Crate rusthound_ce 

---

RustHound-CE is a cross-platform and cross-compiled BloodHound collector tool written in Rust, making it compatible with Linux, Windows, and macOS. It therefore generates all the JSON files that can be analyzed by BloodHound Community Edition. This version is only compatible with BloodHound Community Edition. The version compatible with BloodHound Legacy can be found on NeverHack’s github.

You can either run the binary:

---------------------------------------------------
Initializing RustHound-CE at 13:37:00 UTC on 01/12/23
Powered by @g0h4n_0
---------------------------------------------------
 
Active Directory data collector for BloodHound Community Edition.
g0h4n <https://twitter.com/g0h4n_0>
 
Usage: rusthound-ce [OPTIONS] --domain <domain>
 
Options:
  -v...          Set the level of verbosity
  -h, --help     Print help
  -V, --version  Print version
 
REQUIRED VALUES:
  -d, --domain <domain>  Domain name like: DOMAIN.LOCAL
 
OPTIONAL VALUES:
  -u, --ldapusername <ldapusername>  LDAP username, like: user@domain.local
  -p, --ldappassword <ldappassword>  LDAP password
  -H, --hashes <hashes>              NT hash for pass-the-hash authentication (NTLM), accept [NTHASH, :NTHASH, LMHASH:NTHASH]
  -f, --ldapfqdn <ldapfqdn>          Domain Controller FQDN like: DC01.DOMAIN.LOCAL or just DC01
  -i, --ldapip <ldapip>              Domain Controller IP address like: 192.168.1.10
  -P, --ldapport <ldapport>          LDAP port [default: 389, or 636 with --ldaps]
  -n, --name-server <name-server>    Alternative IP address name server to use for DNS queries
  -o, --output <output>              Output directory where you would like to save JSON files [default: ./]
 
CERTIFICATE AUTHENTICATION:
      --pfx <pfx>            PFX/PKCS#12 client certificate for certificate authentication (Pass-the-Certificate). Uses StartTLS by default, or LDAPS with --ldaps
      --pfx-pass <pfx-pass>  Password protecting the PFX file (optional)
      --crt <crt>            PEM client certificate for certificate authentication (use with --key)
      --key <key>            PEM private key for certificate authentication (use with --crt)
 
OPTIONAL FLAGS:
  -c, --collectionmethod [<COLLECTIONMETHOD>]
          Which information to collect. Supported: All (LDAP, SMB, HTTP), DCOnly (LDAP + SYSVOL, no member-machine connections), Session (user sessions over RPC), RegistryOnly (sessions over WINREG), LdapOnly (LDAP only, no machine or SYSVOL) (default: All) [possible values: All, DCOnly, Session, RegistryOnly, LdapOnly]
      --ldap-filter <ldap-filter>
          Use custom ldap-filter default is : (objectClass=*)
      --ldaps
          Force LDAPS using for request like: ldaps://DOMAIN.LOCAL/
  -k, --kerberos
          Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters for Linux.
      --dns-tcp
          Use TCP instead of UDP for DNS queries
  -z, --zip
          Compress the JSON files into a zip archive
      --cache
          Cache LDAP search results to disk (reduce memory usage on large domains)
      --cache-buffer <cache_buffer>
          Buffer size to use when caching [default: 1000]
      --resume
          Resume the collection from the last saved state
 
OPTIONAL MODULES:
      --fqdn-resolver  Use fqdn-resolver module to get computers IP address

Or build your own using the ldap_search() function:

let result = ldap_search(
    &ldaps,
    &Some(ip),
    &Some(port),
    &domain,
    &ldapfqdn,
    &username,
    &password,
    kerberos,
);

Re-exports

pub use json::maker::make_result;

pub use api::prepare_results_from_source;

pub use api::prepare_results_from_disk;

Modules

api

args

Parsing arguments

banner

Launch and end banners

enums

Utils to extract data from ldap network packets

json

Utils to parse json output from ldap library

modules

List of RustHound add-on modules

objects

All structure needed by RustHound-CE.

transport

Network transports used by RustHound-CE to talk to Active Directory.

utils

All utils functions like timestamp, crypto etc

Structs

SearchEntry

Parsed search result entry.

Traits

EntrySource

Used to iterate over LDAP search entries.

Storage

Functions

ldap_auth

Connect to the Domain Controller and authenticate, returning a ready ldap3::Ldap session. The method is chosen from options:

Type Aliases

DiskStorage

DiskStorageReader