Skip to content

fix: exempt printnightmare and zerologon from ares drift detection #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
l50 wants to merge 1 commit into from
Closed

fix: exempt printnightmare and zerologon from ares drift detection #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions cli/internal/scoreboard/transport_ares.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,16 +158,22 @@ func (t *AresTransport) Drift() []string {
// driftExemptCategories are ares categories that are expected to produce no
// direct technique credit, so their presence is not evidence of a mapping bug.
//
// - "other" is ares's catch-all. Techniques DreadGOAD scores but ares has no
// token_category case for (nopac) land here alongside ones DreadGOAD
// deliberately refuses to credit (printnightmare, zerologon), so the bucket
// is not actionable either way.
// - "other" is ares's catch-all, so the bucket is not actionable either way.
// - "golden_ticket" is flat in ares but per-domain in the answer key
// (golden_ticket-<domain>). That credit comes from domain_compromise[]
// instead, so a flat category with no matching credit is expected.
// - "printnightmare" and "zerologon" are uncreditable by design, not by
// omission: ares mints both on evidence that precedes success (see the
// unmapped cases in aresExploitedToTechniqueIDs), and auto_zerologon
// documents itself as "recon only, no exploit". They reached ares
// token_category as first-class categories in ares-cli PR #366; before
// that they landed in "other" and were exempt by accident. Without an
// explicit exemption the refusal to credit them reads as mapping drift.
var driftExemptCategories = map[string]bool{
"other": true,
"golden_ticket": true,
"other": true,
"golden_ticket": true,
"printnightmare": true,
"zerologon": true,
}

// driftCategoryAliases translates ares category names that differ from the
Expand Down
7 changes: 7 additions & 0 deletions cli/internal/scoreboard/transport_ares_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,6 +306,13 @@ func TestDriftCategoriesCoverAresTokenCategory(t *testing.T) {
"gmsa_password_read": "gmsa_svc",
"laps_password_read": "laps_sql01",
"rbcd": "rbcd_dc01",

// First-class categories as of ares-cli PR #366. nopac is creditable
// via the prefix table; printnightmare and zerologon are creditable by
// nobody and must be exempt, or they warn on every poll.
"nopac": "nopac_192_168_58_240",
"printnightmare": "printnightmare_192_168_58_10",
"zerologon": "zerologon_192_168_58_240",
}

for category, vulnID := range aresCategories {
Expand Down
Loading