bhshell 0.1.1__tar.gz → 0.2.0__tar.gz

{bhshell-0.1.1/bhshell.egg-info → bhshell-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bhshell
-Version: 0.1.1
+Version: 0.2.0
 Summary: Interactive shell for BloodHound
 Author-email: kr0no <kr0no@ka0labs.net>
 License-Expression: MIT
@@ -62,17 +62,20 @@ $ bhshell --url http://127.0.0.1:8080
 [+] Logged in as admin on 127.0.0.1:8080
 
 [bh: shell] > hunt
-  Severity   Check            Count   Example              Description
-  critical   dcsync           2       SVC_SQL@CORP.LOCAL   Non-Tier-Zero principals with replication rights
-  high       kerberoastable   2       JDOE@CORP.LOCAL      Kerberoastable users
+  Severity   Check            Count   Example                      Description
+  critical   dcsync           4       DCSYNCERS@PHANTOM.CORP       Non-Tier-Zero principals with replication rights
+  critical   adcs             95      ALICE@PHANTOM.CORP           AD CS escalation paths (ESC*, GoldenCert)
+  high       kerberoastable   2       ADMINISTRATOR@PHANTOM.CORP   Kerberoastable users
   ...
-[*] Details: 'hunt CHECK' (e.g. 'hunt kerberoastable'), or 'hunt --all'.
+[*] Details: 'hunt CHECK' (e.g. 'hunt dcsync'), or 'hunt --all'.
 
-[bh: shell] > user CORP\svc_sql --all -o svc_sql.csv
+[bh: shell] > user PHANTOM\svc_kerb_del --all -o svc_kerb_del.csv
 
-[bh: shell] > ou corp.local -t
+[bh: shell] > ou phantom.corp -t
 
-[bh: shell] > computer WEB01 -G
+[bh: shell] > computer DF-MS-SHS -G
+
+[bh: shell] > gpo 'ENABLE AV@phantom.corp' -c
 
 [bh: shell] > path --owned -g
 ```
@@ -85,6 +88,8 @@ The same commands run non-interactively for scripting: `bhshell -c "hunt --json"
 |---|---|
 | `user`, `computer`, `group`, `lookup` | Kerberoastable / AS-REP roastable, delegation, password age, Tier Zero and owned flags, plus group nesting, inbound/outbound ACL control, sessions and local admin rights |
 | `ou` | OUs, containers and whole domains: the OU tree with object, Tier Zero and owned counts, every object below an OU, the GPOs that apply (enforced links, blocked inheritance) and who outside Tier Zero can edit them, and who controls the OU; `user`/`computer -G` shows the GPOs applied to one object. Same-named OUs are picked by distinguished name |
+| `gpo` | Where a GPO is linked, the users and computers it applies to (blocked inheritance and enforced links taken into account) and who outside Tier Zero can edit it |
+| `ca`, `template` | Enterprise CAs and certificate templates: the ESC conditions a template meets (ESC2 and ESC15 included, which BloodHound has no edge for), the CA's host and settings (ESC6, ESC8), and who can enroll, manage (ESC7) or rewrite them (ESC4) |
 | `search` | Objects matching property filters (`search -t user hasspn enabled`), with dates, ages (`90d`) and wildcards |
 | `path` | Shortest paths to a target or to Tier Zero, from everything owned, or through `--via` steps; printed as hop chains, a terminal graph, or SVG/PNG for reports |
 | `hunt` | Domain-wide checks by severity: DCSync, control of Tier Zero, AD CS (ESC*), Kerberoasting, privileged sessions, LAPS/gMSA readers, passwords in attributes, takeover primitives (Shadow Credentials, RBCD), GPO control, NTLM relay, trusts, possible honeytokens...; `hunt --owned` limits them to what your owned objects can do |

{bhshell-0.1.1 → bhshell-0.2.0}/README.md

@@ -27,17 +27,20 @@ $ bhshell --url http://127.0.0.1:8080
 [+] Logged in as admin on 127.0.0.1:8080
 
 [bh: shell] > hunt
-  Severity   Check            Count   Example              Description
-  critical   dcsync           2       SVC_SQL@CORP.LOCAL   Non-Tier-Zero principals with replication rights
-  high       kerberoastable   2       JDOE@CORP.LOCAL      Kerberoastable users
+  Severity   Check            Count   Example                      Description
+  critical   dcsync           4       DCSYNCERS@PHANTOM.CORP       Non-Tier-Zero principals with replication rights
+  critical   adcs             95      ALICE@PHANTOM.CORP           AD CS escalation paths (ESC*, GoldenCert)
+  high       kerberoastable   2       ADMINISTRATOR@PHANTOM.CORP   Kerberoastable users
   ...
-[*] Details: 'hunt CHECK' (e.g. 'hunt kerberoastable'), or 'hunt --all'.
+[*] Details: 'hunt CHECK' (e.g. 'hunt dcsync'), or 'hunt --all'.
 
-[bh: shell] > user CORP\svc_sql --all -o svc_sql.csv
+[bh: shell] > user PHANTOM\svc_kerb_del --all -o svc_kerb_del.csv
 
-[bh: shell] > ou corp.local -t
+[bh: shell] > ou phantom.corp -t
 
-[bh: shell] > computer WEB01 -G
+[bh: shell] > computer DF-MS-SHS -G
+
+[bh: shell] > gpo 'ENABLE AV@phantom.corp' -c
 
 [bh: shell] > path --owned -g
 ```
@@ -50,6 +53,8 @@ The same commands run non-interactively for scripting: `bhshell -c "hunt --json"
 |---|---|
 | `user`, `computer`, `group`, `lookup` | Kerberoastable / AS-REP roastable, delegation, password age, Tier Zero and owned flags, plus group nesting, inbound/outbound ACL control, sessions and local admin rights |
 | `ou` | OUs, containers and whole domains: the OU tree with object, Tier Zero and owned counts, every object below an OU, the GPOs that apply (enforced links, blocked inheritance) and who outside Tier Zero can edit them, and who controls the OU; `user`/`computer -G` shows the GPOs applied to one object. Same-named OUs are picked by distinguished name |
+| `gpo` | Where a GPO is linked, the users and computers it applies to (blocked inheritance and enforced links taken into account) and who outside Tier Zero can edit it |
+| `ca`, `template` | Enterprise CAs and certificate templates: the ESC conditions a template meets (ESC2 and ESC15 included, which BloodHound has no edge for), the CA's host and settings (ESC6, ESC8), and who can enroll, manage (ESC7) or rewrite them (ESC4) |
 | `search` | Objects matching property filters (`search -t user hasspn enabled`), with dates, ages (`90d`) and wildcards |
 | `path` | Shortest paths to a target or to Tier Zero, from everything owned, or through `--via` steps; printed as hop chains, a terminal graph, or SVG/PNG for reports |
 | `hunt` | Domain-wide checks by severity: DCSync, control of Tier Zero, AD CS (ESC*), Kerberoasting, privileged sessions, LAPS/gMSA readers, passwords in attributes, takeover primitives (Shadow Credentials, RBCD), GPO control, NTLM relay, trusts, possible honeytokens...; `hunt --owned` limits them to what your owned objects can do |

{bhshell-0.1.1 → bhshell-0.2.0}/bhshell/__init__.py

@@ -1,3 +1,3 @@
 """bhshell - an interactive shell for BloodHound."""
 
-__version__ = "0.1.1"
+__version__ = "0.2.0"

{bhshell-0.1.1 → bhshell-0.2.0}/bhshell/client/client.py

@@ -336,6 +336,8 @@ def _collection(kind: str) -> str:
         "gpo": "gpos",
         "ou": "ous",
         "container": "containers",
+        "enterpriseca": "enterprisecas",
+        "certtemplate": "certtemplates",
     }
     try:
         return mapping[kind.lower()]

{bhshell-0.1.1 → bhshell-0.2.0}/bhshell/config.py

@@ -57,6 +57,16 @@ def _write_private(path: Path, content: str) -> None:
     os.chmod(path, 0o600)
 
 
+def _absolute_dirs(setting: str) -> str:
+    """`query_dirs` with relative folders made absolute, so the setting works from any directory.
+
+    `~` and absolute folders are kept as written.
+    """
+    parts = [p.strip() for p in setting.split(os.pathsep) if p.strip()]
+    return os.pathsep.join(p if p.startswith("~") or Path(p).is_absolute() else str(Path(p).absolute())
+                           for p in parts)
+
+
 @dataclass
 class Config:
     url: str = DEFAULT_URL
@@ -107,7 +117,11 @@ class Config:
         if isinstance(default, (int, float)):
             if isinstance(value, bool):
                 raise TypeError(f"expected a number, got {value!r}")
-            number = type(default)(value)
+            try:
+                number = type(default)(value)
+            except ValueError:
+                raise ValueError(f"expected {'a whole number' if isinstance(default, int) else 'a number'}, "
+                                 f"got {value!r}") from None
             if not math.isfinite(number):
                 raise ValueError(f"not a finite number: {value!r}")
             minimum = _MINIMUMS.get(key)
@@ -118,6 +132,8 @@ class Config:
             from bhshell.client.client import normalize_url  # late: the client imports this module
 
             return normalize_url(str(value))
+        if key == "query_dirs":
+            return _absolute_dirs(str(value))
         return str(value)
 
     def save(self) -> None:

{bhshell-0.1.1 → bhshell-0.2.0}/bhshell/models/entities.py

@@ -38,6 +38,30 @@ PRIMARY_KINDS = (
 TIER_ZERO_LABEL = "Tag_Tier_Zero"
 OWNED_LABEL = "Tag_Owned"
 
+# Well-known broad principals, matched by objectid suffix: Everyone, Anonymous Logon, Authenticated Users,
+# Domain Users, Domain Computers, Users, Pre-Windows 2000 Compatible Access.
+BROAD_SIDS = ("-S-1-1-0", "-S-1-5-7", "-S-1-5-11", "-513", "-515", "-S-1-5-32-545", "-S-1-5-32-554")
+
+# Extended key usages, by the OIDs BloodHound stores.
+EKU_NAMES = {
+    "1.3.6.1.5.5.7.3.1": "Server Authentication",
+    "1.3.6.1.5.5.7.3.2": "Client Authentication",
+    "1.3.6.1.5.5.7.3.3": "Code Signing",
+    "1.3.6.1.5.5.7.3.4": "Secure Email",
+    "1.3.6.1.5.5.7.3.8": "Time Stamping",
+    "1.3.6.1.5.5.7.3.9": "OCSP Signing",
+    "1.3.6.1.5.2.3.4": "PKINIT Client Authentication",
+    "1.3.6.1.5.2.3.5": "KDC Authentication",
+    "1.3.6.1.4.1.311.10.3.4": "Encrypting File System",
+    "1.3.6.1.4.1.311.10.3.4.1": "File Recovery",
+    "1.3.6.1.4.1.311.10.3.12": "Document Signing",
+    "1.3.6.1.4.1.311.20.2.1": "Certificate Request Agent",
+    "1.3.6.1.4.1.311.20.2.2": "Smart Card Logon",
+    "1.3.6.1.4.1.311.21.5": "Private Key Archival",
+    "1.3.6.1.4.1.311.21.6": "Key Recovery Agent",
+    "2.5.29.37.0": "Any Purpose",
+}
+
 
 @dataclass
 class Node:
@@ -140,16 +164,35 @@ class Edge:
         )
 
 
+def literal_rows(literals: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    """Rows of the scalar values a query returned (`RETURN n.name AS name, count(m) AS total`).
+
+    BloodHound sends them as one flat `{key, value}` list: a key already in the row starts a new one.
+    """
+    rows: list[dict[str, Any]] = []
+    row: dict[str, Any] = {}
+    for item in literals:
+        if item.get("key") in row:
+            rows.append(row)
+            row = {}
+        row[item.get("key")] = item.get("value")
+    if row:
+        rows.append(row)
+    return rows
+
+
 @dataclass
 class Graph:
     nodes: dict[str, Node] = field(default_factory=dict)
     edges: list[Edge] = field(default_factory=list)
     # The Cypher query this graph came from ('' when built otherwise).
     query: str = field(default="", compare=False, repr=False)
+    # Scalar values the query returned, as rows (see `literal_rows`).
+    rows: list[dict[str, Any]] = field(default_factory=list, compare=False, repr=False)
 
     @classmethod
     def from_cypher(cls, data: dict[str, Any]) -> Graph:
-        graph = cls()
+        graph = cls(rows=literal_rows(data.get("literals") or []))
         for node_id, raw in (data.get("nodes") or {}).items():
             graph.nodes[str(node_id)] = Node.from_cypher(node_id, raw)
         seen: set[Edge] = set()
@@ -318,12 +361,14 @@ class ADObject:
 
     @staticmethod
     def wrap(node: Node) -> ADObject:
-        kinds = {"User": User, "Computer": Computer, "Group": Group,
-                 "OU": DirectoryContainer, "Container": DirectoryContainer, "Domain": DirectoryContainer}
+        kinds = {"User": User, "Computer": Computer, "Group": Group, "GPO": GPO,
+                 "OU": DirectoryContainer, "Container": DirectoryContainer, "Domain": DirectoryContainer,
+                 "CertTemplate": CertTemplate, "EnterpriseCA": EnterpriseCA}
         return kinds.get(node.kind, ADObject)(node)
 
     def _common_head(self) -> list[SummaryField]:
-        oid = "Object ID (GUID)" if self.node.kind in ("OU", "Container", "GPO") else "Object ID (SID)"
+        sid = self.node.kind in ("User", "Computer", "Group", "Domain")
+        oid = "Object ID (SID)" if sid else "Object ID (GUID)"
         fields = [
             SummaryField("Name", self.node.name),
             SummaryField("Type", self.node.kind),
@@ -407,6 +452,17 @@ class Group(ADObject):
         ]
 
 
+class GPO(ADObject):
+    def summary(self) -> list[SummaryField]:
+        p = self.props
+        fields = self._common_head()
+        if p.get("gpcpath"):
+            fields.append(SummaryField("SYSVOL Path", p["gpcpath"]))
+        if p.get("whencreated"):
+            fields.append(SummaryField("Created", p["whencreated"], "date"))
+        return [*fields, *self._common_tail()]
+
+
 class DirectoryContainer(ADObject):
     """An OU, a container or a domain: the nodes of the directory tree."""
 
@@ -421,3 +477,76 @@ class DirectoryContainer(ADObject):
         if p.get("whencreated"):
             fields.append(SummaryField("Created", p["whencreated"], "date"))
         return [*fields, *self._common_tail()]
+
+
+def effective_ekus(props: dict[str, Any]) -> list[str] | None:
+    """The EKUs a template's certificates carry (`None` when not collected); empty means any use."""
+    ekus = props.get("effectiveekus")
+    if ekus is None:
+        ekus = props.get("ekus")
+    return None if ekus is None else [str(e) for e in ekus]
+
+
+def _registry_flag(props: dict[str, Any], key: str, collected: str, label: str, risk: Risk = "none") -> SummaryField:
+    """A CA setting read from the CA host's registry, which SharpHound cannot always reach."""
+    if props.get(collected) is False:
+        return SummaryField(label, "not collected")
+    value = opt_bool(props, key)
+    return SummaryField(label, value, "bool", _risk_if(value, risk))
+
+
+class CertTemplate(ADObject):
+    def summary(self) -> list[SummaryField]:
+        p = self.props
+        auth = opt_bool(p, "authenticationenabled")
+        supplies = opt_bool(p, "enrolleesuppliessubject")
+        nosid = opt_bool(p, "nosecurityextension")
+        fields = [
+            *self._common_head(),
+            SummaryField("Display Name", p.get("displayname") or ""),
+            SummaryField("Template OID", p.get("oid") or ""),
+            SummaryField("Schema Version", p.get("schemaversion")),
+        ]
+        ekus = effective_ekus(p)
+        if ekus == []:
+            fields.append(SummaryField("Effective EKUs", "none (any purpose)"))
+        elif ekus:
+            fields.append(SummaryField("Effective EKUs", [EKU_NAMES.get(e, e) for e in ekus], "list"))
+        return [
+            *fields,
+            SummaryField("Authentication Enabled", auth, "bool"),
+            SummaryField("Enrollee Supplies Subject", supplies, "bool", _risk_if(supplies and auth)),
+            SummaryField("Requires Manager Approval", opt_bool(p, "requiresmanagerapproval"), "bool"),
+            SummaryField("Authorized Signatures Required", p.get("authorizedsignatures")),
+            SummaryField("No Security Extension", nosid, "bool", _risk_if(nosid and auth)),
+            SummaryField("Validity Period", p.get("validityperiod") or ""),
+            SummaryField("Renewal Period", p.get("renewalperiod") or ""),
+            *self._common_tail(),
+        ]
+
+
+class EnterpriseCA(ADObject):
+    def summary(self) -> list[SummaryField]:
+        p = self.props
+        fields = [
+            *self._common_head(),
+            SummaryField("CA Name", p.get("caname") or ""),
+            SummaryField("DNS Hostname", p.get("dnshostname") or ""),
+            SummaryField("Certificate Thumbprint", p.get("certthumbprint") or ""),
+            _registry_flag(p, "isuserspecifiessanenabled", "isuserspecifiessanenabledcollected",
+                           "User Specified SAN (ESC6)", "high"),
+            *([SummaryField("CA Security", "not collected: rights granted only on the CA may be missing")]
+              if p.get("casecuritycollected") is False else []),
+            _registry_flag(p, "roleseparationenabled", "roleseparationenabledcollected", "Role Separation"),
+            _registry_flag(p, "hasenrollmentagentrestrictions", "enrollmentagentrestrictionscollected",
+                           "Enrollment Agent Restrictions"),
+        ]
+        endpoints = [*(p.get("httpenrollmentendpoints") or []), *(p.get("httpsenrollmentendpoints") or [])]
+        if endpoints:
+            fields.append(SummaryField("Web Enrollment Endpoints", endpoints, "list"))
+        if "hasvulnerableendpoint" in p:
+            vulnerable = opt_bool(p, "hasvulnerableendpoint")
+            fields.append(SummaryField("Relayable Web Enrollment (ESC8)", vulnerable, "bool", _risk_if(vulnerable)))
+        if p.get("whencreated"):
+            fields.append(SummaryField("Created", p["whencreated"], "date"))
+        return [*fields, *self._common_tail()]

{bhshell-0.1.1 → bhshell-0.2.0}/bhshell/models/results.py

@@ -44,6 +44,20 @@ def _with_enabled(total: int, enabled: int) -> str:
     return f"{total} ({enabled})" if total else "0"
 
 
+def _shorten(names: list[str], keep: int = 3) -> list[str]:
+    """The first `keep` names, and how many more there are."""
+    shown = names[:keep]
+    return [*shown, f"+{len(names) - keep} more"] if len(names) > keep else shown
+
+
+def _show_enabled(out: dict[str, Any]) -> dict[str, Any]:
+    """`users` and `computers` as "total (enabled)"."""
+    for key in ("users", "computers"):
+        total, enabled = out[key], out[f"enabled_{key}"]
+        out[key] = None if total is None else _with_enabled(total, enabled or 0)
+    return out
+
+
 @dataclass
 class ContainerRow(Row):
     """One OU or container of a `tree` view; the counts cover everything below it."""
@@ -71,11 +85,7 @@ class ContainerRow(Row):
         return {k: v for k, v in asdict(self).items() if k != "label"}
 
     def as_display(self) -> dict[str, Any]:
-        out = asdict(self)
-        for key in ("users", "computers"):
-            total, enabled = out[key], out[f"enabled_{key}"]
-            out[key] = None if total is None else _with_enabled(total, enabled or 0)
-        return out
+        return _show_enabled(asdict(self))
 
 
 @dataclass
@@ -101,6 +111,8 @@ class GPOLinkRow(Row):
     gpo: str
     linked_to: str
     linked_kind: str
+    # Where the linked domain or OU sits (`CORP.LOCAL/SERVERS/WEB`): OU names repeat across a domain.
+    location: str = ""
     enforced: bool | None = None
     # `None` when unknown (REST fallback).
     applies: bool | None = True
@@ -118,10 +130,56 @@ class GPOLinkRow(Row):
             out["applies"] = None
         else:
             out["applies"] = ("yes" if self.applies else "no") + (f" ({self.reason})" if self.reason else "")
-        shown = self.editable_by[:3]
-        if len(self.editable_by) > len(shown):
-            shown = [*shown, f"+{len(self.editable_by) - len(shown)} more"]
-        out["editable_by"] = shown
+        out["editable_by"] = _shorten(self.editable_by)
+        return out
+
+
+@dataclass
+class GPOTargetRow(Row):
+    """A domain or OU a GPO is linked to (`links` view); the counts cover what the link applies to."""
+
+    linked_to: str
+    kind: str
+    location: str = ""
+    enforced: bool | None = None
+    users: int | None = None
+    enabled_users: int | None = None
+    computers: int | None = None
+    enabled_computers: int | None = None
+    tier_zero_affected: int | None = None
+    owned_affected: int | None = None
+    # OUs below the linked one that block inheritance, and so stop a link that is not enforced.
+    blocked_at: list[str] = field(default_factory=list)
+    tier_zero: bool = False
+    owned: bool = False
+    distinguishedname: str = ""
+    objectid: str = ""
+
+    def as_display(self) -> dict[str, Any]:
+        return _show_enabled(asdict(self))
+
+
+@dataclass
+class TemplateRow(Row):
+    """A certificate template published to a CA (`templates` view)."""
+
+    name: str
+    schema_version: int | None = None
+    authentication: bool | None = None
+    enrollee_supplies_subject: bool | None = None
+    manager_approval: bool | None = None
+    signatures: int | None = None
+    # ESC techniques whose template conditions it meets.
+    escs: list[str] = field(default_factory=list)
+    # Principals outside Tier Zero that can enroll in it.
+    enrollable_by: list[str] = field(default_factory=list)
+    tier_zero: bool = False
+    owned: bool = False
+    objectid: str = ""
+
+    def as_display(self) -> dict[str, Any]:
+        out = asdict(self)
+        out["enrollable_by"] = _shorten(self.enrollable_by)
         return out