Metadata-Version: 2.4
Name: DACLhound
Version: 0.1.0
Summary: Collect Active Directory DACLs and explore them in an interactive graph
License-Expression: MIT
Keywords: active-directory,acl,dacl,bloodhound,security
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Information Technology
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: bloodyAD==2.5.5
Dynamic: license-file

# DACLhound

DACLhound collects Active Directory security descriptors over LDAP and turns the results into a graph you can inspect in a browser. The collector uses bloodyAD as a Python library; it does not run the `bloodyAD` command.

## Install

Python 3.10 or newer is required.

```sh
pipx install DACLhound
```

Upgrade later with:

```sh
pipx upgrade DACLhound
```

## Collect a graph

```sh
DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --dc-ip "$IP" --output "$DOMAIN.json"
```

The collector is read-only. By default it collects users, groups, computers, OUs, containers, GPOs, the domain, and ADCS data. Use `--types` to limit directory object types:

```sh
DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --types users,groups --output users-and-groups.json
```

Use `--no-adcs` to skip ADCS collection. The normalized graph is written to `--output`. Add `--raw-output` to keep the bloodyAD response as well.

## Authentication

### NTLM password

```sh
DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --dc-ip "$IP" -o "$DOMAIN.json"
```

### NTLM pass-the-hash

Use `LMHASH:NTHASH`; if you only have the NT hash, leave the LM field empty:

```sh
DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -hashes ':<NTHASH>' --dc-ip "$IP" -o "$DOMAIN.json"
```

### Kerberos

Use the current `KRB5CCNAME`, or pass a ccache path to `-k`:

```sh
DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -k --dc-ip "$IP" -o "$DOMAIN.json"
DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -k user.ccache --dc-ip "$IP" -o "$DOMAIN.json"
```

Kerberos can also use a password or NT hash with `-k`. For an AES key, use `-aesKey <AESKEY>`. Add `-s` to use LDAPS.

## Open the graph

Run the viewer in the foreground and stop it with `Ctrl+C`:

```sh
DACLhound.py graph --input "$DOMAIN.json"
```

Or run it in the background:

```sh
DACLhound.py graph start --input "$DOMAIN.json"
DACLhound.py graph status
DACLhound.py graph stop
```

The server listens on `127.0.0.1:8765` by default. Uploaded JSON files stay in memory while the server is running and are discarded when it stops. Use `--bind` and `--port` to change the listener. Run `DACLhound.py collect --help` or `DACLhound.py graph --help` for all options.

## License

MIT. See [LICENSE](LICENSE).
