# RustHound
# Summary
- [Limitation](#limitations)
- [Description](#description)
- [How to compile it?](#how-to-compile-it)
- [Using Makefile](#using-makefile)
- [Using Dockerfile](#using-dockerfile)
- [Using Cargo](#using-cargo)
- [Linux x86_64 static version](#manually-for-linux-x86_64-static-version)
- [Windows static version from Linux](#manually-for-windows-static-version-from-linux)
- [macOS static version from Linux](#manually-for-macos-static-version-from-linux)
- [Optimize the binary size](#optimize-the-binary-size)
- [How to build documentation?](#how-to-build-documentation)
- [Usage](#usage)
- [Demo](#demo)
- [Simple usage](#simple-usage)
- [Module FQDN resolver](#module-fqdn-resolver)
- [Module ADCS collector](#module-adcs-collector)
- [Statistics](#rocket-statistics)
- [Roadmap](#-roadmap)
- [Links](#link-links)
# Limitations
Not all SharpHound features have been implemented. Some exist in RustHound and not in SharpHound or BloodHound-Python. Please refer to the [roadmap](#-roadmap) for more information.
# Description
RustHound is a **cross-platform** BloodHound collector tool written in Rust, making it compatible with Linux, Windows, and macOS.
No AV detection and **cross-compiled**.
RustHound generates users, groups, computers, OUs, GPOs, containers, and domain JSON files that can be analyzed with BloodHound.
> 💡 If you can use SharpHound, use it.
> Use RustHound as a backup solution if SharpHound is detected by AV or if it not compatible with your OS.
# How to compile it?
## Using Makefile
You can use the **make** command to install RustHound or to compile it for Linux or Windows.
```bash
make install
rusthound -h
```
More command in the **Makefile**:
```bash
Default:
usage: make install
usage: make uninstall
usage: make debug
usage: make release
Static:
usage: make windows
usage: make windows_x64
usage: make windows_x86
usage: make linux_aarch64
usage: make linux_x86_64
usage: make linux_musl
usage: make macos
usage: make arm_musl
usage: make armv7
Without cli argument:
usage: make windows_noargs
Dependencies:
usage: make install_windows_deps
usage: make install_linux_musl_deps
usage: make install_macos_deps
```
## Using Dockerfile
Use RustHound with Docker to make sure to have all dependencies.
```bash
docker build --rm -t rusthound .
# Then
docker run --rm -v ./:/usr/src/rusthound rusthound windows
docker run --rm -v ./:/usr/src/rusthound rusthound linux_musl
docker run --rm -v ./:/usr/src/rusthound rusthound macos
```
## Using Cargo
You will need to install Rust on your system.
[https://www.rust-lang.org/fr/tools/install](https://www.rust-lang.org/fr/tools/install)
RustHound supports Kerberos and GSSAPI. Therefore, it requires Clang and its development libraries, as well as the Kerberos development libraries. On Debian and Ubuntu, this means **clang-N**, **libclang-N-dev**, and **libkrb5-dev**.
For example:
```bash
# Debian/Ubuntu
sudo apt-get -y update && sudo apt-get -y install gcc clang libclang-dev libgssapi-krb5-2 libkrb5-dev libsasl2-modules-gssapi-mit musl-tools gcc-mingw-w64-x86-64
```
Here is how to compile the "release" and "debug" versions using the **cargo** command.
```bash
git clone https://github.com/OPENCYBER-FR/RustHound
cd RustHound
cargo build --release
# or debug version
cargo b
```
The result can be found in the target/release or target/debug folder.
Below you can find the compilation methodology for each of the OS from Linux.
If you need another compilation system, please consult the list in this link: [https://doc.rust-lang.org/nightly/rustc/platform-support.html](https://doc.rust-lang.org/nightly/rustc/platform-support.html)
## Manually for Linux x86_64 static version
```bash
# Install rustup and Cargo for Linux
curl https://sh.rustup.rs -sSf | sh
# Add Linux deps
rustup install stable-x86_64-unknown-linux-gnu
rustup target add x86_64-unknown-linux-gnu
# Static compilation for Linux
git clone https://github.com/OPENCYBER-FR/RustHound
cd RustHound
CFLAGS="-lrt";LDFLAGS="-lrt";RUSTFLAGS='-C target-feature=+crt-static';cargo build --release --target x86_64-unknown-linux-gnu
```
The result can be found in the target/x86_64-unknown-linux-gnu/release folder.
## Manually for Windows static version from Linux
```bash
# Install rustup and Cargo in Linux
curl https://sh.rustup.rs -sSf | sh
# Add Windows deps
rustup install stable-x86_64-pc-windows-gnu
rustup target add x86_64-pc-windows-gnu
# Static compilation for Windows
git clone https://github.com/OPENCYBER-FR/RustHound
cd RustHound
RUSTFLAGS="-C target-feature=+crt-static" cargo build --release --target x86_64-pc-windows-gnu
```
The result can be found in the target/x86_64-pc-windows-gnu/release folder.
## Manually for macOS static version from Linux
Amazing documentation: [https://wapl.es/rust/2019/02/17/rust-cross-compile-linux-to-macos.html](https://wapl.es/rust/2019/02/17/rust-cross-compile-linux-to-macos.html)
```bash
# Install rustup and Cargo in Linux
curl https://sh.rustup.rs -sSf | sh
# Add macOS tool chain
sudo git clone https://github.com/tpoechtrager/osxcross /usr/local/bin/osxcross
sudo wget -P /usr/local/bin/osxcross/ -nc https://s3.dockerproject.org/darwin/v2/MacOSX10.10.sdk.tar.xz && sudo mv /usr/local/bin/osxcross/MacOSX10.10.sdk.tar.xz /usr/local/bin/osxcross/tarballs/
sudo UNATTENDED=yes OSX_VERSION_MIN=10.7 /usr/local/bin/osxcross/build.sh
sudo chmod 775 /usr/local/bin/osxcross/ -R
export PATH="/usr/local/bin/osxcross/target/bin:$PATH"
# Cargo needs to be told to use the correct linker for the x86_64-apple-darwin target, so add the following to your project’s .cargo/config file:
grep 'target.x86_64-apple-darwin' ~/.cargo/config || echo "[target.x86_64-apple-darwin]" >> ~/.cargo/config
grep 'linker = "x86_64-apple-darwin14-clang"' ~/.cargo/config || echo 'linker = "x86_64-apple-darwin14-clang"' >> ~/.cargo/config
grep 'ar = "x86_64-apple-darwin14-clang"' ~/.cargo/config || echo 'ar = "x86_64-apple-darwin14-clang"' >> ~/.cargo/config
# Static compilation for macOS
git clone https://github.com/OPENCYBER-FR/RustHound
cd RustHound
RUSTFLAGS="-C target-feature=+crt-static" cargo build --release --target x86_64-apple-darwin --features nogssapi
```
The result can be found in the target/x86_64-apple-darwin/release folder.
## Optimize the binary size
> 💡 To obtain an optimized compilation of RustHound add the following compilation parameters at the end of the `Cargo.toml` file.
```bash
[profile.release]
opt-level = "z"
lto = true
strip = true
codegen-units = 1
panic = "abort"
```
The size of the binary will be considerably minimized.
Basic cargo compiler commands can be used.
```bash
make windows
```
More information [here](https://github.com/johnthagen/min-sized-rust)
# How to build the documentation?
```bash
git clone https://github.com/OPENCYBER-FR/RustHound
cd RustHound
cargo doc --open --no-deps
```
# Usage
```bash
Usage: rusthound [OPTIONS] --domain
Options:
-v... Set the level of verbosity
-h, --help Print help information
-V, --version Print version information
REQUIRED VALUES:
-d, --domain Domain name like: DOMAIN.LOCAL
OPTIONAL VALUES:
-u, --ldapusername LDAP username, like: user@domain.local
-p, --ldappassword LDAP password
-f, --ldapfqdn Domain Controler FQDN like: DC01.DOMAIN.LOCAL or just DC01
-i, --ldapip Domain Controller IP address like: 192.168.1.10
-P, --ldapport LDAP port [default: 389]
-n, --name-server Alternative IP address name server to use for DNS queries
-o, --output