feat: add universal and missing ADCS techniques to scoreboard logic#207
Merged
Conversation
**Added:**
- Included "adcs_esc8" in vulnerable techniques for relevant lab entities in the config
- Added new ADCS techniques ("adcs_esc5", "adcs_esc8", "adcs_esc14") to scoreboard labels
- Introduced universal techniques (e.g., "nopac", "printnightmare", "zerologon",
"cve_2019_1040", "certifried", "krbrelayup", "machine_account_quota", "mitm6")
via a dedicated function to ensure they are always credited
- Updated test expectations to cover the new and universal techniques
**Changed:**
- Refactored extraction of techniques to add universal techniques for every lab,
replacing previous static addition of "child_to_parent"
- Improved documentation in code comments for universal techniques logic
dreadnode-renovate-bot
Bot
added
lab/GOAD
**Added:** - Added logic to credit ESC8 technique when any domain has Web Enrollment enabled by introducing addADCSWebEnrollmentTechnique function in the scoreboard generator **Changed:** - Updated technique extraction flow to call addADCSWebEnrollmentTechnique, ensuring ESC8 is recognized at the domain level rather than per host **Removed:** - Removed "adcs_esc8" from per-host 'vulns' lists in config.json to prevent Ansible from dispatching non-existent vulns_adcs_esc8 role
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Key Changes:
Added:
addUniversalTechniquestoscoreboard generation, crediting lab-wide vulnerabilities such as noPac,
PrintNightmare, ZeroLogon, Certifried, Machine Account Quota abuse, MITM6,
and others, making them visible regardless of per-host markers
label mapping for complete coverage of known ADCS escalation paths
Changed:
technique with call to
addUniversalTechniquesto generalize handling oflab-wide vulnerabilities
specific lab host configurations to reflect new technique coverage
"adcs_esc8", noPac, PrintNightmare, ZeroLogon, Certifried, machine account
quota, mitm6, and other universal techniques to match new logic
Removed:
replaced by new universal handling logic