Export-BloodHoundCSV Exception about bloodhound

[andyrobbins]

Hi there,

Thanks for the issue submission. Here is the error message I'm seeing in your post:

The trust relationship between this workstation and the primary domain failed

This error would indicate to me that there is something wrong with the trust between the system you are running this on, and the domain the computer is part of. Are you able to authenticate to the domain? If currently logged on, I'd try browsing the SYSVOL or viewing basic domain info via net, (ie: net accounts /domain).

[Itaykr]

i tried your tests and everything works fine.. it seems that the exception raise on Export-BloundCSV cause running Get-BloundHoundData alone works without exceptions.

[HarmJ0y]

I think I know what the error might be, will dig into it in the next few days.

[Itaykr]

looking forward to hear from you..

[HarmJ0y]

The export functions attempt to do global catalog deconfliction for accounts that show up in more than one domain. The specific function where you're encountering the error is Get-NetForest -> are you able to run Get-NetForest manually?

Are you also able to run the following two lines (used to determine the SID of the forest root):

$ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest(); $ForestSid = (New-Object System.Security.Principal.NTAccount($ForestObject.RootDomain,"krbtgt")).Translate([System.Security.Principal.SecurityIdentifier]).Value

[Slad3G]

Hey Guys,

I am having the same error and when I run the lines in your last thread I get:

PS C:\> $ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetCu
rrentForest(); $ForestSid = (New-Object System.Security.Principal.NTAccount($For
estObject.RootDomain,"krbtgt")).Translate([System.Security.Principal.SecurityIde
ntifier]).Value
Exception calling "Translate" with "1" argument(s): "Some or all identity refer
ences could not be translated."
At line:1 char:194
+ $ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrent
Forest(); $ForestSid = (New-Object System.Security.Principal.NTAccount($ForestO
bject.RootDomain,"krbtgt")).Translate <<<< ([System.Security.Principal.Security
Identifier]).Value
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DotNetMethodException

[HarmJ0y]

Alrighty, not sure what's going on here, but I modified some of the logic with 2819e5f (pull the master branch). The global catalog user mapping is now abstracted out to Get-GlobalCatalogUserMapping which uses a different method to enumerate the reachable global catalog for the domain.

Pull the master branch, try Get-GlobalCatalogUserMapping and/or the normal Get-BloodHoundData | Export-BloodHoundCSV method again to see if the exception is solved.

[Slad3G]

That fixed it! Now I will hop over and submit an issue to the powerview module that is similar.

SG

[HarmJ0y]

Awesome, thanks!