8000 Performance degradation when SharpHound attempts to resolve unresolvable SIDs · Issue #203 · SpecterOps/SharpHoundCommon · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Performance degradation when SharpHound attempts to resolve unresolvable SIDs #203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
NexKosh opened this issue May 4, 2025 · 0 comments
Open

Performance degradation when SharpHound attempts to resolve unresolvable SIDs #203

NexKosh opened this issue May 4, 2025 · 0 comments

Comments

@NexKosh
Copy link
NexKosh commented May 4, 2025 •
edited
Loading

When running SharpHound from a non-domain-joined Windows machine using supplied credentials, if target objects in the domain contain unresolvable SIDs (e.g., due to stale entries from broken two-way trusts), the tool repeatedly attempts to resolve them.

  • Environment
  1. SharpHound Version: 2.6.5
  2. SharpHoundCommon Version: 4.2.6
  3. Command : SharpHound -c DCOnly --ldapusername domainuser@ludus.domain --ldappassword ******** -d ludus.domain -v 1 --skipportcheck --disablecertverification --disablesigning --domaincontroller ludus.domain
  • Conditions
  1. The machine executing SharpHound is not joined to the domain
  2. Some AD objects contain SIDs from a previously trusted domain (e.g., due to removed two-way trust)
  3. unresolvable SID (from a previously trusted domain) was present on many AD objects.
  4. Total object count is large (e.g., 500,000+ objects)
  • Screenshot

  1. non-domain-joined Image

  2. domain-joined Image

  • Observed Behavior
  1. SharpHound attempts to resolve unknown or external SIDs via DirectoryContext using GetDomain(...)
  2. Each failed resolution logs:
    System.DirectoryServices.ActiveDirectory.ActiveDirectoryOperationException: Current security context is not associated with an Active Directory domain or forest.
  • Comparison Results
Scenario Cache Execution Time
Domain-joined host ❌ / ✅ 13 mins
Non-domain host, same creds ✅ 30 mins
Non-domain host, same creds ❌ 90 mins

Is it possible to add unresolvable SID cache to avoid repeated requests or disable try get unresolvable SID?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@NexKosh
0