feat: add lab drift reconciliation, per-environment regions, and config integrity checks - #33
Merged
Conversation
**Added:** - Password reconciliation task that authenticates each user with the configured credential via LogonUser and resets only accounts whose password has drifted, including a credential probe to guard against APIs that falsely validate any password, plus handling for locked-out and Protected Users accounts - `reconcile_passwords.yml` - Group membership reconciliation task that diffs each lab-managed group against config and removes unexpected members, while skipping cross-domain members, machine accounts, built-in principals (RID < 1000), and protected accounts - `reconcile_group_membership.yml` - Default variables controlling reconciliation behavior: `ad_reconcile_passwords`, `ad_reconcile_group_membership`, `ad_reconcile_check_only`, `ad_reconcile_protected_accounts`, and `ad_multi_domain_groups_member` - `defaults/main.yml` **Changed:** - Wired the two reconciliation passes into the AD role after user and group tasks so `lab reset` converges on the baseline instead of a superset - `tasks/main.yml` - Passed cross-domain group membership data into the AD data play so same-domain members applied by a later play are not treated as unmanaged - `playbooks/ad-data.yml` - Documented the new default variables and reconciliation tasks - `roles/ad/README.md` - Expanded the `lab reset` command help to explain that stage 2 reconciles drift rather than only re-applying, and which principals are never touched - `cli/cmd/lab_reset.go`
l50
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Key Changes:
lab resetso an attack run's changes converge back to the baseline instead of leaving the lab at a superset of the declared config--region/DREADGOAD_REGIONprecedence chain, replacing the single inventory-derived regionAdded:
adrole passes reconcile user passwords (via real network logon probes, skipping locked and Protected Users accounts) and remove unmanaged group members while sparing cross-domain, machine, built-in (RID < 1000), and protected accounts -ansible/roles/ad/tasks/reconcile_passwords.yml,reconcile_group_membership.yml,defaults/main.ymllabconfigpackage walks a merged config and reports dangling group/user/vulns_vars references, missing vuln roles, and unpaired vulnerabilities, gated by a shrink-only baseline and regression tests against the real overlaysRegiontoEnvironmentConfig,SetRegionOverride, and a documented resolution order inResolveRegion, surfaced in config tracing anddocs/cli.mdAresTransportnow cross-checks arestoken_coverageagainst the technique prefix table and surfaces uncredited categories in the TUI footer and--oncestderr, with the superseded set filtered out of scored objectivesStrongCertificateBindingEnforcement, and ESC13 confirms the issuance-policy OID'smsDS-OIDToGroupLink, so a CA-side flag alone no longer reports a non-exploitable finding as PASSGOAD-variant-1andTEMPLATElabs andprod/staging/testoverlays, and regenerated GOAD-variant-1 with randomized entities including a third domain and expanded ADCS ESC coverageChanged:
Register-ScheduledTask -Force, OID reuse) and bot passwords are templated from the lab config, with thepsrole rendering scripts as Jinja templates -ad/GOAD*/scripts/*,ansible/roles/vulns_adcs_esc13/files/esc13.ps1,ansible/roles/ps/tasks/main.ymlLabConfigstructs now modelos,vulns_adcs_templates,ca_web_enrollment, andsccm, and generated JSON regains its trailing newline, guarded by a key-preservation test across every lab config -cli/internal/variant/generator.goscoreboard generate-keyanddemonow resolve the active env's lab config (variant plus overlay) instead of hardcodingad/GOAD/data/config.jsonguardian-app/deltasystems.localmustHost/mustLabhelpers and consolidated nil-check-then-dereference patterns across inventory, discovery, and validator testsRemoved:
tools/variant-generator entry from the repo layout in favor of the CLI, and dropped the emptywwwroot/upload/.gitkeepand theessos.localgroup overrides that duplicated base config in GOAD overlayssharesvuln from GOAD-Light dc02 and GOAD-variant-1, removing the previously-baselined "shares vuln with no vulns_vars" integrity findingsBuild:
.hooks/requirements.txtPython deps, the AWS/Azure Terraform providers,microsoft.ad, and the CLI's Go module dependencies to current releases