Failed to setup LDAP Query Filter

[xZhiLx]

./sharphound.exe -d domain --ldapusername redacted --ldappassword -redacted

2023-10-30T18:48:32.7077262-07:00|WARNING|[CommonLib LDAPUtils]Failed to setup LDAP Query Filter
SharpHoundCommonLib.Exceptions.LDAPQueryException: Error creating LDAP connection: GetDomain call failed for REDACTED
at SharpHoundCommonLib.LDAPUtils.d__51.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at SharpHoundCommonLib.LDAPUtils.SetupLDAPQueryFilter(String ldapFilter, SearchScope scope, String[] props, Boolean includeAcl, String domainName, Boolean showDeleted, String adsPath, Boolean globalCatalog, Boolean skipCache)

does anyone also encounter this issue? I'm trying to run it and it keeps on showing multiple warnings in different domains and endpoints. I wonder if this also affects the results because when I try to upload the _computer.json it stucks at 0% forever.

[JonasBK]

Hi,

What version of SharpHound are you running? I tested in my lab with v2.0.1 and did not experience that warning:

If your computers.json is stuck at 0% it is likely because the SharpHound version is not compatible with the BloodHound version. What version of BloodHound are you running?

[xZhiLx]

I see. I think it's just my environment. but I'm not sure what causes the issue/warning "GetDomain call failed".

I also tried using the latest Bloodhound in docker. but when trying to upload or ingest the logs _computer.json in the bloodhound it displays the status "Failed" and a status message "Analysis Failed".

That time I'm using the legacy version of Bloodhound from this documentation:
https://bloodhound.readthedocs.io/en/latest/installation/linux.html

[JonasBK]

I'm not sure what's causing the "GetDomain call failed" error. Maybe it's related to DNS or LDAP requirements. Can enumerate the domain using other tools from that host?

BloodHound CE (docker version) is only compatible with SharpHound 2.x. Was the data you ingested perhaps from SharpHound v1.x?

[JonasBK]

You can also try to run SharpHound with -v 0 to get additional logging. That might help us understand why it is failing.

[xZhiLx]

I was already able to upload the _computer.json in Bloodhound, it appears to be a version compatibility issue. thanks