bhshell 0.1.0__py3-none-any.whl

bhshell/shell/commands/library.py

@@ -0,0 +1,56 @@
+"""Saved query library command."""
+
+from __future__ import annotations
+
+import argparse
+
+from cmd2 import Choices, Cmd2ArgumentParser, with_argparser
+
+from bhshell.errors import NotFoundError
+from bhshell.models.results import Column
+from bhshell.queries.library import QueryLibrary, query_dirs, user_dir
+from bhshell.shell.commands.base import BaseCommands, add_output_args
+
+
+def _query_parser() -> Cmd2ArgumentParser:
+    p = Cmd2ArgumentParser(description=f"Saved Cypher queries: bundled, {user_dir()}/*.cyp, the folders in "
+                                       "'config query_dirs', and queries saved on the server.")
+    sub = p.add_subparsers(dest="action", required=True, metavar="{list,show,run}")
+    sub.add_parser("list", help="list available queries")
+    show = sub.add_parser("show", help="print a query")
+    show.add_argument("name", choices_provider=LibraryCommands.query_names)
+    run = sub.add_parser("run", help="run a query")
+    run.add_argument("name", choices_provider=LibraryCommands.query_names)
+    add_output_args(run)
+    return p
+
+
+class LibraryCommands(BaseCommands):
+    DEFAULT_CATEGORY = "Analysis"
+
+    def _library(self) -> QueryLibrary:
+        return QueryLibrary(self.app.client, extra_dirs=query_dirs(self.app.config.query_dirs))
+
+    def query_names(self) -> Choices:
+        """Tab-completion provider (local queries only, to stay fast)."""
+        return Choices.from_values(self._library().load(include_server=False))
+
+    @with_argparser(_query_parser)
+    def do_query(self, args: argparse.Namespace) -> None:
+        """List, show or run saved Cypher queries."""
+        app = self.app
+        library = self._library()
+        queries = library.load()
+        if args.action == "list":
+            rows = [{"name": q.name, "source": q.source, "description": q.description} for q in queries.values()]
+            app.ui.table("Saved queries", [Column("Name", "name"), Column("Source", "source"),
+                                           Column("Description", "description")], rows, notes=library.notes)
+            return
+        query = queries.get(args.name)
+        if query is None:
+            raise NotFoundError(f"No saved query named '{args.name}'", hint="Run 'query list'.")
+        if args.action == "show":
+            app.poutput(query.query)
+            return
+        app.require_auth()
+        self.show_graph(app.entities.run_cypher(query.query), as_json=args.json, output=args.output)

bhshell/shell/commands/marking.py

@@ -0,0 +1,59 @@
+"""Owned / high-value (Tier Zero) marking commands."""
+
+from __future__ import annotations
+
+import argparse
+
+from cmd2 import Cmd2ArgumentParser, with_argparser
+
+from bhshell.queries.marking import Tag
+from bhshell.render import export
+from bhshell.shell.commands.base import BaseCommands, add_output_args
+
+_LABEL = {"owned": "Owned", "tier0": "Tier Zero / High Value"}
+
+
+def _marking_parser(tag: Tag) -> Cmd2ArgumentParser:
+    label = _LABEL[tag]
+    p = Cmd2ArgumentParser(description=f"List or change {label} objects.")
+    sub = p.add_subparsers(dest="action", required=True, metavar="{list,add,remove}")
+    ls = sub.add_parser("list", help=f"list {label} objects")
+    add_output_args(ls)
+    for action in ("add", "remove"):
+        a = sub.add_parser(action, help=f"{action} an object {'to' if action == 'add' else 'from'} {label}")
+        a.add_argument("name", help="samaccountname, NAME@DOMAIN, DOMAIN\\NAME or SID",
+                       choices_provider=BaseCommands.recent_names)
+        a.add_argument("-t", "--type", choices=["user", "computer", "group"], help="object type (default: any)")
+        a.add_argument("-d", "--domain", help="restrict the lookup to a domain")
+    return p
+
+
+class MarkingCommands(BaseCommands):
+    DEFAULT_CATEGORY = "Marking"
+
+    def _run(self, args: argparse.Namespace, tag: Tag) -> None:
+        app = self.app
+        app.require_auth()
+        if args.action == "list":
+            nodes = app.marking.list(tag)
+            if args.json:
+                app.poutput(export.to_json([n.as_dict() for n in nodes]))
+            else:
+                app.ui.nodes(nodes, _LABEL[tag])
+            if args.output:
+                self.export(args.output, [n.as_dict() for n in nodes], export.node_rows(nodes))
+            return
+        kind = args.type.capitalize() if args.type else None
+        node = app.entities.resolve(args.name, kind, args.domain)
+        app.remember(node)
+        app.ui.success(app.marking.mark(node, tag, add=args.action == "add"))
+
+    @with_argparser(lambda: _marking_parser("owned"))
+    def do_owned(self, args: argparse.Namespace) -> None:
+        """List, add or remove owned objects."""
+        self._run(args, "owned")
+
+    @with_argparser(lambda: _marking_parser("tier0"))
+    def do_hvt(self, args: argparse.Namespace) -> None:
+        """List, add or remove Tier Zero / high value targets."""
+        self._run(args, "tier0")

bhshell/shell/commands/paths.py

@@ -0,0 +1,166 @@
+"""Attack-path command."""
+
+from __future__ import annotations
+
+import argparse
+import itertools
+from dataclasses import replace
+from pathlib import Path
+
+from cmd2 import Choices, Cmd2ArgumentParser, RawDescriptionCmd2HelpFormatter, with_argparser
+
+from bhshell.errors import BHError
+from bhshell.models.entities import Node
+from bhshell.queries.edges import EDGE_GROUPS
+from bhshell.queries.paths import PathResult, PathService
+from bhshell.queries.service import PATH_KINDS
+from bhshell.render import export, png, svg
+from bhshell.render.views import first_n
+from bhshell.shell.commands.base import BaseCommands, add_output_args
+
+
+def _path_parser() -> Cmd2ArgumentParser:
+    p = Cmd2ArgumentParser(
+        description="Find attack paths.",
+        epilog="path SRC DST              shortest path between two objects\n"
+               "path SRC                  shortest paths from SRC to any Tier Zero object\n"
+               "path SRC [DST] --via X    go through X on the way (repeat --via for more steps, in order)\n"
+               "path --owned [DST]        shortest paths from every owned object to Tier Zero (or to DST)",
+        formatter_class=RawDescriptionCmd2HelpFormatter,
+    )
+    p.add_argument("src", nargs="?", help="source object (user, computer, group, domain, OU, GPO)",
+                   choices_provider=BaseCommands.recent_names)
+    p.add_argument("dst", nargs="?", help="destination object (default: Tier Zero)",
+                   choices_provider=BaseCommands.recent_names)
+    p.add_argument("--via", action="append", default=[], metavar="NAME", choices_provider=BaseCommands.recent_names,
+                   help="intermediate step (repeatable, visited in the order given)")
+    p.add_argument("--owned", action="store_true", help="start from every owned object")
+    p.add_argument("--exclude", action="append", default=[], metavar="EDGE", type=_edge_group,
+                   choices_provider=lambda _self: Choices.from_values(sorted(EDGE_GROUPS)),
+                   help="skip these edges/groups: " + ", ".join(sorted(EDGE_GROUPS)) + " (repeatable)")
+    p.add_argument("-d", "--domain", help="restrict name resolution to a domain")
+    p.add_argument("--include-disabled", action="store_true",
+                   help="allow paths through disabled objects that cannot be re-enabled")
+    p.add_argument("-g", "--graph", action="store_true",
+                   help="draw the paths as a graph (asks which ones when there are several)")
+    p.add_argument("-p", "--pick", type=_selection, metavar="N",
+                   help="only these paths, numbered as in the list: 2, 1,3 or 2-4")
+    p.add_argument("-n", "--max-paths", type=int, default=20, metavar="N", help="paths shown (default 20, 0 = all)")
+    add_output_args(p, formats=(".json", ".csv", ".svg", ".png"))
+    p.add_argument("--svg-layout", choices=("auto", "horizontal", "vertical", "wrapped"), default="auto",
+                   help="SVG/PNG layout (default auto: whichever prints largest on a portrait page; "
+                        "wrapped: rows of hops, like lines of text)")
+    p.add_argument("--png-scale", type=_scale, default=2.0, metavar="N",
+                   help="PNG pixels per SVG pixel (default 2: sharp in print, same size in Word)")
+    return p
+
+
+def _edge_group(text: str) -> frozenset[str]:
+    try:
+        return EDGE_GROUPS[text.lower()]
+    except KeyError:
+        raise argparse.ArgumentTypeError(
+            f"unknown edge group {text!r} (choose from {', '.join(sorted(EDGE_GROUPS))})") from None
+
+
+def _scale(text: str) -> float:
+    try:
+        value = float(text)
+    except ValueError:
+        raise argparse.ArgumentTypeError(f"not a number: {text!r}") from None
+    if not 1 <= value <= 8:
+        raise argparse.ArgumentTypeError("must be between 1 and 8")
+    return value
+
+
+def _selection(text: str) -> list[int]:
+    """Parse `2`, `1,3` or `2-4` into path numbers."""
+    numbers: list[int] = []
+    try:
+        for part in text.replace(" ", "").split(","):
+            first, _, last = part.partition("-")
+            numbers += range(int(first), int(last or first) + 1)
+    except ValueError:
+        raise argparse.ArgumentTypeError(f"not a path selection: {text!r} (use e.g. 2, 1,3 or 2-4)") from None
+    if not numbers or min(numbers) < 1:
+        raise argparse.ArgumentTypeError(f"path numbers start at 1: {text!r}")
+    return list(dict.fromkeys(numbers))
+
+
+def _pick(result: PathResult, numbers: list[int]) -> PathResult:
+    if max(numbers) > len(result.paths):
+        raise BHError(f"There are only {len(result.paths)} path(s); cannot pick {max(numbers)}")
+    picked = [result.paths[n - 1] for n in numbers]
+    note = f"Showing path {', '.join(map(str, numbers))} of {len(result.paths)}."
+    return replace(result, paths=picked, notes=[*result.notes, note], numbers=numbers)
+
+
+class PathCommands(BaseCommands):
+    DEFAULT_CATEGORY = "Analysis"
+
+    @with_argparser(_path_parser)
+    def do_path(self, args: argparse.Namespace) -> None:
+        """Find attack paths between objects or towards Tier Zero."""
+        app = self.app
+        app.require_auth()
+        exclude = frozenset().union(*args.exclude) if args.exclude else frozenset()
+        service = PathService(app.entities, include_disabled=args.include_disabled, exclude=exclude)
+        if args.owned:
+            if args.src or args.via:
+                raise BHError("--owned takes no SRC or --via (an optional DST is allowed)")
+            if args.dst:
+                result = service.owned_to(self._resolve(args.dst, args.domain))
+            else:
+                result = service.owned_to_tier_zero()
+        elif not args.src:
+            raise BHError("Give a SRC object or --owned")
+        else:
+            src = self._resolve(args.src, args.domain)
+            waypoints = [self._resolve(name, args.domain) for name in args.via]
+            dst = self._resolve(args.dst, args.domain) if args.dst else None
+            steps = [src, *waypoints] + ([dst] if dst else [])
+            for a, b in itertools.pairwise(steps):
+                if a.objectid == b.objectid:
+                    raise BHError(f"{a.name} appears twice in a row in the route")
+            if waypoints:
+                result = service.route(src, waypoints, dst)
+            elif dst:
+                result = service.shortest(src, dst)
+            else:
+                result = service.to_tier_zero(src)
+        if args.pick:
+            result = _pick(result, args.pick)
+        elif args.graph and not args.json and len(result.paths) > 1 and app.can_ask():
+            app.ui.paths(result, args.max_paths)
+            shown = len(first_n(result.paths, args.max_paths))
+            answer = app.read_input(f"Path(s) to draw [1-{shown}, e.g. 2, 1,3 or 2-4; Enter = all]: ").strip()
+            if answer:
+                try:
+                    numbers = _selection(answer)
+                except argparse.ArgumentTypeError as exc:
+                    raise BHError(str(exc)) from exc
+                result = _pick(result, numbers)
+        if args.json:
+            app.poutput(export.to_json(result.as_dict()))
+        elif args.graph:
+            app.ui.path_graph(result, args.max_paths)
+        else:
+            app.ui.paths(result, args.max_paths)
+        if args.output and args.output.lower().endswith((".svg", ".png")):
+            shown = first_n(result.paths, args.max_paths)
+            out = Path(args.output).expanduser()
+            document = svg.render(result, shown, args.svg_layout)
+            if out.suffix.lower() == ".png":
+                out.write_bytes(png.from_svg(document, args.png_scale))
+            else:
+                out.write_text(document, encoding="utf-8")
+            app.ui.success(f"Diagram of {len(shown)} path(s) written to {out}")
+        elif args.output:
+            rows = result.rows()
+            fields = ["path", "hop", "source", "edge", "target", "target_kind", "tier_zero"]
+            self.export(args.output, result.as_dict(), (fields, rows))
+
+    def _resolve(self, name: str, domain: str | None) -> Node:
+        node = self.app.entities.resolve(name, domain=domain, kinds=PATH_KINDS)
+        self.app.remember(node)
+        return node

bhshell/shell/commands/search.py

@@ -0,0 +1,125 @@
+"""Attribute search command."""
+
+from __future__ import annotations
+
+import argparse
+import shlex
+
+from cmd2 import (
+    Choices,
+    Cmd2ArgparseError,
+    Cmd2ArgumentParser,
+    RawDescriptionCmd2HelpFormatter,
+    with_argparser,
+)
+
+from bhshell.errors import BHError
+from bhshell.models.entities import PRIMARY_KINDS
+from bhshell.queries.search import (
+    COMMON_PROPS,
+    SearchOptions,
+    SearchService,
+    parse_filter,
+)
+from bhshell.render import export
+from bhshell.shell.commands.base import BaseCommands, add_output_args
+
+_KINDS = {k.lower(): k for k in PRIMARY_KINDS}
+
+
+def _kind(value: str) -> str:
+    try:
+        return _KINDS[value.lower()]
+    except KeyError:
+        raise argparse.ArgumentTypeError(f"unknown type '{value}' (one of: {', '.join(PRIMARY_KINDS)})") from None
+
+
+def _filter_names() -> list[str]:
+    return [*COMMON_PROPS, *(f"!{p}" for p in COMMON_PROPS)]
+
+
+def _search_parser() -> Cmd2ArgumentParser:
+    p = Cmd2ArgumentParser(
+        description="List objects whose properties match every FILTER.",
+        epilog="Filters (ANDed):\n"
+               "  ATTR                 true            hasspn\n"
+               "  !ATTR                false or unset  !enabled\n"
+               "  ATTR=VALUE           equals          samaccountname=svc_sql\n"
+               "  ATTR!=VALUE          differs\n"
+               "  ATTR~TEXT            contains        description~pass\n"
+               "  ATTR!~TEXT           doesn't contain\n"
+               "  ATTR<VALUE  > <= >=  compare         pwdlastset<2020-01-01  lastlogontimestamp<90d\n\n"
+               "Text matching ignores case; '*' at either end of a value is a wildcard (name=svc_*).\n"
+               "VALUE can be true/false, null (unset), a number, a date (YYYY-MM-DD) or an age (90d =\n"
+               "90 days ago). Quote filters containing spaces: 'description~service account'.\n\n"
+               "Examples:\n"
+               "  search -t user hasspn enabled\n"
+               "  search -t computer operatingsystem~2012 -d CORP\n"
+               "  search -t user pwdneverexpires 'pwdlastset<5000d' -c lastlogon -o old.csv",
+        formatter_class=RawDescriptionCmd2HelpFormatter,
+    )
+    p.add_argument("filters", nargs="*", metavar="FILTER", help="property filter (see below)",
+                   choices_provider=lambda _self: Choices.from_values(_filter_names()))
+    p.add_argument("-t", "--type", type=_kind, metavar="TYPE",
+                   choices_provider=lambda _self: Choices.from_values(PRIMARY_KINDS),
+                   help="object type (User, Computer, Group, OU, GPO, ...; default: any)")
+    p.add_argument("-d", "--domain", help="restrict to a domain (FQDN or NetBIOS)")
+    p.add_argument("-c", "--columns", action="append", default=[], metavar="ATTR[,ATTR...]",
+                   help="extra properties to show (filtered properties are always shown)")
+    p.add_argument("-l", "--limit", type=int, metavar="N", help="max results fetched (default: config max_results)")
+    p.add_argument("-n", "--max-rows", type=int, metavar="N",
+                   help="max table rows shown (default: config display_rows; 0 = all)")
+    add_output_args(p)
+    return p
+
+
+def _uncut(args: argparse.Namespace) -> argparse.Namespace:
+    """Re-read the arguments when cmd2 cut them at '>', '|' or ';'.
+
+    Redirection is disabled, but cmd2 still ends the argument list at those characters, which would
+    silently drop the rest of `lastlogon>=90d enabled`.
+    """
+    stmt = args.cmd2_statement
+    if not (stmt.redirector or stmt.terminator):
+        return args
+    try:
+        return _search_parser().parse_args(shlex.split(stmt.raw.split(None, 1)[1]))
+    except ValueError as exc:
+        raise BHError(f"Cannot parse arguments: {exc}") from exc
+    except SystemExit as exc:  # usage error: argparse already printed it
+        raise Cmd2ArgparseError from exc
+
+
+class SearchCommands(BaseCommands):
+    DEFAULT_CATEGORY = "Entities"
+
+    @with_argparser(_search_parser)
+    def do_search(self, args: argparse.Namespace) -> None:
+        """List objects matching property filters (e.g. 'search -t user hasspn enabled')."""
+        app = self.app
+        args = _uncut(args)
+        if not (args.filters or args.type or args.domain):
+            raise BHError("Give at least one FILTER, -t TYPE or -d DOMAIN (see 'help search')")
+        if args.limit is not None and args.limit < 1:
+            raise BHError("--limit must be at least 1")
+        opts = SearchOptions(filters=[parse_filter(f) for f in args.filters], kind=args.type,
+                             domain=args.domain or "", limit=args.limit or app.config.max_results)
+        columns = [c.strip() for spec in args.columns for c in spec.split(",") if c.strip()]
+        app.require_auth()
+        result = SearchService(app.entities).search(opts, columns)
+        for node in result.nodes:
+            app.remember(node)
+
+        if args.json:
+            app.poutput(export.to_json(result.as_dict()))
+        else:
+            notes = [f"Filters: {' AND '.join(args.filters)}"] if args.filters else []
+            if result.truncated:
+                total = f" of {result.total:,}" if result.total is not None else ""
+                notes.append(f"Only the first {opts.limit:,}{total} results were fetched (raise --limit).")
+            app.ui.table(f"Search: {opts.kind or 'any type'}", result.columns, result.rows(),
+                         max_rows=self.max_rows(args), notes=notes)
+        if args.output:
+            fields = [c.attr for c in result.columns]
+            fields.insert(3, "objectid")
+            self.export(args.output, result.as_dict(), (fields, result.rows()))

bhshell-0.1.0.dist-info/METADATA

@@ -0,0 +1,134 @@
+Metadata-Version: 2.4
+Name: bhshell
+Version: 0.1.0
+Summary: Interactive shell for BloodHound
+Author-email: kr0no <kr0no@ka0labs.net>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/kr0no/bloodhound-shell
+Project-URL: Issues, https://github.com/kr0no/bloodhound-shell/issues
+Project-URL: Author, https://kr0no.me
+Keywords: bloodhound,bloodhound-ce,active-directory,attack-paths,cypher,pentest,red-team,security,cli,shell
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cmd2<5,>=4.3
+Requires-Dist: rich>=13.0
+Requires-Dist: requests>=2.31
+Requires-Dist: resvg-py>=0.5
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: responses>=0.25; extra == "dev"
+Dynamic: license-file
+
+# bhshell
+
+[![PyPI version](https://img.shields.io/pypi/v/bhshell.svg)](https://pypi.org/project/bhshell/)
+[![Python versions](https://img.shields.io/pypi/pyversions/bhshell.svg)](https://pypi.org/project/bhshell/)
+[![CI](https://github.com/kr0no/bloodhound-shell/actions/workflows/ci.yml/badge.svg)](https://github.com/kr0no/bloodhound-shell/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/kr0no/bloodhound-shell/blob/main/LICENSE)
+
+An interactive command-line shell for BloodHound. Look up Active Directory objects,
+hunt for weaknesses and find attack paths from the terminal, without opening the web UI.
+
+## Installation
+
+Requires Python 3.11+ and a BloodHound CE v9 server (tested on v9.7.1).
+
+```bash
+pipx install bhshell     # recommended
+# or
+pip install bhshell
+```
+
+## Quick Start
+
+```console
+$ bhshell --url http://127.0.0.1:8080
+
+[bh: shell] > login -u admin
+[+] Logged in as admin on 127.0.0.1:8080
+
+[bh: shell] > hunt
+  Severity   Check            Count   Example              Description
+  critical   dcsync           2       SVC_SQL@CORP.LOCAL   Non-Tier-Zero principals with replication rights
+  high       kerberoastable   2       JDOE@CORP.LOCAL      Kerberoastable users
+  ...
+[*] Details: 'hunt CHECK' (e.g. 'hunt kerberoastable'), or 'hunt --all'.
+
+[bh: shell] > user CORP\svc_sql --all -o svc_sql.csv
+
+[bh: shell] > path --owned -g
+```
+
+The same commands run non-interactively for scripting: `bhshell -c "hunt --json" > hunt.json`.
+
+## What it does
+
+| Command | Shows |
+|---|---|
+| `user`, `computer`, `group`, `lookup` | Kerberoastable / AS-REP roastable, delegation, password age, Tier Zero and owned flags, plus group nesting, inbound/outbound ACL control, sessions and local admin rights |
+| `search` | Objects matching property filters (`search -t user hasspn enabled`), with dates, ages (`90d`) and wildcards |
+| `path` | Shortest paths to a target or to Tier Zero, from everything owned, or through `--via` steps; printed as hop chains, a terminal graph, or SVG/PNG for reports |
+| `hunt` | Domain-wide checks by severity: DCSync, control of Tier Zero, AD CS (ESC*), Kerberoasting, privileged sessions, LAPS/gMSA readers, passwords in attributes, takeover primitives (Shadow Credentials, RBCD), GPO control, NTLM relay, trusts, possible honeytokens...; `hunt --owned` limits them to what your owned objects can do |
+| `cypher`, `query` | Raw Cypher, and a library of saved queries: bundled, your own `.cyp` files (`~/.bhshell/queries/` or any folder set with `config query_dirs`) and those saved on the server |
+| `owned`, `hvt` | Mark or unmark owned and Tier Zero objects |
+| `domains`, `trusts` | Per-domain counts, and the trust map with SID filtering status |
+
+To add your own query, save it as a `.cyp` file in `~/.bhshell/queries/` and run it by name:
+
+```console
+$ cat ~/.bhshell/queries/stale-admins.cyp
+// description: Enabled adminCount users who have not logged on for a year
+MATCH (u:User) WHERE u.admincount = true AND u.enabled = true
+  AND u.lastlogontimestamp < (datetime().epochseconds - 31536000) RETURN u
+
+[bh: shell] > query run stale-admins -o stale-admins.csv
+```
+
+See [Query library](https://github.com/kr0no/bloodhound-shell/blob/main/docs/USAGE.md#query-library) for the format and for
+keeping queries in other folders (a team repository, one folder per engagement).
+
+Most commands take `--json` and `-o FILE` (JSON or CSV). Login works with a password (plus MFA) or
+an API token; secrets are prompted for or read from the environment, never passed as arguments.
+
+## Documentation
+
+The full usage guide (every command, view flag, search filter, path option, hunt check and
+configuration setting) is in [docs/USAGE.md](https://github.com/kr0no/bloodhound-shell/blob/main/docs/USAGE.md).
+Inside the shell, run `help` or `help <command>`.
+
+## Contributing
+
+Bug reports and pull requests are welcome at
+[github.com/kr0no/bloodhound-shell/issues](https://github.com/kr0no/bloodhound-shell/issues).
+
+```bash
+git clone https://github.com/kr0no/bloodhound-shell.git
+cd bloodhound-shell
+python3 -m venv .venv && . .venv/bin/activate
+pip install -e '.[dev]'
+python -m pytest
+```
+
+The tests mock the BloodHound API with `responses`, so no BloodHound server is needed.
+
+## License
+
+Distributed under the MIT License. See
+[LICENSE](https://github.com/kr0no/bloodhound-shell/blob/main/LICENSE) for details.
+
+BloodHound is a trademark of SpecterOps. bhshell is an independent project and is not affiliated
+with or endorsed by SpecterOps.

bhshell-0.1.0.dist-info/RECORD

@@ -0,0 +1,59 @@
+bhshell/__init__.py,sha256=n8SMTm85bIm5dpDJikW_zJjQZPgMT4FcZ-GmvKO48tA,76
+bhshell/__main__.py,sha256=zu6PVRedmvjjW2Sw8F-W3cMXcD6G5_trj8p4GdVkPRI,55
+bhshell/cli.py,sha256=Hjy5c0bc7ntBteP2q_SK5FnOm1-vjqDx_86P00YOAMA,2123
+bhshell/config.py,sha256=qXOeWgTerpgZAK0spewO57qJn3fqkeOPF3XySp7ROO4,5121
+bhshell/errors.py,sha256=ZAYQp51ERF9VN47obi43OGVrizLiHXRerFZFwwYrDvg,1847
+bhshell/client/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+bhshell/client/auth.py,sha256=w2o-u7CYCfgJF1uKOv6l6fJK4rwhS4m1pzC-_jz_q-g,2503
+bhshell/client/client.py,sha256=s5R5lgwl25AdHE8-9zbmXikzWQriOdlCq8QL7TIYc8w,12543
+bhshell/library/asrep-roastable-users.cyp,sha256=Iee5Ll4mMBTx_5OEx3eeNAlEWOghziQo-g5Y7fiSff0,172
+bhshell/library/dcsync-principals.cyp,sha256=HsNxJ71svTZTdwvgtYMPyqDEfxkQxWbjNwnEE8GcW-M,173
+bhshell/library/domain-admins-members.cyp,sha256=zz10dAxSza6ZNQLSz06OEkVRoYIU_V3KLu6AtGsPtbw,189
+bhshell/library/domain-trusts.cyp,sha256=BUE17dPNPnEE4-uoVEzeq60j-F_Sz1s9MnJdalDVHKY,140
+bhshell/library/gpos-linked-to-domain-controllers.cyp,sha256=vFhfVW06oOV2Z2K4jm40JHMKKlEgBy3hoTskUHMr4fs,216
+bhshell/library/kerberoastable-users.cyp,sha256=pi66OnFXQCR_JXjbJV_cZUvbXQk4ZHl0SiOIRd86rr0,156
+bhshell/library/owned-objects.cyp,sha256=y13goTwj7NCNHP9pBZup_Dc8zvrNEiywNEwTWYJkczg,92
+bhshell/library/owned-to-tier-zero.cyp,sha256=nEHSLzU1WRVKifbP1LkL82uJM00fy-Px8I1lL5iJ_OY,227
+bhshell/library/sid-history.cyp,sha256=rZCgg6Lz-thCU_p7On1kJFanM91uc7A59IXCr81MaSo,147
+bhshell/library/tier-zero-users.cyp,sha256=-ISf4QzQ4v-RtHyr2A66lTOCksvKgGhDWTnYpuoJihM,133
+bhshell/library/unconstrained-delegation.cyp,sha256=6BFxFRHoJ57pHqDcjsLwdzWfUQnCcUPNekIndXPuI28,199
+bhshell/models/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+bhshell/models/entities.py,sha256=VqlC-wPJ_mTdTKwRS1WEr11RBNkTYKc7aaJzWxTPRUA,15155
+bhshell/models/results.py,sha256=ea9HiAKVuyMI7JVQzjDmoEtLDUIs4HfmpFf5dIh3kv0,2159
+bhshell/queries/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+bhshell/queries/cypher.py,sha256=97G_ynpiAtYb_Kf3IAsV7hcnf1KXOIMso-A7lQMb7Ow,5420
+bhshell/queries/domains.py,sha256=Ob6FGCPIAVfFiuQtytD0xN_ipPjuVvjIHrsrTO7p8AU,5572
+bhshell/queries/edges.py,sha256=5Iexg7VS_RYvsYXMb7quznbGed4FjQGMY9o4pyLp9v4,4687
+bhshell/queries/hunt.py,sha256=xkPi499zV6HzaTQotUvMrGILyQCEzsK7lbFO54zp9mc,35125
+bhshell/queries/library.py,sha256=4zfvI3CxG90_HeDSiR36gASLAfpy3bSEE516GLTo--Q,3732
+bhshell/queries/marking.py,sha256=iL17u8sVl5q_-y21D0vafkq89pWqw9cObjw_5jkOOnc,5849
+bhshell/queries/paths.py,sha256=dI83FisHXN9Zh0UdyzmormNML9W3ocoLvp7rwMHpki0,18762
+bhshell/queries/search.py,sha256=BKgINanmdsp-62fdrgeRoP9VF-na7W69Cg2GJAso5Ww,8609
+bhshell/queries/service.py,sha256=tdSTxv1CUKVmbvggYgXqb6fp0nfoIOnyq8O5Ow--qCE,24560
+bhshell/render/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+bhshell/render/export.py,sha256=y7jtGMF9hVEGXMMRr059e14R_uRFGQttYQHCeFJPzeo,2911
+bhshell/render/graph.py,sha256=Hk950xYCqWhgoJSLhic9vkLT3ILKmSQvtqxJB4MOHes,14728
+bhshell/render/layout.py,sha256=UV-FF421SxnnTvhc755utRgZozJ_JHhN4De__eRoT2A,5763
+bhshell/render/png.py,sha256=iJnkKzY_03LGhlL072rzC_amfMJcQyOuNxx2uJfLD-8,1544
+bhshell/render/styles.py,sha256=cdxIDXjx9PvqlhyJgMaobLrdhU-_l5PmbKxsmsR3Plk,348
+bhshell/render/svg.py,sha256=7KiXEQcb3tdfkXUdRzyHF40jJeFVwyO36k6JM31Mris,24560
+bhshell/render/views.py,sha256=DkrcKlKwr1W-PUAuOMnNB-hw1AGK8rc0yNvvhyMI-Kw,15254
+bhshell/shell/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+bhshell/shell/app.py,sha256=q6j5LVLsaGIE3V18pDkkx30OO_Ar6W41jkskInhtkRI,7734
+bhshell/shell/commands/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+bhshell/shell/commands/base.py,sha256=kDe-betW_HlyTjDeO1E7BS5J3efI7zKSKy4LcuvErks,2339
+bhshell/shell/commands/connection.py,sha256=2ScEPftqtBAG7bKFJ2Dl7KdvOx6PB6THYVIoHeguhhk,9802
+bhshell/shell/commands/cypher.py,sha256=qub9u7jgP8nXz_JMmpijU1o0JPEGTWRsSj6yaiZ_G18,3266
+bhshell/shell/commands/domains.py,sha256=HvCRbJc8XihzqIgiBQFTI73jcS6qjEK8okUM2Lc-xy0,3335
+bhshell/shell/commands/entities.py,sha256=l6FBMYJky31NI0DYYE3zSLUeqDtXWprE6qsSN_R8iOY,4088
+bhshell/shell/commands/hunt.py,sha256=mbW9OTYOCyM4UI9Y9UfBJJJ3Gjgeraup7je0xotKwJI,6891
+bhshell/shell/commands/library.py,sha256=SR9UwFc0FRENLTpkoMXYAhoPEWGuSvQmoZlKrUBrNOY,2455
+bhshell/shell/commands/marking.py,sha256=re0an3vMhLrq89_Sj0CFwKlvx7f2pb-2Ox40YfV18Ks,2414
+bhshell/shell/commands/paths.py,sha256=oqdaR1VxQWAzBaWlrmtxHehpbE2UECgtpcQF3GBGahg,8211
+bhshell/shell/commands/search.py,sha256=Mmaf6ekSOKszxw3hUeLI1v5IC89O3GMJqWqmCXGYGoM,5680
+bhshell-0.1.0.dist-info/licenses/LICENSE,sha256=C-WjLV0cwkkudk4FX4LGQqaiRtlt442o8gRVlCsdANA,1062
+bhshell-0.1.0.dist-info/METADATA,sha256=Q5b4SSVftYbVI2k_WIyo-LR30JVzIov7pOr367lPeH4,5942
+bhshell-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+bhshell-0.1.0.dist-info/entry_points.txt,sha256=E9K8CHFYC7Kbbt-QESeY5S2LsWXxbLXthz0REEFK9nY,45
+bhshell-0.1.0.dist-info/top_level.txt,sha256=Ajj2nWqEd-LNnHF6KFuzwwmXq76LZuRFdzRaTqb9rg0,8
+bhshell-0.1.0.dist-info/RECORD,,

bhshell-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

bhshell-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+bhshell = bhshell.cli:main

bhshell-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 kr0no
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

bhshell-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+bhshell