Skip to content

v2.5.20

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Sep 08:21
· 89 commits to main since this release
v2.5.20
5a10b1e

RustHound-CE v2.5.20

Computer:LocalGroups is now collected live over MS-SAMR (#69): each host's BUILTIN aliases feed the AdminTo, CanRDP, ExecuteDCOM and CanPSRemote edges.

Added

  • SAMR collection (SamrOpenAlias / SamrGetMembersInAlias) over the existing SMB transport, so it works over password, pass-the-hash and Kerberos. Prototyped in LocalGroups-rs.
  • New collection method -c LocalGroup (also runs under All); member ObjectType resolved from the LDAP sid_type map.
  • SeRemoteInteractiveLogonRight synthesized on every host, as SharpHound does, so CanRDP resolves on domain controllers.

Fixed

  • Well-known SIDs in GPO-resolved principals are emitted as <DOMAIN>-<SID>, matching SharpHound, so their edges attach to the graph instead of dangling.

Changed

  • Bumped dcerpc to 0.2.11 and added windows-sddl.
  • ROADMAP.md: Computer 62.2% => 68.9%, overall coverage 84.3% => 85.7% (503 / 587).
Assets 16
Loading