Skip to content

Performance degradation when SharpHound attempts to resolve unresolvable SIDs #203

Open
Open
Performance degradation when SharpHound attempts to resolve unresolvable SIDs#203
Labels
ticketed

Description

@NexKosh
NexKosh
opened on May 4, 2025

When running SharpHound from a non-domain-joined Windows machine using supplied credentials, if target objects in the domain contain unresolvable SIDs (e.g., due to stale entries from broken two-way trusts), the tool repeatedly attempts to resolve them.

  • Environment
  1. SharpHound Version: 2.6.5
  2. SharpHoundCommon Version: 4.2.6
  3. Command : SharpHound -c DCOnly --ldapusername domainuser@ludus.domain --ldappassword ******** -d ludus.domain -v 1 --skipportcheck --disablecertverification --disablesigning --domaincontroller ludus.domain
  • Conditions
  1. The machine executing SharpHound is not joined to the domain
  2. Some AD objects contain SIDs from a previously trusted domain (e.g., due to removed two-way trust)
  3. unresolvable SID (from a previously trusted domain) was present on many AD objects.
  4. Total object count is large (e.g., 500,000+ objects)
  • Screenshot

  1. non-domain-joined Image

  2. domain-joined Image

  • Observed Behavior
  1. SharpHound attempts to resolve unknown or external SIDs via DirectoryContext using GetDomain(...)
  2. Each failed resolution logs:
    System.DirectoryServices.ActiveDirectory.ActiveDirectoryOperationException: Current security context is not associated with an Active Directory domain or forest.
  • Comparison Results
Scenario Cache Execution Time
Domain-joined host ❌ / ✅ 13 mins
Non-domain host, same creds ✅ 30 mins
Non-domain host, same creds ❌ 90 mins

Is it possible to add unresolvable SID cache to avoid repeated requests or disable try get unresolvable SID?

Activity

  1. slokie-so
    added
    ticketed
    on Jun 13, 2025

  2. ktstrader commented on Jun 27, 2025

    @ktstrader
    ktstrader
    on Jun 27, 2025
    Contributor

    Hi @NexKosh! Would you be able to provide steps to reproduce this issue for testing purposes?

  3. NexKosh commented on Jun 28, 2025

    @NexKosh
    NexKosh
    on Jun 28, 2025
    Author

    Hi @ktstrader 👋

    To accurately simulate SharpHound performance degradation caused by unresolved or stale ACL SIDs (typically from removed trusts or deleted users), I suggest the following setup:

    ✅ Recommended Procedure

    1. Establish a Two-Way Trust Between Domains

      • Set up a two-ways trust between two domains (e.g., corp.local and lab.local).

    2. Inject Cross-Domain ACL Entries

      • While the trust is still active, inject a large number of ACLs (~10,000 entries) into objects in lab.local.
      • Each ACL should grant rights (e.g., GenericAll) to SIDs from corp.local.
      • Use tools like BadBlood to populate the domain with users, groups, and computers. Then assign ACLs referencing foreign domain users either manually or through scripting.

    3. Break the Trust Relationship

      • Remove the trust between corp.local and lab.local.
      • The injected ACLs will remain in lab.local, but their associated SIDs from corp.local will no longer resolve via LDAP, simulating real-world stale SID conditions.

    4. Run SharpHound from an External Machine

      • From a machine not joined to lab.local, execute SharpHound against the lab.local domain using the DCOnly collection method.
      SharpHound.exe --CollectionMethod DCOnly --Domain lab.local --UserName sharphound --Password P@ssw0rd
  4. definitelynotagoblin
    added a commit that references this issue on Jul 18, 2025

    fix: Early exit for domains we know are unresolvalbe per #203

    d67c336
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    ticketed

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions