Skip to content

fix: rewrite compound share names in generated variants - #36

Merged
l50 merged 1 commit into
mainfrom
fix/variant-1-residual-lore
Aug 1, 2026
Merged

fix: rewrite compound share names in generated variants#36
l50 merged 1 commit into
mainfrom
fix/variant-1-residual-lore

Conversation

@l50

@l50 l50 commented Aug 1, 2026

Copy link
Copy Markdown
Owner

Key Changes:

  • Fixed compound share name "thewallserver" surviving into generated variants due to word-boundary matching limitations
  • Introduced a share alias mapping so compound forms are rewritten alongside their base share name
  • Renamed the "thewall" share to "records" across GOAD variant-1 data, mappings, and scripts

Added:

  • Share alias mapping - Added shareAliases map in generator.go to associate a base share name with compound forms (e.g., thewall -> thewallserver) that word-boundary replacement cannot reach on its own
  • Compound share rewriting logic - Extended mapShares to emit compound aliases into the Misc replacement list with the appropriate suffix, relying on longest-first sorting so they match before the bare share name
  • Test coverage for compound share rewriting - Added TestCompoundShareNameRewritten in generator_test.go verifying that "thewallserver" in an archived kerberoasting script is properly rewritten and no "thewall" fragments survive

Changed:

  • Share configuration - Renamed the thewall share to records and updated its path from C:\thewall to C:\records in config.json and dev-overlay.json
  • SPN and script references - Updated HTTP/CIFS SPNs and PowerShell scripts (kerberoasting.ps1, constrained_delegation_use_any.ps1) to reference records/recordsserver instead of thewall/thewallserver
  • User account details - Changed the patrick user's password to patrick and description to Patrick in config.json
  • Mapping definitions - Updated mapping.json with the new hodor password, a shares mapping (thewall -> records), and a thewallserver -> recordsserver misc entry

**Added:**

- Compound share name handling via a new `shareAliases` map that rewrites forms like `thewallserver` that word-boundary matching cannot reach from the bare share name - `cli/internal/variant/generator.go`
- `TestCompoundShareNameRewritten` covering the archived kerberoasting script's `thewallserver` case - `cli/internal/variant/generator_test.go`

**Changed:**

- Renamed the `thewall` share to `records` across GOAD variant-1 config, dev overlay, mapping, and delegation/kerberoasting scripts to align share naming
- Updated user `patrick` credentials and description, adjusting the corresponding password mapping in `mapping.json`
- Extended `mapShares` to emit compound alias forms into Misc for plain longest-first replacement so they resolve before the bare share name
@l50
l50 merged commit 96b4b01 into main Aug 1, 2026
9 checks passed
@l50
l50 deleted the fix/variant-1-residual-lore branch August 1, 2026 21:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant