DACLhound 0.1.0__tar.gz

daclhound-0.1.0/DACLhound.egg-info/PKG-INFO

@@ -0,0 +1,101 @@
+Metadata-Version: 2.4
+Name: DACLhound
+Version: 0.1.0
+Summary: Collect Active Directory DACLs and explore them in an interactive graph
+License-Expression: MIT
+Keywords: active-directory,acl,dacl,bloodhound,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: bloodyAD==2.5.5
+Dynamic: license-file
+
+# DACLhound
+
+DACLhound collects Active Directory security descriptors over LDAP and turns the results into a graph you can inspect in a browser. The collector uses bloodyAD as a Python library; it does not run the `bloodyAD` command.
+
+## Install
+
+Python 3.10 or newer is required.
+
+```sh
+pipx install DACLhound
+```
+
+Upgrade later with:
+
+```sh
+pipx upgrade DACLhound
+```
+
+## Collect a graph
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --dc-ip "$IP" --output "$DOMAIN.json"
+```
+
+The collector is read-only. By default it collects users, groups, computers, OUs, containers, GPOs, the domain, and ADCS data. Use `--types` to limit directory object types:
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --types users,groups --output users-and-groups.json
+```
+
+Use `--no-adcs` to skip ADCS collection. The normalized graph is written to `--output`. Add `--raw-output` to keep the bloodyAD response as well.
+
+## Authentication
+
+### NTLM password
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --dc-ip "$IP" -o "$DOMAIN.json"
+```
+
+### NTLM pass-the-hash
+
+Use `LMHASH:NTHASH`; if you only have the NT hash, leave the LM field empty:
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -hashes ':<NTHASH>' --dc-ip "$IP" -o "$DOMAIN.json"
+```
+
+### Kerberos
+
+Use the current `KRB5CCNAME`, or pass a ccache path to `-k`:
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -k --dc-ip "$IP" -o "$DOMAIN.json"
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -k user.ccache --dc-ip "$IP" -o "$DOMAIN.json"
+```
+
+Kerberos can also use a password or NT hash with `-k`. For an AES key, use `-aesKey <AESKEY>`. Add `-s` to use LDAPS.
+
+## Open the graph
+
+Run the viewer in the foreground and stop it with `Ctrl+C`:
+
+```sh
+DACLhound.py graph --input "$DOMAIN.json"
+```
+
+Or run it in the background:
+
+```sh
+DACLhound.py graph start --input "$DOMAIN.json"
+DACLhound.py graph status
+DACLhound.py graph stop
+```
+
+The server listens on `127.0.0.1:8765` by default. Uploaded JSON files stay in memory while the server is running and are discarded when it stops. Use `--bind` and `--port` to change the listener. Run `DACLhound.py collect --help` or `DACLhound.py graph --help` for all options.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

daclhound-0.1.0/DACLhound.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+daclgraph_server.py
+daclhound_cli.py
+pyproject.toml
+DACLhound.egg-info/PKG-INFO
+DACLhound.egg-info/SOURCES.txt
+DACLhound.egg-info/dependency_links.txt
+DACLhound.egg-info/entry_points.txt
+DACLhound.egg-info/requires.txt
+DACLhound.egg-info/top_level.txt
+daclhound_assets/__init__.py
+daclhound_assets/viewer.html

daclhound-0.1.0/DACLhound.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

daclhound-0.1.0/DACLhound.egg-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+DACLhound.py = daclhound_cli:entrypoint
+daclhound = daclhound_cli:entrypoint

daclhound-0.1.0/DACLhound.egg-info/requires.txt

@@ -0,0 +1 @@
+bloodyAD==2.5.5

daclhound-0.1.0/DACLhound.egg-info/top_level.txt

@@ -0,0 +1,3 @@
+daclgraph_server
+daclhound_assets
+daclhound_cli

daclhound-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gzzcoo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

daclhound-0.1.0/PKG-INFO

@@ -0,0 +1,101 @@
+Metadata-Version: 2.4
+Name: DACLhound
+Version: 0.1.0
+Summary: Collect Active Directory DACLs and explore them in an interactive graph
+License-Expression: MIT
+Keywords: active-directory,acl,dacl,bloodhound,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: bloodyAD==2.5.5
+Dynamic: license-file
+
+# DACLhound
+
+DACLhound collects Active Directory security descriptors over LDAP and turns the results into a graph you can inspect in a browser. The collector uses bloodyAD as a Python library; it does not run the `bloodyAD` command.
+
+## Install
+
+Python 3.10 or newer is required.
+
+```sh
+pipx install DACLhound
+```
+
+Upgrade later with:
+
+```sh
+pipx upgrade DACLhound
+```
+
+## Collect a graph
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --dc-ip "$IP" --output "$DOMAIN.json"
+```
+
+The collector is read-only. By default it collects users, groups, computers, OUs, containers, GPOs, the domain, and ADCS data. Use `--types` to limit directory object types:
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --types users,groups --output users-and-groups.json
+```
+
+Use `--no-adcs` to skip ADCS collection. The normalized graph is written to `--output`. Add `--raw-output` to keep the bloodyAD response as well.
+
+## Authentication
+
+### NTLM password
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --dc-ip "$IP" -o "$DOMAIN.json"
+```
+
+### NTLM pass-the-hash
+
+Use `LMHASH:NTHASH`; if you only have the NT hash, leave the LM field empty:
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -hashes ':<NTHASH>' --dc-ip "$IP" -o "$DOMAIN.json"
+```
+
+### Kerberos
+
+Use the current `KRB5CCNAME`, or pass a ccache path to `-k`:
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -k --dc-ip "$IP" -o "$DOMAIN.json"
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -k user.ccache --dc-ip "$IP" -o "$DOMAIN.json"
+```
+
+Kerberos can also use a password or NT hash with `-k`. For an AES key, use `-aesKey <AESKEY>`. Add `-s` to use LDAPS.
+
+## Open the graph
+
+Run the viewer in the foreground and stop it with `Ctrl+C`:
+
+```sh
+DACLhound.py graph --input "$DOMAIN.json"
+```
+
+Or run it in the background:
+
+```sh
+DACLhound.py graph start --input "$DOMAIN.json"
+DACLhound.py graph status
+DACLhound.py graph stop
+```
+
+The server listens on `127.0.0.1:8765` by default. Uploaded JSON files stay in memory while the server is running and are discarded when it stops. Use `--bind` and `--port` to change the listener. Run `DACLhound.py collect --help` or `DACLhound.py graph --help` for all options.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

daclhound-0.1.0/README.md

@@ -0,0 +1,80 @@
+# DACLhound
+
+DACLhound collects Active Directory security descriptors over LDAP and turns the results into a graph you can inspect in a browser. The collector uses bloodyAD as a Python library; it does not run the `bloodyAD` command.
+
+## Install
+
+Python 3.10 or newer is required.
+
+```sh
+pipx install DACLhound
+```
+
+Upgrade later with:
+
+```sh
+pipx upgrade DACLhound
+```
+
+## Collect a graph
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --dc-ip "$IP" --output "$DOMAIN.json"
+```
+
+The collector is read-only. By default it collects users, groups, computers, OUs, containers, GPOs, the domain, and ADCS data. Use `--types` to limit directory object types:
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --types users,groups --output users-and-groups.json
+```
+
+Use `--no-adcs` to skip ADCS collection. The normalized graph is written to `--output`. Add `--raw-output` to keep the bloodyAD response as well.
+
+## Authentication
+
+### NTLM password
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --dc-ip "$IP" -o "$DOMAIN.json"
+```
+
+### NTLM pass-the-hash
+
+Use `LMHASH:NTHASH`; if you only have the NT hash, leave the LM field empty:
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -hashes ':<NTHASH>' --dc-ip "$IP" -o "$DOMAIN.json"
+```
+
+### Kerberos
+
+Use the current `KRB5CCNAME`, or pass a ccache path to `-k`:
+
+```sh
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -k --dc-ip "$IP" -o "$DOMAIN.json"
+DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -k user.ccache --dc-ip "$IP" -o "$DOMAIN.json"
+```
+
+Kerberos can also use a password or NT hash with `-k`. For an AES key, use `-aesKey <AESKEY>`. Add `-s` to use LDAPS.
+
+## Open the graph
+
+Run the viewer in the foreground and stop it with `Ctrl+C`:
+
+```sh
+DACLhound.py graph --input "$DOMAIN.json"
+```
+
+Or run it in the background:
+
+```sh
+DACLhound.py graph start --input "$DOMAIN.json"
+DACLhound.py graph status
+DACLhound.py graph stop
+```
+
+The server listens on `127.0.0.1:8765` by default. Uploaded JSON files stay in memory while the server is running and are discarded when it stops. Use `--bind` and `--port` to change the listener. Run `DACLhound.py collect --help` or `DACLhound.py graph --help` for all options.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

daclhound-0.1.0/daclgraph_server.py

@@ -0,0 +1,150 @@
+"""Serve the DACL graph viewer and keep uploaded datasets in process memory."""
+from __future__ import annotations
+
+import argparse
+from importlib.resources import files
+import json
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from urllib.parse import unquote, urlparse
+
+VIEWER = files("daclhound_assets").joinpath("viewer.html")
+MAX_BODY = 64 * 1024 * 1024
+
+
+class DatasetStore:
+    """Thread-safe, process-local storage for uploaded graph datasets."""
+
+    def __init__(self, initial_json: str | None = None) -> None:
+        self._lock = threading.Lock()
+        self._next_id = 1
+        self._datasets: list[dict] = []
+        if initial_json:
+            path = Path(initial_json).expanduser().resolve()
+            self.add(path.name, json.loads(path.read_text(encoding="utf-8")))
+
+    def add(self, name: str, data: object) -> dict:
+        if not isinstance(data, dict) or not isinstance(data.get("nodes"), list) or not isinstance(data.get("edges"), list):
+            raise ValueError("Expected a DACL graph JSON object with nodes and edges arrays")
+        with self._lock:
+            key = str(self._next_id)
+            self._next_id += 1
+            item = {"key": key, "name": name or "daclgraph.json", "data": data}
+            self._datasets.append(item)
+            return item
+
+    def list(self) -> list[dict]:
+        with self._lock:
+            return list(self._datasets)
+
+    def remove(self, key: str) -> bool:
+        with self._lock:
+            remaining = [item for item in self._datasets if item["key"] != key]
+            if len(remaining) == len(self._datasets):
+                return False
+            self._datasets = remaining
+            return True
+
+
+def make_handler(store: DatasetStore, log_requests: bool = False):
+    class Handler(BaseHTTPRequestHandler):
+        server_version = "DACLGraph/1.0"
+
+        def log_message(self, fmt: str, *args) -> None:
+            if log_requests:
+                print(f"[{self.log_date_time_string()}] {fmt % args}")
+
+        def send_bytes(self, status: int, body: bytes, content_type: str) -> None:
+            self.send_response(status)
+            self.send_header("Content-Type", content_type)
+            self.send_header("Content-Length", str(len(body)))
+            self.send_header("Cache-Control", "no-store")
+            self.end_headers()
+            self.wfile.write(body)
+
+        def send_json(self, status: int, value: object) -> None:
+            body = json.dumps(value, ensure_ascii=False).encode("utf-8")
+            self.send_bytes(status, body, "application/json; charset=utf-8")
+
+        def do_GET(self) -> None:
+            path = urlparse(self.path).path
+            if path == "/api/datasets":
+                self.send_json(200, store.list())
+                return
+            if path in ("/", "/daclgraph_viewer.html"):
+                try:
+                    self.send_bytes(200, VIEWER.read_bytes(), "text/html; charset=utf-8")
+                except OSError as exc:
+                    self.send_json(500, {"error": str(exc)})
+                return
+            self.send_json(404, {"error": "Not found"})
+
+        def do_POST(self) -> None:
+            path = urlparse(self.path).path
+            if path != "/api/datasets":
+                self.send_json(404, {"error": "Not found"})
+                return
+            try:
+                length = int(self.headers.get("Content-Length", "0"))
+            except ValueError:
+                length = 0
+            if length <= 0 or length > MAX_BODY:
+                self.send_json(400, {"error": "Request body must be between 1 byte and 64 MiB"})
+                return
+            try:
+                payload = json.loads(self.rfile.read(length).decode("utf-8"))
+            except (json.JSONDecodeError, UnicodeDecodeError):
+                self.send_json(400, {"error": "Invalid JSON request body"})
+                return
+            if not isinstance(payload, dict):
+                self.send_json(400, {"error": "Expected an object containing name and data"})
+                return
+            try:
+                item = store.add(str(payload.get("name") or "daclgraph.json"), payload.get("data"))
+            except ValueError as exc:
+                self.send_json(400, {"error": str(exc)})
+                return
+            self.send_json(201, item)
+
+        def do_DELETE(self) -> None:
+            path = urlparse(self.path).path
+            prefix = "/api/datasets/"
+            if not path.startswith(prefix):
+                self.send_json(404, {"error": "Not found"})
+                return
+            key = unquote(path[len(prefix):])
+            if not store.remove(key):
+                self.send_json(404, {"error": "Dataset not found"})
+                return
+            self.send_json(200, {"removed": key})
+
+    return Handler
+
+
+def run_server(host: str = "127.0.0.1", port: int = 8765, initial_json: str | None = None, log_requests: bool = False) -> None:
+    store = DatasetStore(initial_json)
+    server = ThreadingHTTPServer((host, port), make_handler(store, log_requests))
+    print(f"[+] DACLhound server listening at http://{host}:{port}/")
+    print("[+] Uploaded datasets are kept in memory until this process exits")
+    try:
+        server.serve_forever()
+    except KeyboardInterrupt:
+        print("\n[*] Stopping DACLhound server")
+    finally:
+        server.server_close()
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Serve the interactive DACL graph viewer with in-memory datasets.")
+    parser.add_argument("--host", default="127.0.0.1", help="Bind address (default: 127.0.0.1)")
+    parser.add_argument("--port", type=int, default=8765, help="HTTP port (default: 8765)")
+    parser.add_argument("--initial-json", help="Load one graph JSON into the in-memory session on startup")
+    parser.add_argument("--verbose", action="store_true", help="Log each HTTP request")
+    args = parser.parse_args()
+    run_server(args.host, args.port, args.initial_json, args.verbose)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

daclhound-0.1.0/daclhound_assets/__init__.py

@@ -0,0 +1 @@
+"""Static resources shipped with DACLhound."""