXVweayJ5GGiY21NSGNCVfsBuSoTyWmdhzAvpmPVZcRJNRhE7/EJaHz4QczXpoYJNoYJqkHeoI/ijO3fSOvaSKoAUYg2MUjyTeMjPEmqvT4KDOcn2ebv4EZldIph3AJOR3SUMvIlS01s1JuwfRPQd0EGcwBZwkoRW0I2Rt6eJrvFBWo1RScTWJIocFBAPj+qdTaE5eUczuDiaA0dJC1q9/XmT0BJ4R8xRCqRrBQkCna3hYnK2gYZWx7a2BvPpECOkAoN5B1DTiW0hEcXbkZ8AL38voT3cqPxVQgfgX2W0C1Ai3qhydsT0naCrkj5lAMMQDiV0dMSH+HS4ZgcRDR6GyrgxphS6kEti+sePH7O8A9S8UY2Fy+JYzl3hWa2/VugGNxp/jdCd5mx25axx9nDnTFrQG3JejCapBz7Ep/fAnBMlM4A5a4SeyC3ILkBtVMeajep+oMuj45RG9WAhDSSml4xfWKDsoEAoP7JIFEGbZEUF6MBiNKZJm7rKYtQJvaEqYbnGaoQ+kl0pSe1KI/I3nvxl0X4DfhO47dj5JpG76Qo6tGD2BogoBRsQmcrkWbBDG/elot0PERTt/pgT9KPBCrRfpB/1w34U+b5FNaIxufI5/P7lyL4BoOu8MnloReAbPGMtyzsGAv8U4iCIJtrcORiyinzPUmR6y9MzKscydyLJgQg5gHvpHJp0k+CUOlV71lWxc1XBzoUktM4MuAR48elQOX+e9EQfaOV1SBMivfn0DM/u1Q9T0u5VC7pXBdK9SEvQQg2FQvnTqziMNs5QbBzIQRiOtyOgFdXCSGjF6v+HZ03CKOA8DZhpgOoVaNUn/3AVoC1B2YCtAgb5udqG6Asr74CWo/oiAhRYvxytbHICc4kK0UZ+sH+HLco7RkM08jl9DDZUdhBRVAqNMBbKrVMrncB+a0M/Be+ABIjH+fspcqT0VdN4mrwAT0NKYRxgUF81Y8F4KZEabRuMb/PI60GaITuIeFFhWsYKYSKWmrUmJ5AeaWUxk0Gk6L1G+B7YVsJfCk4hv/apyFGNfRpH1S70PeLzYxIlJnGH4HlLdRZSefmqhBmAJMpTx2CZiVzC6JqVOai4mupxWRUIb2oAbyzEpgxwtXCuNZFVxT6Xtjm0LxlhcP6Qh1IlzMe2EhcA5/Mr+yWj2gE/Sm0WFxIwUFgETaAhwcXIWGINlgCp4XaiktRDq4HXv5QA0RlwKy4jt0OrgwVqqPTjs03E+ivE5dA4KzhpHAVTDQEwBhJXEqwvaSIFKTHpcdZYXm0xQRarGVNrSM5qDea91pSAmgyoJQG1GFBbAmozoI4E1GFAkgQkMSBZApIZUFcC6jKgngTUY0B9CajPgAYS0IABDSWgIQMaSUAjBjSWgMYMaCIBTRjQVAKaMqCZBDRjQHMJaM6AFhLQggEtJaAlA1IkIIUBrSSgFQNaS0BrBrSRgDYMSJWAVAa0lYC2DGgnAe0Y0F4C2jOggwR0YEBHCejIgE4S0IkBnSWgMwO6SEAXBnSVgK4M6CYB3RjQXQK6M6CHBPRgQE8J6MmANAlIY0AvCejFAFECRAb0lgC8Ab9UTUZlHBeIYwA7DBBIv7eai/iwEBF6qzWMBfwhShrHxM4ViXnRq0yNvUwN9SZDQgsFDFxneZ8iEscL60mc1iz8TC5LAfDJiohR2maTMYt5ogIpaBcJG8AIBKgyh8OwtnaAl64aKQi3jA74wKHjyLiWiyB/MMlRlPyRkQdOtBGh4Ugf50h34kjLcYRJHKkTR2wuN5w5Cj+QP6JfuAQgaA5QJywBYuQ6h1wj85CbaXATRW7GwU0lckPMFXEiSHEC1NaBUeBgkBsxChQ2uekcTH7aRcHUIrlpHgX+BrmpFzWUw5vqoeSnchTfAEMJUTBnTG7iox7Z8SYm6g4lHR6lP403gVEfX+CNwUR+1PZfQK2qjF5GddvGukhjCaWXuaHG3NygUU/qVnFe9sePvEAsibpMEVIy+0ZwDDSq2pF5UmMDVHBt19iosb2FseQmZK1WVRsrkRobYiYBFsJUBRQsFYB5PJLkYUlayJNU8khSiSWZ4k4SnBobRKODMeq0FGXUxvoTNLQtoEG8hGrEzVDGYp3tW6AeOqPOVg0it4LVIbHbANVbA/z1wq9wazDqjAYaS6DtYBpuZ/n667NN+UhHpqNypW0D7+5hRh3q+EXCDjBntt9kUaraE9QwR0RUq5rGmy1GlUWBcxg1uZB2XAQk5Lkf+agtPExpcImuUWEfEJ42vNJPmW3KD3lDLsR6noDxSCkl74AE2SoYSuoDIaFwHOa8fIiNFU6CIO0FOxJAZK8B7eJGnLXS2wKUXO9QVkI1TmItijb7cdmmFJe92gcVig5WLooOUcVpcJ7NarB9o4SpOg1Wdj81qSjbcwgtE9q0hTAlWJEkEwJgBuAASZRBOqUqOs4ck2GD8qqvk6LZD4LRHAoxwiHgGj4oHAaDjWVklPoQSsGspMRKHsFSmcndURfDVeIxsNFalXgcrnnY1UrxuAKM0lGPMinFIQQ0i7+RX6WFhsS95CeOh+BkcpfxOxTmBNAqzGi0V3nQKMC89ErAbb34PdASp3g+GiilqlBJ+ANSTcVUmN8ByK+BEmczkcMmcQuBDBrhFEG8s/TaWLWWdjiNQORYn1UwhpXkgqskG3LUJotjSSK8PAqLfY7nkhV8PYWeFqm6IqydoiD4vuAXjWO1YY/X9XxcXIzlHgXlPgN8zcfSjXGlO5uTr3hvEnfJ7vfAfaA4CS7Y0OIPGIuknuQoMfhrahyPwT8VTRSjlidSKaPjwmOEc0DpPEiXZDZaUbNhniX+qIC1D3y2jeezFuy770Fru/vuD2rPeiO4Pwe4iYBS3H21W9yJjEMCtXABWBTCUvhq5E8HGqxpEpO/9YhRCxdBXMB/hNlWq4GlsmncOWjilMQ71Qh/uvp/VqQ3S7dJ42H1zmJmUn/QCJfd9fHX5ugbOBZK45K3c5G0Line truncated
+	$DeflatedStream = New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($EncodedCompressedFile),[IO.Compression.CompressionMode]::Decompress)
+	$UncompressedFileBytes = New-Object Byte[](1114624)
+	$DeflatedStream.Read($UncompressedFileBytes, 0, 1114624) | Out-Null
+	$Assembly = [Reflection.Assembly]::Load($UncompressedFileBytes)
+	$BindingFlags = [Reflection.BindingFlags] "Public,Static"
+	$a = @()
+	$Assembly.GetType("Costura.AssemblyLoader", $false).GetMethod("Attach", $BindingFlags).Invoke($Null, @())
+	$Assembly.GetType("Sharphound.Program").GetMethod("InvokeSharpHound").Invoke($Null, @(,$passed))
+}