bhshell 0.1.0__tar.gz → 0.2.0__tar.gz

{bhshell-0.1.0/bhshell.egg-info → bhshell-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bhshell
-Version: 0.1.0
+Version: 0.2.0
 Summary: Interactive shell for BloodHound
 Author-email: kr0no <kr0no@ka0labs.net>
 License-Expression: MIT
@@ -35,8 +35,8 @@ Dynamic: license-file
 
 # bhshell
 
-[![PyPI version](https://img.shields.io/pypi/v/bhshell.svg)](https://pypi.org/project/bhshell/)
-[![Python versions](https://img.shields.io/pypi/pyversions/bhshell.svg)](https://pypi.org/project/bhshell/)
+![PyPI Status](https://img.shields.io/pypi/status/bhshell)
+[![PyPI version](https://img.shields.io/pypi/v/bhshell)](https://pypi.org/project/bhshell/)
 [![CI](https://github.com/kr0no/bloodhound-shell/actions/workflows/ci.yml/badge.svg)](https://github.com/kr0no/bloodhound-shell/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/kr0no/bloodhound-shell/blob/main/LICENSE)
 
@@ -62,13 +62,20 @@ $ bhshell --url http://127.0.0.1:8080
 [+] Logged in as admin on 127.0.0.1:8080
 
 [bh: shell] > hunt
-  Severity   Check            Count   Example              Description
-  critical   dcsync           2       SVC_SQL@CORP.LOCAL   Non-Tier-Zero principals with replication rights
-  high       kerberoastable   2       JDOE@CORP.LOCAL      Kerberoastable users
+  Severity   Check            Count   Example                      Description
+  critical   dcsync           4       DCSYNCERS@PHANTOM.CORP       Non-Tier-Zero principals with replication rights
+  critical   adcs             95      ALICE@PHANTOM.CORP           AD CS escalation paths (ESC*, GoldenCert)
+  high       kerberoastable   2       ADMINISTRATOR@PHANTOM.CORP   Kerberoastable users
   ...
-[*] Details: 'hunt CHECK' (e.g. 'hunt kerberoastable'), or 'hunt --all'.
+[*] Details: 'hunt CHECK' (e.g. 'hunt dcsync'), or 'hunt --all'.
 
-[bh: shell] > user CORP\svc_sql --all -o svc_sql.csv
+[bh: shell] > user PHANTOM\svc_kerb_del --all -o svc_kerb_del.csv
+
+[bh: shell] > ou phantom.corp -t
+
+[bh: shell] > computer DF-MS-SHS -G
+
+[bh: shell] > gpo 'ENABLE AV@phantom.corp' -c
 
 [bh: shell] > path --owned -g
 ```
@@ -80,6 +87,9 @@ The same commands run non-interactively for scripting: `bhshell -c "hunt --json"
 | Command | Shows |
 |---|---|
 | `user`, `computer`, `group`, `lookup` | Kerberoastable / AS-REP roastable, delegation, password age, Tier Zero and owned flags, plus group nesting, inbound/outbound ACL control, sessions and local admin rights |
+| `ou` | OUs, containers and whole domains: the OU tree with object, Tier Zero and owned counts, every object below an OU, the GPOs that apply (enforced links, blocked inheritance) and who outside Tier Zero can edit them, and who controls the OU; `user`/`computer -G` shows the GPOs applied to one object. Same-named OUs are picked by distinguished name |
+| `gpo` | Where a GPO is linked, the users and computers it applies to (blocked inheritance and enforced links taken into account) and who outside Tier Zero can edit it |
+| `ca`, `template` | Enterprise CAs and certificate templates: the ESC conditions a template meets (ESC2 and ESC15 included, which BloodHound has no edge for), the CA's host and settings (ESC6, ESC8), and who can enroll, manage (ESC7) or rewrite them (ESC4) |
 | `search` | Objects matching property filters (`search -t user hasspn enabled`), with dates, ages (`90d`) and wildcards |
 | `path` | Shortest paths to a target or to Tier Zero, from everything owned, or through `--via` steps; printed as hop chains, a terminal graph, or SVG/PNG for reports |
 | `hunt` | Domain-wide checks by severity: DCSync, control of Tier Zero, AD CS (ESC*), Kerberoasting, privileged sessions, LAPS/gMSA readers, passwords in attributes, takeover primitives (Shadow Credentials, RBCD), GPO control, NTLM relay, trusts, possible honeytokens...; `hunt --owned` limits them to what your owned objects can do |

{bhshell-0.1.0 → bhshell-0.2.0}/README.md

@@ -1,7 +1,7 @@
 # bhshell
 
-[![PyPI version](https://img.shields.io/pypi/v/bhshell.svg)](https://pypi.org/project/bhshell/)
-[![Python versions](https://img.shields.io/pypi/pyversions/bhshell.svg)](https://pypi.org/project/bhshell/)
+![PyPI Status](https://img.shields.io/pypi/status/bhshell)
+[![PyPI version](https://img.shields.io/pypi/v/bhshell)](https://pypi.org/project/bhshell/)
 [![CI](https://github.com/kr0no/bloodhound-shell/actions/workflows/ci.yml/badge.svg)](https://github.com/kr0no/bloodhound-shell/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/kr0no/bloodhound-shell/blob/main/LICENSE)
 
@@ -27,13 +27,20 @@ $ bhshell --url http://127.0.0.1:8080
 [+] Logged in as admin on 127.0.0.1:8080
 
 [bh: shell] > hunt
-  Severity   Check            Count   Example              Description
-  critical   dcsync           2       SVC_SQL@CORP.LOCAL   Non-Tier-Zero principals with replication rights
-  high       kerberoastable   2       JDOE@CORP.LOCAL      Kerberoastable users
+  Severity   Check            Count   Example                      Description
+  critical   dcsync           4       DCSYNCERS@PHANTOM.CORP       Non-Tier-Zero principals with replication rights
+  critical   adcs             95      ALICE@PHANTOM.CORP           AD CS escalation paths (ESC*, GoldenCert)
+  high       kerberoastable   2       ADMINISTRATOR@PHANTOM.CORP   Kerberoastable users
   ...
-[*] Details: 'hunt CHECK' (e.g. 'hunt kerberoastable'), or 'hunt --all'.
+[*] Details: 'hunt CHECK' (e.g. 'hunt dcsync'), or 'hunt --all'.
 
-[bh: shell] > user CORP\svc_sql --all -o svc_sql.csv
+[bh: shell] > user PHANTOM\svc_kerb_del --all -o svc_kerb_del.csv
+
+[bh: shell] > ou phantom.corp -t
+
+[bh: shell] > computer DF-MS-SHS -G
+
+[bh: shell] > gpo 'ENABLE AV@phantom.corp' -c
 
 [bh: shell] > path --owned -g
 ```
@@ -45,6 +52,9 @@ The same commands run non-interactively for scripting: `bhshell -c "hunt --json"
 | Command | Shows |
 |---|---|
 | `user`, `computer`, `group`, `lookup` | Kerberoastable / AS-REP roastable, delegation, password age, Tier Zero and owned flags, plus group nesting, inbound/outbound ACL control, sessions and local admin rights |
+| `ou` | OUs, containers and whole domains: the OU tree with object, Tier Zero and owned counts, every object below an OU, the GPOs that apply (enforced links, blocked inheritance) and who outside Tier Zero can edit them, and who controls the OU; `user`/`computer -G` shows the GPOs applied to one object. Same-named OUs are picked by distinguished name |
+| `gpo` | Where a GPO is linked, the users and computers it applies to (blocked inheritance and enforced links taken into account) and who outside Tier Zero can edit it |
+| `ca`, `template` | Enterprise CAs and certificate templates: the ESC conditions a template meets (ESC2 and ESC15 included, which BloodHound has no edge for), the CA's host and settings (ESC6, ESC8), and who can enroll, manage (ESC7) or rewrite them (ESC4) |
 | `search` | Objects matching property filters (`search -t user hasspn enabled`), with dates, ages (`90d`) and wildcards |
 | `path` | Shortest paths to a target or to Tier Zero, from everything owned, or through `--via` steps; printed as hop chains, a terminal graph, or SVG/PNG for reports |
 | `hunt` | Domain-wide checks by severity: DCSync, control of Tier Zero, AD CS (ESC*), Kerberoasting, privileged sessions, LAPS/gMSA readers, passwords in attributes, takeover primitives (Shadow Credentials, RBCD), GPO control, NTLM relay, trusts, possible honeytokens...; `hunt --owned` limits them to what your owned objects can do |

{bhshell-0.1.0 → bhshell-0.2.0}/bhshell/__init__.py

@@ -1,3 +1,3 @@
 """bhshell - an interactive shell for BloodHound."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"

{bhshell-0.1.0 → bhshell-0.2.0}/bhshell/client/client.py

@@ -314,6 +314,12 @@ class BHClient:
         data = resp.get("data") or {}
         return data.get("props") or data
 
+    def entity_counts(self, kind: str, objectid: str) -> dict[str, int]:
+        """Related-object counts the entity endpoint reports (`users`, `computers`, `gpos`, ...)."""
+        resp = self.get(f"api/v2/{_collection(kind)}/{objectid}", counts="true") or {}
+        data = resp.get("data") or {}
+        return {k: v for k, v in data.items() if isinstance(v, int) and not isinstance(v, bool)}
+
     def entity_related(
         self, kind: str, objectid: str, relation: str, *, limit: int | None = None
     ) -> list[dict[str, Any]]:
@@ -330,6 +336,8 @@ def _collection(kind: str) -> str:
         "gpo": "gpos",
         "ou": "ous",
         "container": "containers",
+        "enterpriseca": "enterprisecas",
+        "certtemplate": "certtemplates",
     }
     try:
         return mapping[kind.lower()]

{bhshell-0.1.0 → bhshell-0.2.0}/bhshell/config.py

@@ -57,6 +57,16 @@ def _write_private(path: Path, content: str) -> None:
     os.chmod(path, 0o600)
 
 
+def _absolute_dirs(setting: str) -> str:
+    """`query_dirs` with relative folders made absolute, so the setting works from any directory.
+
+    `~` and absolute folders are kept as written.
+    """
+    parts = [p.strip() for p in setting.split(os.pathsep) if p.strip()]
+    return os.pathsep.join(p if p.startswith("~") or Path(p).is_absolute() else str(Path(p).absolute())
+                           for p in parts)
+
+
 @dataclass
 class Config:
     url: str = DEFAULT_URL
@@ -107,7 +117,11 @@ class Config:
         if isinstance(default, (int, float)):
             if isinstance(value, bool):
                 raise TypeError(f"expected a number, got {value!r}")
-            number = type(default)(value)
+            try:
+                number = type(default)(value)
+            except ValueError:
+                raise ValueError(f"expected {'a whole number' if isinstance(default, int) else 'a number'}, "
+                                 f"got {value!r}") from None
             if not math.isfinite(number):
                 raise ValueError(f"not a finite number: {value!r}")
             minimum = _MINIMUMS.get(key)
@@ -118,6 +132,8 @@ class Config:
             from bhshell.client.client import normalize_url  # late: the client imports this module
 
             return normalize_url(str(value))
+        if key == "query_dirs":
+            return _absolute_dirs(str(value))
         return str(value)
 
     def save(self) -> None:

{bhshell-0.1.0 → bhshell-0.2.0}/bhshell/errors.py

@@ -67,7 +67,7 @@ class UnsupportedFeature(BHError):
 class AmbiguousMatchError(BHError):
     hint = "Qualify the name: 'jdoe@corp.local', 'CORP\\jdoe', '--domain CORP.LOCAL' or use the SID."
 
-    def __init__(self, query: str, candidates: Sequence[Node]) -> None:
-        super().__init__(f"'{query}' matches {len(candidates)} objects")
+    def __init__(self, query: str, candidates: Sequence[Node], *, hint: str = "") -> None:
+        super().__init__(f"'{query}' matches {len(candidates)} objects", hint=hint)
         self.query = query
         self.candidates = list(candidates)

{bhshell-0.1.0 → bhshell-0.2.0}/bhshell/models/entities.py

@@ -38,6 +38,30 @@ PRIMARY_KINDS = (
 TIER_ZERO_LABEL = "Tag_Tier_Zero"
 OWNED_LABEL = "Tag_Owned"
 
+# Well-known broad principals, matched by objectid suffix: Everyone, Anonymous Logon, Authenticated Users,
+# Domain Users, Domain Computers, Users, Pre-Windows 2000 Compatible Access.
+BROAD_SIDS = ("-S-1-1-0", "-S-1-5-7", "-S-1-5-11", "-513", "-515", "-S-1-5-32-545", "-S-1-5-32-554")
+
+# Extended key usages, by the OIDs BloodHound stores.
+EKU_NAMES = {
+    "1.3.6.1.5.5.7.3.1": "Server Authentication",
+    "1.3.6.1.5.5.7.3.2": "Client Authentication",
+    "1.3.6.1.5.5.7.3.3": "Code Signing",
+    "1.3.6.1.5.5.7.3.4": "Secure Email",
+    "1.3.6.1.5.5.7.3.8": "Time Stamping",
+    "1.3.6.1.5.5.7.3.9": "OCSP Signing",
+    "1.3.6.1.5.2.3.4": "PKINIT Client Authentication",
+    "1.3.6.1.5.2.3.5": "KDC Authentication",
+    "1.3.6.1.4.1.311.10.3.4": "Encrypting File System",
+    "1.3.6.1.4.1.311.10.3.4.1": "File Recovery",
+    "1.3.6.1.4.1.311.10.3.12": "Document Signing",
+    "1.3.6.1.4.1.311.20.2.1": "Certificate Request Agent",
+    "1.3.6.1.4.1.311.20.2.2": "Smart Card Logon",
+    "1.3.6.1.4.1.311.21.5": "Private Key Archival",
+    "1.3.6.1.4.1.311.21.6": "Key Recovery Agent",
+    "2.5.29.37.0": "Any Purpose",
+}
+
 
 @dataclass
 class Node:
@@ -140,16 +164,35 @@ class Edge:
         )
 
 
+def literal_rows(literals: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    """Rows of the scalar values a query returned (`RETURN n.name AS name, count(m) AS total`).
+
+    BloodHound sends them as one flat `{key, value}` list: a key already in the row starts a new one.
+    """
+    rows: list[dict[str, Any]] = []
+    row: dict[str, Any] = {}
+    for item in literals:
+        if item.get("key") in row:
+            rows.append(row)
+            row = {}
+        row[item.get("key")] = item.get("value")
+    if row:
+        rows.append(row)
+    return rows
+
+
 @dataclass
 class Graph:
     nodes: dict[str, Node] = field(default_factory=dict)
     edges: list[Edge] = field(default_factory=list)
     # The Cypher query this graph came from ('' when built otherwise).
     query: str = field(default="", compare=False, repr=False)
+    # Scalar values the query returned, as rows (see `literal_rows`).
+    rows: list[dict[str, Any]] = field(default_factory=list, compare=False, repr=False)
 
     @classmethod
     def from_cypher(cls, data: dict[str, Any]) -> Graph:
-        graph = cls()
+        graph = cls(rows=literal_rows(data.get("literals") or []))
         for node_id, raw in (data.get("nodes") or {}).items():
             graph.nodes[str(node_id)] = Node.from_cypher(node_id, raw)
         seen: set[Edge] = set()
@@ -318,16 +361,23 @@ class ADObject:
 
     @staticmethod
     def wrap(node: Node) -> ADObject:
-        cls = {"User": User, "Computer": Computer, "Group": Group}.get(node.kind, ADObject)
-        return cls(node)
+        kinds = {"User": User, "Computer": Computer, "Group": Group, "GPO": GPO,
+                 "OU": DirectoryContainer, "Container": DirectoryContainer, "Domain": DirectoryContainer,
+                 "CertTemplate": CertTemplate, "EnterpriseCA": EnterpriseCA}
+        return kinds.get(node.kind, ADObject)(node)
 
     def _common_head(self) -> list[SummaryField]:
-        return [
+        sid = self.node.kind in ("User", "Computer", "Group", "Domain")
+        oid = "Object ID (SID)" if sid else "Object ID (GUID)"
+        fields = [
             SummaryField("Name", self.node.name),
             SummaryField("Type", self.node.kind),
-            SummaryField("Object ID (SID)", self.node.objectid),
+            SummaryField(oid, self.node.objectid),
             SummaryField("Domain", self.node.domain),
         ]
+        if self.props.get("distinguishedname"):
+            fields.append(SummaryField("Distinguished Name", self.props["distinguishedname"]))
+        return fields
 
     def _common_tail(self) -> list[SummaryField]:
         return [
@@ -400,3 +450,103 @@ class Group(ADObject):
             SummaryField("AdminCount", admincount, "bool", _risk_if(admincount, "medium")),
             *self._common_tail(),
         ]
+
+
+class GPO(ADObject):
+    def summary(self) -> list[SummaryField]:
+        p = self.props
+        fields = self._common_head()
+        if p.get("gpcpath"):
+            fields.append(SummaryField("SYSVOL Path", p["gpcpath"]))
+        if p.get("whencreated"):
+            fields.append(SummaryField("Created", p["whencreated"], "date"))
+        return [*fields, *self._common_tail()]
+
+
+class DirectoryContainer(ADObject):
+    """An OU, a container or a domain: the nodes of the directory tree."""
+
+    def summary(self) -> list[SummaryField]:
+        p = self.props
+        fields = self._common_head()
+        if self.node.kind == "Domain":
+            fields.append(SummaryField("Functional Level", p.get("functionallevel") or ""))
+        if self.node.kind == "OU":
+            blocks = opt_bool(p, "blocksinheritance")
+            fields.append(SummaryField("Blocks GPO Inheritance", blocks, "bool", _risk_if(blocks, "info")))
+        if p.get("whencreated"):
+            fields.append(SummaryField("Created", p["whencreated"], "date"))
+        return [*fields, *self._common_tail()]
+
+
+def effective_ekus(props: dict[str, Any]) -> list[str] | None:
+    """The EKUs a template's certificates carry (`None` when not collected); empty means any use."""
+    ekus = props.get("effectiveekus")
+    if ekus is None:
+        ekus = props.get("ekus")
+    return None if ekus is None else [str(e) for e in ekus]
+
+
+def _registry_flag(props: dict[str, Any], key: str, collected: str, label: str, risk: Risk = "none") -> SummaryField:
+    """A CA setting read from the CA host's registry, which SharpHound cannot always reach."""
+    if props.get(collected) is False:
+        return SummaryField(label, "not collected")
+    value = opt_bool(props, key)
+    return SummaryField(label, value, "bool", _risk_if(value, risk))
+
+
+class CertTemplate(ADObject):
+    def summary(self) -> list[SummaryField]:
+        p = self.props
+        auth = opt_bool(p, "authenticationenabled")
+        supplies = opt_bool(p, "enrolleesuppliessubject")
+        nosid = opt_bool(p, "nosecurityextension")
+        fields = [
+            *self._common_head(),
+            SummaryField("Display Name", p.get("displayname") or ""),
+            SummaryField("Template OID", p.get("oid") or ""),
+            SummaryField("Schema Version", p.get("schemaversion")),
+        ]
+        ekus = effective_ekus(p)
+        if ekus == []:
+            fields.append(SummaryField("Effective EKUs", "none (any purpose)"))
+        elif ekus:
+            fields.append(SummaryField("Effective EKUs", [EKU_NAMES.get(e, e) for e in ekus], "list"))
+        return [
+            *fields,
+            SummaryField("Authentication Enabled", auth, "bool"),
+            SummaryField("Enrollee Supplies Subject", supplies, "bool", _risk_if(supplies and auth)),
+            SummaryField("Requires Manager Approval", opt_bool(p, "requiresmanagerapproval"), "bool"),
+            SummaryField("Authorized Signatures Required", p.get("authorizedsignatures")),
+            SummaryField("No Security Extension", nosid, "bool", _risk_if(nosid and auth)),
+            SummaryField("Validity Period", p.get("validityperiod") or ""),
+            SummaryField("Renewal Period", p.get("renewalperiod") or ""),
+            *self._common_tail(),
+        ]
+
+
+class EnterpriseCA(ADObject):
+    def summary(self) -> list[SummaryField]:
+        p = self.props
+        fields = [
+            *self._common_head(),
+            SummaryField("CA Name", p.get("caname") or ""),
+            SummaryField("DNS Hostname", p.get("dnshostname") or ""),
+            SummaryField("Certificate Thumbprint", p.get("certthumbprint") or ""),
+            _registry_flag(p, "isuserspecifiessanenabled", "isuserspecifiessanenabledcollected",
+                           "User Specified SAN (ESC6)", "high"),
+            *([SummaryField("CA Security", "not collected: rights granted only on the CA may be missing")]
+              if p.get("casecuritycollected") is False else []),
+            _registry_flag(p, "roleseparationenabled", "roleseparationenabledcollected", "Role Separation"),
+            _registry_flag(p, "hasenrollmentagentrestrictions", "enrollmentagentrestrictionscollected",
+                           "Enrollment Agent Restrictions"),
+        ]
+        endpoints = [*(p.get("httpenrollmentendpoints") or []), *(p.get("httpsenrollmentendpoints") or [])]
+        if endpoints:
+            fields.append(SummaryField("Web Enrollment Endpoints", endpoints, "list"))
+        if "hasvulnerableendpoint" in p:
+            vulnerable = opt_bool(p, "hasvulnerableendpoint")
+            fields.append(SummaryField("Relayable Web Enrollment (ESC8)", vulnerable, "bool", _risk_if(vulnerable)))
+        if p.get("whencreated"):
+            fields.append(SummaryField("Created", p["whencreated"], "date"))
+        return [*fields, *self._common_tail()]

bhshell-0.2.0/bhshell/models/results.py

@@ -0,0 +1,238 @@
+"""Result containers returned by the query layer and consumed by renderers/exporters."""
+
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass, field
+from typing import Any, Literal
+
+from bhshell.models.entities import ADObject, Node, SummaryField
+
+Backend = Literal["cypher", "rest"]
+
+
+class Row:
+    """A view row (a dataclass): `as_dict` is what is exported, `as_display` what the table shows."""
+
+    def as_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+    def as_display(self) -> dict[str, Any]:
+        return self.as_dict()
+
+
+@dataclass
+class RelationshipRow(Row):
+    """One relationship in a view.
+
+    Not every view fills every field; `Column` definitions on the
+    owning `ViewResult` select which ones are displayed.
+    """
+
+    principal: str = ""
+    principal_kind: str = ""
+    edge: str = ""
+    target: str = ""
+    target_kind: str = ""
+    via: str = ""
+    depth: int | None = None
+    tier_zero: bool = False
+    owned: bool = False
+    objectid: str = ""
+
+
+def _with_enabled(total: int, enabled: int) -> str:
+    return f"{total} ({enabled})" if total else "0"
+
+
+def _shorten(names: list[str], keep: int = 3) -> list[str]:
+    """The first `keep` names, and how many more there are."""
+    shown = names[:keep]
+    return [*shown, f"+{len(names) - keep} more"] if len(names) > keep else shown
+
+
+def _show_enabled(out: dict[str, Any]) -> dict[str, Any]:
+    """`users` and `computers` as "total (enabled)"."""
+    for key in ("users", "computers"):
+        total, enabled = out[key], out[f"enabled_{key}"]
+        out[key] = None if total is None else _with_enabled(total, enabled or 0)
+    return out
+
+
+@dataclass
+class ContainerRow(Row):
+    """One OU or container of a `tree` view; the counts cover everything below it."""
+
+    name: str
+    kind: str
+    depth: int
+    # The name indented under its parent, for display.
+    label: str = ""
+    users: int | None = None
+    enabled_users: int | None = None
+    computers: int | None = None
+    enabled_computers: int | None = None
+    groups: int | None = None
+    tier_zero_below: int | None = None
+    owned_below: int | None = None
+    gpo_links: int = 0
+    blocks_inheritance: bool | None = None
+    tier_zero: bool = False
+    owned: bool = False
+    distinguishedname: str = ""
+    objectid: str = ""
+
+    def as_dict(self) -> dict[str, Any]:
+        return {k: v for k, v in asdict(self).items() if k != "label"}
+
+    def as_display(self) -> dict[str, Any]:
+        return _show_enabled(asdict(self))
+
+
+@dataclass
+class ContainedRow(Row):
+    """An object below an OU or container (`contents` view)."""
+
+    name: str
+    kind: str
+    enabled: bool | None = None
+    # Containers between the explored one and the object ("direct" when it is a direct child).
+    location: str = ""
+    depth: int = 1
+    tier_zero: bool = False
+    owned: bool = False
+    distinguishedname: str = ""
+    objectid: str = ""
+
+
+@dataclass
+class GPOLinkRow(Row):
+    """A GPO linked to the object or to a container above it (`gpos` view)."""
+
+    gpo: str
+    linked_to: str
+    linked_kind: str
+    # Where the linked domain or OU sits (`CORP.LOCAL/SERVERS/WEB`): OU names repeat across a domain.
+    location: str = ""
+    enforced: bool | None = None
+    # `None` when unknown (REST fallback).
+    applies: bool | None = True
+    # Why it does not apply ("inheritance blocked at X"), why the link adds nothing ("duplicate: ..."), or ''.
+    reason: str = ""
+    # Principals outside Tier Zero that can edit the GPO.
+    editable_by: list[str] = field(default_factory=list)
+    tier_zero: bool = False
+    owned: bool = False
+    objectid: str = ""
+
+    def as_display(self) -> dict[str, Any]:
+        out = asdict(self)
+        if self.applies is None:
+            out["applies"] = None
+        else:
+            out["applies"] = ("yes" if self.applies else "no") + (f" ({self.reason})" if self.reason else "")
+        out["editable_by"] = _shorten(self.editable_by)
+        return out
+
+
+@dataclass
+class GPOTargetRow(Row):
+    """A domain or OU a GPO is linked to (`links` view); the counts cover what the link applies to."""
+
+    linked_to: str
+    kind: str
+    location: str = ""
+    enforced: bool | None = None
+    users: int | None = None
+    enabled_users: int | None = None
+    computers: int | None = None
+    enabled_computers: int | None = None
+    tier_zero_affected: int | None = None
+    owned_affected: int | None = None
+    # OUs below the linked one that block inheritance, and so stop a link that is not enforced.
+    blocked_at: list[str] = field(default_factory=list)
+    tier_zero: bool = False
+    owned: bool = False
+    distinguishedname: str = ""
+    objectid: str = ""
+
+    def as_display(self) -> dict[str, Any]:
+        return _show_enabled(asdict(self))
+
+
+@dataclass
+class TemplateRow(Row):
+    """A certificate template published to a CA (`templates` view)."""
+
+    name: str
+    schema_version: int | None = None
+    authentication: bool | None = None
+    enrollee_supplies_subject: bool | None = None
+    manager_approval: bool | None = None
+    signatures: int | None = None
+    # ESC techniques whose template conditions it meets.
+    escs: list[str] = field(default_factory=list)
+    # Principals outside Tier Zero that can enroll in it.
+    enrollable_by: list[str] = field(default_factory=list)
+    tier_zero: bool = False
+    owned: bool = False
+    objectid: str = ""
+
+    def as_display(self) -> dict[str, Any]:
+        out = asdict(self)
+        out["enrollable_by"] = _shorten(self.enrollable_by)
+        return out
+
+
+@dataclass(frozen=True)
+class Column:
+    """A table column: `attr` is a row key; `fmt` picks the cell formatting (see `Renderer.fmt_value`)."""
+
+    header: str
+    attr: str
+    fmt: str = ""
+
+
+@dataclass
+class ViewResult:
+    """The outcome of one relationship view (groups, outbound, ...)."""
+
+    key: str
+    title: str
+    columns: list[Column]
+    rows: list[Any] = field(default_factory=list)  # `Row`s; `RelationshipRow`s for relationship views
+    backend: Backend = "cypher"
+    notes: list[str] = field(default_factory=list)
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "view": self.key,
+            "title": self.title,
+            "backend": self.backend,
+            "notes": self.notes,
+            "rows": [r.as_dict() for r in self.rows],
+        }
+
+
+@dataclass
+class EntityReport:
+    """A summary and/or a set of relationship views for one entity."""
+
+    node: Node
+    show_summary: bool = True
+    views: list[ViewResult] = field(default_factory=list)
+    # Summary fields computed by queries (OU contents, linked GPOs, ...), shown after the node's own.
+    extra: list[SummaryField] = field(default_factory=list)
+
+    @property
+    def entity(self) -> ADObject:
+        return ADObject.wrap(self.node)
+
+    def summary(self) -> list[SummaryField]:
+        return [*self.entity.summary(), *self.extra]
+
+    def as_dict(self) -> dict[str, Any]:
+        out: dict[str, Any] = {"entity": self.node.as_dict()}
+        if self.show_summary:
+            out["summary"] = {f.label: f.value for f in self.summary()}
+        out["views"] = {v.key: v.as_dict() for v in self.views}
+        return out