Merge pull request #19 from jazofra/main

Improve Windows AD fallback and progress reporting for large domain enumeration

Author: Mayyhem

.claude/plans/ldap_sspi_fix.md

@@ -0,0 +1,27 @@
+# LDAP SSPI Fix Plan
+
+## Goal
+Make Windows LDAP enumeration use native SSPI integrated authentication when no explicit LDAP credentials are supplied, matching ShareHound behavior.
+
+## Tasks
+1. Inspect MSSQLHound LDAP connection and bind selection logic.
+2. Inspect ShareHound Windows LDAP/SSPI implementation for the working pattern.
+3. Implement the minimal Windows-specific SSPI path or correct the existing selection logic.
+4. Add focused unit coverage where feasible without requiring a live domain controller.
+5. Run `go test ./...` and address failures related to this change.
+
+## Follow-up
+1. Keep successful Windows ADSI fallback logs concise at info level.
+2. Preserve the full Go LDAP failure only at verbose level for troubleshooting.
+3. Re-run `go test ./...` and rebuild `mssqlhound.exe`.
+
+## Go ADSI Computer Enumeration
+1. Add an in-process Windows ADSI/ADO computer enumeration helper in Go; do not fork PowerShell.
+2. Use the same filter and attributes as ShareHound's Go LDAP path: all computer objects, `dNSHostName` first and `name` as fallback.
+3. Route `--scan-all-computers` Windows fallback to the Go helper.
+4. Add non-Windows stub/tests, run `go test ./...`, and rebuild `mssqlhound.exe`.
+
+## IP Deduplication Progress
+1. Resolve unique hostnames concurrently instead of serially resolving every server entry.
+2. Emit info-level progress during DNS resolution and final dedupe processing.
+3. Preserve existing input-order dedupe preference behavior.

.claude/tasks/lessons.md

@@ -0,0 +1,6 @@
+# Lessons
+
+- For Windows AD fallback paths, avoid `exec.Command("powershell", ...)` when in-process Go/COM/LDAP APIs can do the work. Fork/exec can be blocked by policy even when native ADSI works.
+- With go-ole ADO collections, retrieve `Item` via property access first (`GetProperty(collection, "Item", name)`), not method invocation; otherwise provider properties like `Page Size` can fail with `Member not found`.
+- Long-running AD enumeration must emit progress at info level and carry useful attributes like `objectSid` forward to avoid slow follow-up lookup loops.
+- Long-running DNS/IP dedupe must emit info-level progress and avoid serial per-entry lookups; resolve unique hostnames concurrently with a bounded worker count.

README.md

@@ -222,17 +222,13 @@ Each authentication below generates log entries on the target system.
 | WinRM login | SQL Server host | NTLM or Basic auth | Logged as a Windows authentication event | **Only `test-epa-matrix` subcommand** |
 | WMI/DCOM login | SQL Server host | Current user's Windows credentials | Logged as a DCOM authentication event | **Windows only**, during local group enumeration |
 
-## Subprocesses Executed
-
-MSSQLHound spawns local `powershell.exe` processes as fallbacks when native Go clients fail. All subprocesses run on the **operator's machine**, not on targets (except WinRM remote execution).
-
-| Executable | Arguments | Purpose | Conditions |
-|------------|-----------|---------|------------|
-| `powershell.exe` | `-NoProfile -NonInteractive -Command <script>` | SQL query execution via `System.Data.SqlClient` | Windows only. Fallback when Go TDS driver fails with "untrusted domain" error. **Not used when `--proxy` is set.** |
-| `powershell.exe` | `-NoProfile -NonInteractive -Command <script>` | SPN enumeration via `[adsisearcher]` (ADSI) | Windows only. Fallback when Go LDAP client fails. |
-| `powershell.exe` | `-NoProfile -NonInteractive -Command <script>` | Domain computer enumeration via `[adsisearcher]` (ADSI) | Windows only. Fallback when Go LDAP client fails. |
-| `powershell.exe` | `-NoProfile -NonInteractive -Command <script>` | SPN lookup by hostname via `[adsisearcher]` (ADSI) | Windows only. Fallback when Go LDAP client fails. |
-| `powershell.exe` | `-NoProfile -NonInteractive -EncodedCommand <base64>` | Remote PowerShell via WinRM: EPA registry configuration and SQL service restart on target host | **Only `test-epa-matrix` subcommand.** Executes on the remote target via WinRM. |
+## Subprocesses Executed
+
+MSSQLHound does not spawn local `powershell.exe` processes as collection fallbacks. The only PowerShell command constructed by the Go binary is sent through WinRM for the EPA matrix workflow.
+
+| Executable | Arguments | Purpose | Conditions |
+|------------|-----------|---------|------------|
+| `powershell.exe` | `-NoProfile -NonInteractive -EncodedCommand <base64>` | Remote PowerShell via WinRM: EPA registry configuration and SQL service restart on target host | **Only `test-epa-matrix` subcommand.** Executes on the remote target via WinRM. |
 
 ## SQL Queries Executed on Targets
 
@@ -359,9 +355,8 @@ The original MSSQLHound PowerShell script is an excellent tool for SQL Server se
 - **Single Binary**: No dependencies, easy to deploy and run
 - **No PowerShell Required**: Can run on systems without PowerShell installed
 
-### Compatibility
-- **PowerShell Fallback**: When the native Go SQL driver fails (e.g., certain SSPI configurations), automatically falls back to PowerShell's `System.Data.SqlClient` for maximum compatibility
-- **Full Feature Parity**: Produces identical BloodHound-compatible output
+### Compatibility
+- **Full Feature Parity**: Produces identical BloodHound-compatible output
 
 ### Maintainability
 - **Strongly Typed**: Go's type system catches errors at compile time
@@ -371,12 +366,11 @@ The original MSSQLHound PowerShell script is an excellent tool for SQL Server se
 ## Features
 
 - **SQL Server Collection**: Enumerates server principals (logins, server roles), databases, database principals (users, roles), permissions, and role memberships
-- **Linked Server Discovery**: Maps SQL Server linked server relationships
-- **Active Directory Integration**: Resolves Windows logins to domain principals via LDAP
-- **BloodHound Output**: Produces OpenGraph JSON format compatible with BloodHound CE
-- **Streaming Output**: Memory-efficient streaming JSON writer for large environments
-- **Automatic Fallback**: Falls back to PowerShell for servers with SSPI issues
-- **LDAP Paging**: Handles large domains with thousands of computers/SPNs
+- **Linked Server Discovery**: Maps SQL Server linked server relationships
+- **Active Directory Integration**: Resolves Windows logins to domain principals via LDAP
+- **BloodHound Output**: Produces OpenGraph JSON format compatible with BloodHound CE
+- **Streaming Output**: Memory-efficient streaming JSON writer for large environments
+- **LDAP Paging**: Handles large domains with thousands of computers/SPNs
 
 ## Building
 
@@ -751,24 +745,23 @@ mssqlhound completion powershell | Out-String | Invoke-Expression
 
 ### Connection Handling
 
-The Go version includes automatic PowerShell fallback for servers that fail with the native `go-mssqldb` driver:
+The Go version uses the native `go-mssqldb` driver with multiple connection strategies for hostname, encryption, and SPN handling:
 
 ```
-Native connection: go-mssqldb (fast, cross-platform)
-        ↓ fails with "untrusted domain" error
-Fallback: PowerShell + System.Data.SqlClient (Windows only, more compatible)
-```
-
-This ensures maximum compatibility while maintaining performance for the majority of servers.
+Native connection: go-mssqldb (fast, cross-platform)
+```
+
+If all native strategies fail, the connection error is returned directly.
 
 ### LDAP Connection Methods
 
 The Go version tries multiple LDAP connection methods in order:
 
-1. **LDAPS (port 636)** - TLS encrypted, most secure
-2. **LDAP + StartTLS (port 389)** - Upgrade to TLS
-3. **Plain LDAP (port 389)** - Unencrypted (may fail if DC requires signing)
-4. **PowerShell/ADSI Fallback** - Windows COM-based fallback
+1. **LDAPS (port 636)** - TLS encrypted, most secure
+2. **LDAP + StartTLS (port 389)** - Upgrade to TLS
+3. **Plain LDAP (port 389)** - Unencrypted (may fail if DC requires signing)
+
+For `--scan-all-computers` on Windows with implicit LDAP authentication, computer enumeration may use in-process Go ADSI if LDAP computer enumeration fails. This path does not launch PowerShell.
 
 ## CVE Detection
 
@@ -827,18 +820,7 @@ Some SQL Server instances with specific SSPI configurations may fail to connect
 Login failed. The login is from an untrusted domain and cannot be used with Windows authentication
 ```
 
-**Automatic Handling:** The Go version detects this error and automatically retries using PowerShell's `System.Data.SqlClient`, which handles these edge cases more reliably. This fallback requires PowerShell to be available on the system.
-
-### PowerShell Fallback Limitations
-
-The PowerShell fallback for SQL connections and AD enumeration requires:
-- Windows operating system
-- PowerShell execution not blocked by security policy
-- Access to `System.Data.SqlClient` (.NET Framework)
-
-If PowerShell is blocked (e.g., `Access is denied` error), the fallback will not work. In this case:
-- For SQL connections: Some servers may not be reachable
-- For AD enumeration: Use explicit LDAP credentials instead
+There is no local PowerShell retry path for this condition. Check domain trust, SPN selection, EPA settings, and the selected authentication method; use SQL authentication or explicit Kerberos material where appropriate.
 
 ### When to Use LDAP Credentials
 
@@ -872,11 +854,10 @@ Use `-v` or `--verbose` to see detailed connection attempts and errors:
 
 | Error | Cause | Solution |
 |-------|-------|----------|
-| `untrusted domain` | SSPI negotiation failed | Automatic PowerShell fallback; check domain trust |
-| `Size Limit Exceeded` | Too many LDAP results | Update to latest version (has paging) |
-| `80090346` | GSSAPI/Kerberos failure | Use explicit LDAP credentials |
-| `Strong Auth Required` | DC requires LDAP signing | Will automatically try LDAPS/StartTLS |
-| `Access is denied` (PowerShell) | Execution policy blocked | Use explicit LDAP credentials instead |
+| `untrusted domain` | SSPI negotiation failed | Check domain trust, SPN selection, EPA settings, and authentication method |
+| `Size Limit Exceeded` | Too many LDAP results | Update to latest version (has paging) |
+| `80090346` | GSSAPI/Kerberos failure | Use explicit LDAP credentials |
+| `Strong Auth Required` | DC requires LDAP signing | Will automatically try LDAPS/StartTLS |
 
 ### Debug LDAP Connection
 

internal/collector/adsi_nonwindows.go

@@ -0,0 +1,9 @@
+//go:build !windows
+
+package collector
+
+import "fmt"
+
+func (c *Collector) enumerateComputersViaWindowsADSI() ([]domainComputer, error) {
+	return nil, fmt.Errorf("Windows ADSI computer enumeration is only available on Windows")
+}