From f03c8c9727c67513f712d03def4721b882123e8c Mon Sep 17 00:00:00 2001 From: Jayson Grace Date: Thu, 30 Jul 2026 11:44:16 -0600 Subject: [PATCH] fix: exempt printnightmare and zerologon from ares drift detection **Added:** - Test coverage for the `nopac`, `printnightmare`, and `zerologon` first-class categories introduced in ares-cli PR #366, ensuring uncreditable categories don't warn on every poll - `transport_ares_test.go` **Changed:** - Added `printnightmare` and `zerologon` to `driftExemptCategories` so the refusal to credit these by-design-uncreditable techniques no longer reads as mapping drift; previously they landed in the "other" catch-all and were exempt only by accident before PR #366 promoted them to first-class categories - `transport_ares.go` - Trimmed the `driftExemptCategories` documentation for the "other" catch-all and expanded the rationale to explain the explicit `printnightmare` and `zerologon` exemptions - `transport_ares.go` --- cli/internal/scoreboard/transport_ares.go | 18 ++++++++++++------ cli/internal/scoreboard/transport_ares_test.go | 7 +++++++ 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/cli/internal/scoreboard/transport_ares.go b/cli/internal/scoreboard/transport_ares.go index b3823b02..fa40eedc 100644 --- a/cli/internal/scoreboard/transport_ares.go +++ b/cli/internal/scoreboard/transport_ares.go @@ -158,16 +158,22 @@ func (t *AresTransport) Drift() []string { // driftExemptCategories are ares categories that are expected to produce no // direct technique credit, so their presence is not evidence of a mapping bug. // -// - "other" is ares's catch-all. Techniques DreadGOAD scores but ares has no -// token_category case for (nopac) land here alongside ones DreadGOAD -// deliberately refuses to credit (printnightmare, zerologon), so the bucket -// is not actionable either way. +// - "other" is ares's catch-all, so the bucket is not actionable either way. // - "golden_ticket" is flat in ares but per-domain in the answer key // (golden_ticket-). That credit comes from domain_compromise[] // instead, so a flat category with no matching credit is expected. +// - "printnightmare" and "zerologon" are uncreditable by design, not by +// omission: ares mints both on evidence that precedes success (see the +// unmapped cases in aresExploitedToTechniqueIDs), and auto_zerologon +// documents itself as "recon only, no exploit". They reached ares +// token_category as first-class categories in ares-cli PR #366; before +// that they landed in "other" and were exempt by accident. Without an +// explicit exemption the refusal to credit them reads as mapping drift. var driftExemptCategories = map[string]bool{ - "other": true, - "golden_ticket": true, + "other": true, + "golden_ticket": true, + "printnightmare": true, + "zerologon": true, } // driftCategoryAliases translates ares category names that differ from the diff --git a/cli/internal/scoreboard/transport_ares_test.go b/cli/internal/scoreboard/transport_ares_test.go index 675bbd10..7296d802 100644 --- a/cli/internal/scoreboard/transport_ares_test.go +++ b/cli/internal/scoreboard/transport_ares_test.go @@ -306,6 +306,13 @@ func TestDriftCategoriesCoverAresTokenCategory(t *testing.T) { "gmsa_password_read": "gmsa_svc", "laps_password_read": "laps_sql01", "rbcd": "rbcd_dc01", + + // First-class categories as of ares-cli PR #366. nopac is creditable + // via the prefix table; printnightmare and zerologon are creditable by + // nobody and must be exempt, or they warn on every poll. + "nopac": "nopac_192_168_58_240", + "printnightmare": "printnightmare_192_168_58_10", + "zerologon": "zerologon_192_168_58_240", } for category, vulnID := range aresCategories {