SharpHound.ps1 does not produce output

[Pri3st]

Description:

Many times the PowerShell script will not produce the designated output file. The .exe ingestor works perfectly every time. Sometimes, the problem is resolved when I use the -OutputDirectory option.

[rvazarkar]

I'm not really sure how we would go about debugging this, especially since the .ps1 script is just wrapping the .exe, so functionally there shouldn't be any real difference other than how its delivered into memory. Can you isolate a reproduction of this in a specific scenario?

[leechristensen]

It could potentially be due to PowerShell tracking the current directory differently than what the .NET libs see:

[StephenHinck]

Closing this issue as we've not heard any updates. We can always re-open with more info!

[robertstrom]

Not sure if this is going to be seen since this issue is closed but giving it a try anyway. I have run into the same issue as described above.

In my case I opened a PowerShell shell from another shell using the runas /user:<domain>\<user> powershell.exe command. When the PowerShell shell opened it opened in C:\Windows\System32. I navigated to the directory where the Sharphound.ps1 file was located and ran the commands to collect from the domain (twice because I did not see any results).

Then I ran a search for *bloodhound.zip and found that the collection files are in the C:\Windows\System32 directory. I believe that @leechristensen hit the nail on the head here.

Sharphound.ps1 / Invoke-Bloodhound run from the C:\users\rstrom\Downloads\SharpHound-v2.3.3 directory

Resulting files are located in the C:\Windows\System32 directory

The cache file ended up in System32 also