DACLhound

DACLhound collects Active Directory security descriptors over LDAP and turns the results into a graph you can inspect in a browser. The collector uses bloodyAD as a Python library; it does not run the bloodyAD command.

Install

Python 3.10 or newer is required.

pipx install DACLhound

Upgrade later with:

pipx upgrade DACLhound

Collect a graph

DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --dc-ip "$IP" --output "$DOMAIN.json"

The collector is read-only. By default it collects users, groups, computers, OUs, containers, GPOs, the domain, and ADCS data. Use --types to limit directory object types:

DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --types users,groups --output users-and-groups.json

Use --no-adcs to skip ADCS collection. The normalized graph is written to --output. Add --raw-output to keep the bloodyAD response as well.

Authentication

NTLM password

DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -p 'password' --dc-ip "$IP" -o "$DOMAIN.json"

NTLM pass-the-hash

Use LMHASH:NTHASH; if you only have the NT hash, leave the LM field empty:

DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -hashes ':<NTHASH>' --dc-ip "$IP" -o "$DOMAIN.json"

Kerberos

Use the current KRB5CCNAME, or pass a ccache path to -k:

DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -k --dc-ip "$IP" -o "$DOMAIN.json"
DACLhound.py collect --host "$FQDN" -d "$DOMAIN" -u 'user' -k user.ccache --dc-ip "$IP" -o "$DOMAIN.json"

Kerberos can also use a password or NT hash with -k. For an AES key, use -aesKey <AESKEY>. Add -s to use LDAPS.

Open the graph

Run the viewer in the foreground and stop it with Ctrl+C:

DACLhound.py graph --input "$DOMAIN.json"

Or run it in the background:

DACLhound.py graph start --input "$DOMAIN.json"
DACLhound.py graph status
DACLhound.py graph stop

The server listens on 127.0.0.1:8765 by default. Uploaded JSON files stay in memory while the server is running and are discarded when it stops. Use --bind and --port to change the listener. Run DACLhound.py collect --help or DACLhound.py graph --help for all options.

License

MIT. See LICENSE.