Pearson's OSCP Notebook

RustHound

Properties1
tagsrusthound, rusthound-ce, bloodhound, active-directory, ldap, collection, enumeration, adcs, kerberos, oscp

4 min read

RustHound — BloodHound Collector (Rust)

What is RustHound?

RustHound is a Rust BloodHound data collector — runs on Linux, Windows, and macOS without Python or a domain-joined shell. Outputs JSON (or ZIP) for import into BloodHound.

BinaryBloodHound versionRepo
rusthoundLegacy BloodHound (Neo4j GUI)NH-RED-TEAM/RustHound
rusthound-ceBloodHound CE (Community Edition)g0h4n/RustHound-CE

OSCP use: Same role as bloodhound-python or SharpHound — collect AD data from Kali with domain creds → import ZIP → find path to Domain Admin in Bloodhound + Sharphound.

Sync time first: Time Sync — Kerberos auth fails with clock skew.

Install

# Prebuilt binaries — GitHub releases (recommended for labs)
# rusthound / rusthound-ce from repos above
 
# Cargo install (legacy)
cargo install rusthound
 
# Kali — bloodhound-python often already installed; rusthound is optional
which rusthound rusthound-ce

📌 1) Global Arguments

Both tools share similar flags:

FlagDescription
-d, --domain <DOMAIN>Required — domain FQDN (e.g. corp.local)
-u, --ldapusernameUser — format user@domain.local
-p, --ldappasswordPassword (omit to prompt)
-f, --ldapfqdnDC hostname (DC01 or DC01.corp.local)
-i, --ldapipDC IP address
-P, --ldapportLDAP port (default 389)
-n, --name-serverDNS server IP (usually DC IP)
-o, --outputOutput directory (default ./)
-z, --zipCompress JSON into ZIP for BloodHound import
--ldapsForce LDAPS (port 636)
--dns-tcpDNS over TCP (UDP blocked)
-k, --kerberosKerberos auth from ccache (KRB5CCNAME) — rusthound-ce
--fqdn-resolverResolve computer names to IPs (full collection)

rusthound (legacy) only:

FlagDescription
--dc-onlyLDAP only — no SMB/HTTP to member hosts (stealth)
--adcsCollect AD CS / certificate template data
--old-bloodhoundADCS output for legacy BloodHound format

rusthound-ce only:

FlagDescription
-c, --collectionmethodAll (LDAP+SMB+HTTP) or DCOnly (LDAP only)

📌 2) Basic Collection (OSCP)

rusthound-ce → BloodHound CE

# Password auth — full collection + ZIP
rusthound-ce -d corp.local -u jsmith@corp.local -p 'Password1' \
  -i 10.10.10.10 -o ./rusthound-out -z
 
# Stealth — LDAP only (no SMB to workstations)
rusthound-ce -d corp.local -u jsmith@corp.local -p 'Password1' \
  -i 10.10.10.10 -c DCOnly -o ./out -z
 
# LDAPS
rusthound-ce -d corp.local --ldaps -u jsmith@corp.local -p 'Password1' \
  -i 10.10.10.10 -o ./out -z

rusthound → BloodHound Legacy

rusthound -d corp.local -u jsmith@corp.local -p 'Password1' \
  -i 10.10.10.10 -o ./rusthound-out -z
 
# Stealth LDAP-only
rusthound -d corp.local -u jsmith@corp.local -p 'Password1' \
  -i 10.10.10.10 --dc-only -o ./out -z
 
# Include AD CS data (ESC paths in graph)
rusthound -d corp.local -u jsmith@corp.local -p 'Password1' \
  -i 10.10.10.10 --adcs -o ./out -z

Import ZIP → Bloodhound + Sharphound → Shortest Paths to Domain Admins.

📌 3) Kerberos Authentication

After obtaining a TGT (e.g. impacket-getTGT):

export KRB5CCNAME=/path/to/user.ccache
sudo timedatectl set-ntp false
sudo ntpdate -s 10.10.10.10   # required
 
rusthound-ce -d corp.local -k -i 10.10.10.10 -o ./out -z

Pair with Impacket getTGT, Rubeus, or cracked creds → ticket → collect without password on wire.

📌 4) Windows On-Box

Single binary — no .NET / PowerShell needed:

rusthound.exe -d corp.local -u jsmith@corp.local -p Password1 -i 10.10.10.10 -o C:\Temp\ -z

Alternative on Windows: SharpHound (official) or Invoke-BloodHound in-memory.

📌 5) Collector Comparison

ToolPlatformBloodHoundNotes
SharpHoundWindowsLegacy + CEOfficial; in-memory PS1 option
bloodhound-pythonLinux (Python)Legacy + CEpip install bloodhound; very common on Kali
rusthound / rusthound-ceLinux/Win/macOS (Rust)Legacy / CE respectivelyFast, single binary; ADCS on legacy rusthound
bloodyAD get bloodhoundLinux (Python)CE onlyBasic collector; see bloodyAD
ldapsearchLinux—Raw LDAP; no graph

When to pick RustHound:

  • Want a static binary (no pip/Python deps)
  • bloodhound-python broken or slow in lab
  • Need ADCS collection on legacy BloodHound (--adcs)
  • Collect from Windows without SharpHound.exe

📌 6) Troubleshooting

ProblemFix
Auth fails, good credsTime Sync — timedatectl set-ntp false then ntpdate -s DC_IP
DNS resolution fails-i DC_IP -n DC_IP in /etc/hosts: 10.10.10.10 dc.corp.local corp.local
LDAPS cert errorsTry without --ldaps first
Empty / incomplete graphUse -c All or drop --dc-only; add --fqdn-resolver
Wrong BloodHound versionrusthound = Legacy · rusthound-ce = CE

📌 Quick Cheat Sheet

# OSCP default — CE
rusthound-ce -d corp.local -u user@corp.local -p 'pass' -i DC_IP -o /tmp/bh -z
 
# Legacy BloodHound + ADCS
rusthound -d corp.local -u user@corp.local -p 'pass' -i DC_IP --adcs -o /tmp/bh -z
 
# Stealth
rusthound-ce -d corp.local -u user@corp.local -p 'pass' -i DC_IP -c DCOnly -z

Graph View

Backlinks