bhshell 0.1.0__tar.gz → 0.1.1__tar.gz

{bhshell-0.1.0/bhshell.egg-info → bhshell-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bhshell
-Version: 0.1.0
+Version: 0.1.1
 Summary: Interactive shell for BloodHound
 Author-email: kr0no <kr0no@ka0labs.net>
 License-Expression: MIT
@@ -35,8 +35,8 @@ Dynamic: license-file
 
 # bhshell
 
-[![PyPI version](https://img.shields.io/pypi/v/bhshell.svg)](https://pypi.org/project/bhshell/)
-[![Python versions](https://img.shields.io/pypi/pyversions/bhshell.svg)](https://pypi.org/project/bhshell/)
+![PyPI Status](https://img.shields.io/pypi/status/bhshell)
+[![PyPI version](https://img.shields.io/pypi/v/bhshell)](https://pypi.org/project/bhshell/)
 [![CI](https://github.com/kr0no/bloodhound-shell/actions/workflows/ci.yml/badge.svg)](https://github.com/kr0no/bloodhound-shell/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/kr0no/bloodhound-shell/blob/main/LICENSE)
 
@@ -70,6 +70,10 @@ $ bhshell --url http://127.0.0.1:8080
 
 [bh: shell] > user CORP\svc_sql --all -o svc_sql.csv
 
+[bh: shell] > ou corp.local -t
+
+[bh: shell] > computer WEB01 -G
+
 [bh: shell] > path --owned -g
 ```
 
@@ -80,6 +84,7 @@ The same commands run non-interactively for scripting: `bhshell -c "hunt --json"
 | Command | Shows |
 |---|---|
 | `user`, `computer`, `group`, `lookup` | Kerberoastable / AS-REP roastable, delegation, password age, Tier Zero and owned flags, plus group nesting, inbound/outbound ACL control, sessions and local admin rights |
+| `ou` | OUs, containers and whole domains: the OU tree with object, Tier Zero and owned counts, every object below an OU, the GPOs that apply (enforced links, blocked inheritance) and who outside Tier Zero can edit them, and who controls the OU; `user`/`computer -G` shows the GPOs applied to one object. Same-named OUs are picked by distinguished name |
 | `search` | Objects matching property filters (`search -t user hasspn enabled`), with dates, ages (`90d`) and wildcards |
 | `path` | Shortest paths to a target or to Tier Zero, from everything owned, or through `--via` steps; printed as hop chains, a terminal graph, or SVG/PNG for reports |
 | `hunt` | Domain-wide checks by severity: DCSync, control of Tier Zero, AD CS (ESC*), Kerberoasting, privileged sessions, LAPS/gMSA readers, passwords in attributes, takeover primitives (Shadow Credentials, RBCD), GPO control, NTLM relay, trusts, possible honeytokens...; `hunt --owned` limits them to what your owned objects can do |

{bhshell-0.1.0 → bhshell-0.1.1}/README.md

@@ -1,7 +1,7 @@
 # bhshell
 
-[![PyPI version](https://img.shields.io/pypi/v/bhshell.svg)](https://pypi.org/project/bhshell/)
-[![Python versions](https://img.shields.io/pypi/pyversions/bhshell.svg)](https://pypi.org/project/bhshell/)
+![PyPI Status](https://img.shields.io/pypi/status/bhshell)
+[![PyPI version](https://img.shields.io/pypi/v/bhshell)](https://pypi.org/project/bhshell/)
 [![CI](https://github.com/kr0no/bloodhound-shell/actions/workflows/ci.yml/badge.svg)](https://github.com/kr0no/bloodhound-shell/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/kr0no/bloodhound-shell/blob/main/LICENSE)
 
@@ -35,6 +35,10 @@ $ bhshell --url http://127.0.0.1:8080
 
 [bh: shell] > user CORP\svc_sql --all -o svc_sql.csv
 
+[bh: shell] > ou corp.local -t
+
+[bh: shell] > computer WEB01 -G
+
 [bh: shell] > path --owned -g
 ```
 
@@ -45,6 +49,7 @@ The same commands run non-interactively for scripting: `bhshell -c "hunt --json"
 | Command | Shows |
 |---|---|
 | `user`, `computer`, `group`, `lookup` | Kerberoastable / AS-REP roastable, delegation, password age, Tier Zero and owned flags, plus group nesting, inbound/outbound ACL control, sessions and local admin rights |
+| `ou` | OUs, containers and whole domains: the OU tree with object, Tier Zero and owned counts, every object below an OU, the GPOs that apply (enforced links, blocked inheritance) and who outside Tier Zero can edit them, and who controls the OU; `user`/`computer -G` shows the GPOs applied to one object. Same-named OUs are picked by distinguished name |
 | `search` | Objects matching property filters (`search -t user hasspn enabled`), with dates, ages (`90d`) and wildcards |
 | `path` | Shortest paths to a target or to Tier Zero, from everything owned, or through `--via` steps; printed as hop chains, a terminal graph, or SVG/PNG for reports |
 | `hunt` | Domain-wide checks by severity: DCSync, control of Tier Zero, AD CS (ESC*), Kerberoasting, privileged sessions, LAPS/gMSA readers, passwords in attributes, takeover primitives (Shadow Credentials, RBCD), GPO control, NTLM relay, trusts, possible honeytokens...; `hunt --owned` limits them to what your owned objects can do |

{bhshell-0.1.0 → bhshell-0.1.1}/bhshell/__init__.py

@@ -1,3 +1,3 @@
 """bhshell - an interactive shell for BloodHound."""
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"

{bhshell-0.1.0 → bhshell-0.1.1}/bhshell/client/client.py

@@ -314,6 +314,12 @@ class BHClient:
         data = resp.get("data") or {}
         return data.get("props") or data
 
+    def entity_counts(self, kind: str, objectid: str) -> dict[str, int]:
+        """Related-object counts the entity endpoint reports (`users`, `computers`, `gpos`, ...)."""
+        resp = self.get(f"api/v2/{_collection(kind)}/{objectid}", counts="true") or {}
+        data = resp.get("data") or {}
+        return {k: v for k, v in data.items() if isinstance(v, int) and not isinstance(v, bool)}
+
     def entity_related(
         self, kind: str, objectid: str, relation: str, *, limit: int | None = None
     ) -> list[dict[str, Any]]:

{bhshell-0.1.0 → bhshell-0.1.1}/bhshell/errors.py

@@ -67,7 +67,7 @@ class UnsupportedFeature(BHError):
 class AmbiguousMatchError(BHError):
     hint = "Qualify the name: 'jdoe@corp.local', 'CORP\\jdoe', '--domain CORP.LOCAL' or use the SID."
 
-    def __init__(self, query: str, candidates: Sequence[Node]) -> None:
-        super().__init__(f"'{query}' matches {len(candidates)} objects")
+    def __init__(self, query: str, candidates: Sequence[Node], *, hint: str = "") -> None:
+        super().__init__(f"'{query}' matches {len(candidates)} objects", hint=hint)
         self.query = query
         self.candidates = list(candidates)

{bhshell-0.1.0 → bhshell-0.1.1}/bhshell/models/entities.py

@@ -318,16 +318,21 @@ class ADObject:
 
     @staticmethod
     def wrap(node: Node) -> ADObject:
-        cls = {"User": User, "Computer": Computer, "Group": Group}.get(node.kind, ADObject)
-        return cls(node)
+        kinds = {"User": User, "Computer": Computer, "Group": Group,
+                 "OU": DirectoryContainer, "Container": DirectoryContainer, "Domain": DirectoryContainer}
+        return kinds.get(node.kind, ADObject)(node)
 
     def _common_head(self) -> list[SummaryField]:
-        return [
+        oid = "Object ID (GUID)" if self.node.kind in ("OU", "Container", "GPO") else "Object ID (SID)"
+        fields = [
             SummaryField("Name", self.node.name),
             SummaryField("Type", self.node.kind),
-            SummaryField("Object ID (SID)", self.node.objectid),
+            SummaryField(oid, self.node.objectid),
             SummaryField("Domain", self.node.domain),
         ]
+        if self.props.get("distinguishedname"):
+            fields.append(SummaryField("Distinguished Name", self.props["distinguishedname"]))
+        return fields
 
     def _common_tail(self) -> list[SummaryField]:
         return [
@@ -400,3 +405,19 @@ class Group(ADObject):
             SummaryField("AdminCount", admincount, "bool", _risk_if(admincount, "medium")),
             *self._common_tail(),
         ]
+
+
+class DirectoryContainer(ADObject):
+    """An OU, a container or a domain: the nodes of the directory tree."""
+
+    def summary(self) -> list[SummaryField]:
+        p = self.props
+        fields = self._common_head()
+        if self.node.kind == "Domain":
+            fields.append(SummaryField("Functional Level", p.get("functionallevel") or ""))
+        if self.node.kind == "OU":
+            blocks = opt_bool(p, "blocksinheritance")
+            fields.append(SummaryField("Blocks GPO Inheritance", blocks, "bool", _risk_if(blocks, "info")))
+        if p.get("whencreated"):
+            fields.append(SummaryField("Created", p["whencreated"], "date"))
+        return [*fields, *self._common_tail()]

bhshell-0.1.1/bhshell/models/results.py

@@ -0,0 +1,180 @@
+"""Result containers returned by the query layer and consumed by renderers/exporters."""
+
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass, field
+from typing import Any, Literal
+
+from bhshell.models.entities import ADObject, Node, SummaryField
+
+Backend = Literal["cypher", "rest"]
+
+
+class Row:
+    """A view row (a dataclass): `as_dict` is what is exported, `as_display` what the table shows."""
+
+    def as_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+    def as_display(self) -> dict[str, Any]:
+        return self.as_dict()
+
+
+@dataclass
+class RelationshipRow(Row):
+    """One relationship in a view.
+
+    Not every view fills every field; `Column` definitions on the
+    owning `ViewResult` select which ones are displayed.
+    """
+
+    principal: str = ""
+    principal_kind: str = ""
+    edge: str = ""
+    target: str = ""
+    target_kind: str = ""
+    via: str = ""
+    depth: int | None = None
+    tier_zero: bool = False
+    owned: bool = False
+    objectid: str = ""
+
+
+def _with_enabled(total: int, enabled: int) -> str:
+    return f"{total} ({enabled})" if total else "0"
+
+
+@dataclass
+class ContainerRow(Row):
+    """One OU or container of a `tree` view; the counts cover everything below it."""
+
+    name: str
+    kind: str
+    depth: int
+    # The name indented under its parent, for display.
+    label: str = ""
+    users: int | None = None
+    enabled_users: int | None = None
+    computers: int | None = None
+    enabled_computers: int | None = None
+    groups: int | None = None
+    tier_zero_below: int | None = None
+    owned_below: int | None = None
+    gpo_links: int = 0
+    blocks_inheritance: bool | None = None
+    tier_zero: bool = False
+    owned: bool = False
+    distinguishedname: str = ""
+    objectid: str = ""
+
+    def as_dict(self) -> dict[str, Any]:
+        return {k: v for k, v in asdict(self).items() if k != "label"}
+
+    def as_display(self) -> dict[str, Any]:
+        out = asdict(self)
+        for key in ("users", "computers"):
+            total, enabled = out[key], out[f"enabled_{key}"]
+            out[key] = None if total is None else _with_enabled(total, enabled or 0)
+        return out
+
+
+@dataclass
+class ContainedRow(Row):
+    """An object below an OU or container (`contents` view)."""
+
+    name: str
+    kind: str
+    enabled: bool | None = None
+    # Containers between the explored one and the object ("direct" when it is a direct child).
+    location: str = ""
+    depth: int = 1
+    tier_zero: bool = False
+    owned: bool = False
+    distinguishedname: str = ""
+    objectid: str = ""
+
+
+@dataclass
+class GPOLinkRow(Row):
+    """A GPO linked to the object or to a container above it (`gpos` view)."""
+
+    gpo: str
+    linked_to: str
+    linked_kind: str
+    enforced: bool | None = None
+    # `None` when unknown (REST fallback).
+    applies: bool | None = True
+    # Why it does not apply ("inheritance blocked at X"), why the link adds nothing ("duplicate: ..."), or ''.
+    reason: str = ""
+    # Principals outside Tier Zero that can edit the GPO.
+    editable_by: list[str] = field(default_factory=list)
+    tier_zero: bool = False
+    owned: bool = False
+    objectid: str = ""
+
+    def as_display(self) -> dict[str, Any]:
+        out = asdict(self)
+        if self.applies is None:
+            out["applies"] = None
+        else:
+            out["applies"] = ("yes" if self.applies else "no") + (f" ({self.reason})" if self.reason else "")
+        shown = self.editable_by[:3]
+        if len(self.editable_by) > len(shown):
+            shown = [*shown, f"+{len(self.editable_by) - len(shown)} more"]
+        out["editable_by"] = shown
+        return out
+
+
+@dataclass(frozen=True)
+class Column:
+    """A table column: `attr` is a row key; `fmt` picks the cell formatting (see `Renderer.fmt_value`)."""
+
+    header: str
+    attr: str
+    fmt: str = ""
+
+
+@dataclass
+class ViewResult:
+    """The outcome of one relationship view (groups, outbound, ...)."""
+
+    key: str
+    title: str
+    columns: list[Column]
+    rows: list[Any] = field(default_factory=list)  # `Row`s; `RelationshipRow`s for relationship views
+    backend: Backend = "cypher"
+    notes: list[str] = field(default_factory=list)
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "view": self.key,
+            "title": self.title,
+            "backend": self.backend,
+            "notes": self.notes,
+            "rows": [r.as_dict() for r in self.rows],
+        }
+
+
+@dataclass
+class EntityReport:
+    """A summary and/or a set of relationship views for one entity."""
+
+    node: Node
+    show_summary: bool = True
+    views: list[ViewResult] = field(default_factory=list)
+    # Summary fields computed by queries (OU contents, linked GPOs, ...), shown after the node's own.
+    extra: list[SummaryField] = field(default_factory=list)
+
+    @property
+    def entity(self) -> ADObject:
+        return ADObject.wrap(self.node)
+
+    def summary(self) -> list[SummaryField]:
+        return [*self.entity.summary(), *self.extra]
+
+    def as_dict(self) -> dict[str, Any]:
+        out: dict[str, Any] = {"entity": self.node.as_dict()}
+        if self.show_summary:
+            out["summary"] = {f.label: f.value for f in self.summary()}
+        out["views"] = {v.key: v.as_dict() for v in self.views}
+        return out