NTLM Fixes and add Registry Collection

README.md

@@ -32,7 +32,8 @@ dotnet build
 The listing below details the CLI arguments SharpHound supports. Additional details about these options can be found in the [BloodHound CE Collection documentation](https://support.bloodhoundenterprise.io/hc/en-us/articles/17481375424795-All-SharpHound-Community-Edition-Flags-Explained).
 ```
   -c, --collectionmethods    (Default: Default) Collection Methods: Container, Group, LocalGroup, GPOLocalGroup,
-                             Session, LoggedOn, ObjectProps, ACL, ComputerOnly, Trusts, Default, RDP, DCOM, DCOnly, UserRights, CARegistry, DCRegistry, CertServices
+                             Session, LoggedOn, ObjectProps, ACL, ComputerOnly, Trusts, Default, RDP, DCOM, DCOnly, UserRights, 
+                             CARegistry, DCRegistry, CertServices, WebClientService, NTLMRegistry,SMBInfo,LdapServices
 
   -d, --domain               Specify domain to enumerate
 

Sharphound.csproj

@@ -25,8 +25,8 @@
         <PackageReference Include="Microsoft.Bcl.AsyncInterfaces" Version="8.0.0" />
         <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.0" />
         <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
-        <PackageReference Include="SharpHoundCommon" Version="4.2.0" />
-        <PackageReference Include="SharpHoundRPC" Version="4.2.0" />
+        <PackageReference Include="SharpHoundCommon" Version="4.2.1" />
+        <PackageReference Include="SharpHoundRPC" Version="4.2.1" />
         <PackageReference Include="SharpZipLib" Version="1.3.3" />
         <PackageReference Include="System.Runtime.CompilerServices.Unsafe" Version="6.0.0" />
         <PackageReference Include="System.Threading.Channels" Version="8.0.0" />

src/Client/Enums.cs

@@ -30,6 +30,7 @@ public enum CollectionMethodOptions
         WebClientService,
         LdapServices,
         SmbInfo,
+        NTLMRegistry,
         // Re-introduce this when we're ready for Event Log collection
         // EventLogs,
         All

src/Options.cs

@@ -14,7 +14,7 @@ public class Options
         // Options that affect what is collected
         [Option('c', "collectionmethods", Default = new[] { "Default" },
             HelpText =
-                "Collection Methods: Group, LocalGroup, LocalAdmin, RDP, DCOM, PSRemote, Session, Trusts, ACL, Container, ComputerOnly, GPOLocalGroup, LoggedOn, ObjectProps, SPNTargets, UserRights, Default, DCOnly, CARegistry, DCRegistry, CertServices, WebClientService, LdapServices, SmbInfo, All")]
+                "Collection Methods: Group, LocalGroup, LocalAdmin, RDP, DCOM, PSRemote, Session, Trusts, ACL, Container, ComputerOnly, GPOLocalGroup, LoggedOn, ObjectProps, SPNTargets, UserRights, Default, DCOnly, CARegistry, DCRegistry, CertServices, WebClientService, LdapServices, SmbInfo, NTLMRegistry, All")]
         public IEnumerable<string> CollectionMethods { get; set; }
 
         [Option('d', "domain", Default = null, HelpText = "Specify domain to enumerate")]
@@ -207,6 +207,7 @@ internal bool ResolveCollectionMethods(ILogger logger, out CollectionMethod reso
                     CollectionMethodOptions.WebClientService => CollectionMethod.WebClientService,
                     CollectionMethodOptions.LdapServices => CollectionMethod.LdapServices,
                     CollectionMethodOptions.SmbInfo => CollectionMethod.SmbInfo,
+                    CollectionMethodOptions.NTLMRegistry => CollectionMethod.NTLMRegistry,
                     // Re-introduce this when we're ready for Event Log collection
                     // CollectionMethodOptions.EventLogs => CollectionMethod.EventLogs,
                     CollectionMethodOptions.All => CollectionMethod.All,
@@ -266,6 +267,12 @@ internal bool ResolveCollectionMethods(ILogger logger, out CollectionMethod reso
                     resolved ^= CollectionMethod.DCRegistry;
                     updates.Add("[-] Removed DCRegistry Collection");
                 }
+
+                if ((resolved & CollectionMethod.NTLMRegistry) != 0)
+                {
+                    resolved ^= CollectionMethod.NTLMRegistry;
+                    updates.Add("[-] Removed NTLMRegistry Collection");
+                }
 
                 if (localGroupRemoved)
                 {

src/Runtime/ObjectProcessors.cs

@@ -1,4 +1,5 @@
 using System;
+using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Collections.ObjectModel;
 using System.Linq;
@@ -15,6 +16,7 @@
 using SharpHoundCommonLib.Enums;
 using SharpHoundCommonLib.OutputTypes;
 using SharpHoundCommonLib.Processors;
+using SharpHoundRPC.PortScanner;
 using Container = SharpHoundCommonLib.OutputTypes.Container;
 using Group = SharpHoundCommonLib.OutputTypes.Group;
 using Label = SharpHoundCommonLib.Enums.Label;
@@ -41,7 +43,7 @@ public class ObjectProcessors {
         private readonly SPNProcessors _spnProcessor;
         private readonly WebClientServiceProcessor _webClientProcessor;
         private readonly SmbProcessor _smbProcessor;
-
+        private readonly ConcurrentDictionary<string, RegistryProcessor> _registryProcessorMap = new();
         public ObjectProcessors(IContext context, ILogger log) {
             _context = context;
             _aclProcessor = new ACLProcessor(context.LDAPUtils);
@@ -306,6 +308,17 @@ await compStatusChannel.Writer.WriteAsync(new CSVComputerStatus {
                 ret.UserRights = await userRights.ToArrayAsync();
             }
 
+            if (_methods.HasFlag(CollectionMethod.NTLMRegistry)) {
+                await _context.DoDelay();
+                if (_registryProcessorMap.TryGetValue(resolvedSearchResult.DomainSid, out var processor)) {
+                    ret.RegistryData = await processor.ReadRegistrySettings(resolvedSearchResult.DisplayName);
+                } else {
+                    var newProcessor = new RegistryProcessor(null, resolvedSearchResult.Domain);
+                    _registryProcessorMap.TryAdd(resolvedSearchResult.DomainSid, newProcessor);
+                    ret.RegistryData = await newProcessor.ReadRegistrySettings(resolvedSearchResult.DisplayName);
+                }
+            }
+
             if (_methods.HasFlag(CollectionMethod.WebClientService)) {
                 ret.IsWebClientRunning = await _webClientProcessor.IsWebClientRunning(apiName);
             }
@@ -353,6 +366,7 @@ private async void ProcessDomainController(ResolvedSearchResult resolvedSearchRe
             _log.LogDebug("Processing DC: {dc}", apiName);
 
             if (_methods.HasFlag(CollectionMethod.DCRegistry)) {
+                await _context.DoDelay();
                 DCRegistryData dCRegistryData = new() {
                     CertificateMappingMethods = _dcRegistryProcessor.GetCertificateMappingMethods(apiName),
                     StrongCertificateBindingEnforcement =
@@ -364,7 +378,16 @@ private async void ProcessDomainController(ResolvedSearchResult resolvedSearchRe
 
             if (_methods.HasFlag(CollectionMethod.LdapServices)) {
                 var dcLdapProcessor = new DCLdapProcessor(_context.PortScanTimeout, apiName, _log);
-                ret.LdapServices = await dcLdapProcessor.Scan();
+                var ldapServices = await dcLdapProcessor.Scan();
+                ret.Properties.Add("ldapenabled", ldapServices.HasLdap);
+                ret.Properties.Add("ldapsenabled", ldapServices.HasLdaps);
+                if (ldapServices.IsChannelBindingDisabled.Collected) {
+                    ret.Properties.Add("ldapsepa", ldapServices.IsChannelBindingDisabled);    
+                }
+
+                if (ldapServices.IsSigningRequired.Collected) {
+                    ret.Properties.Add("ldapsigning", ldapServices.IsSigningRequired);    
+                }
             }
         }