SharpHound gets stuck / doesn't complete

[hubert3]

Running SharpHound v1.0.3 on a large domain it sometimes (not always) gets stuck on the same number of objects indefinitely and does not complete. Did not happen previously on the same domain

[craig1122321]

I have same issue
Do you have any update?

[hubert3]

Happened again on the same domain around the same number of objects

It reached 146047 objects at 21:46:46 and was still stuck on the same number as of 01:26:23, more than 3 hours later when I killed sharphound

This only started happening with the post-BH 4.1.0 Sharphound version - Old sharphound successfully completed and produced a zip for the same domain many times.

[hubert3]

Earlier in the same run (before it gets stuck) there are some errors like this - unsure if relevant

[rvazarkar]

That error isn't an issue. Can you narrow it down to a single collection method?

[dse002]

Same issue here. Seems to be caused by the LoggedOn method. Same issue with SharpHound 1.0.4.

[rvazarkar]

Neat, can you run with -v 0 -t 1 with the same options? Its going to take a while, but knowing where its getting locked up will be super helpful. It looks like its getting caught up somewhere in session enumeration, but I cant tell where from looking at it

[dse002]

Neat, can you run with -v 0 -t 1 with the same options? Its going to take a while, but knowing where its getting locked up will be super helpful. It looks like its getting caught up somewhere in session enumeration, but I cant tell where from looking at it

-t 1 isn't working (unknown option). I'll run it with just -v 0.

[dse002]

Neat, can you run with -v 0 -t 1 with the same options? Its going to take a while, but knowing where its getting locked up will be super helpful. It looks like its getting caught up somewhere in session enumeration, but I cant tell where from looking at it

[rvazarkar]

Wowzers. 7518 seconds to finish registry enum. Looks like I need to add a timeout to that

[SeiV-K]

It happened to me also. Do we have any root cause of this ? Which collection options to avoid for not having this ?

[hubert3]

Happening again with SharpHound v2.6.6 with -c Default around the same number of objects (~380k) on a large domain on multiple attempts.

I was using a different set of collection methods until recently but wanted to try -c Default or -c All since some new methods were added.

Is it feasible to add timeouts to all collection methods?

Trying a run with the previous reduced list of methods, will see if that narrows it down