Skip to content

fix: correctly credit ticket-granting exploits without parser discoveries#282

Merged
l50 merged 2 commits into
feat/more-attack-covfrom
feat/dreadgoad-delegation-fixes
May 12, 2026
Merged

fix: correctly credit ticket-granting exploits without parser discoveries#282
l50 merged 2 commits into
feat/more-attack-covfrom
feat/dreadgoad-delegation-fixes

Conversation

@l50
Copy link
Copy Markdown
Contributor

@l50 l50 commented May 12, 2026

Key Changes:

  • Added logic to recognize Kerberos ticket saves as valid evidence for certain vulnerabilities
  • Implemented new helper functions to detect ticket-granting primitives and ticket evidence in tool output
  • Updated exploit success evaluation to include ticket saves, not just parser-extracted discoveries
  • Added comprehensive tests for new detection logic

Added:

  • Ticket evidence recognition logic - Introduced is_ticket_grant_vuln and result_has_ccache_evidence functions to identify when a ticket save (rather than a parser-discovered credential) should mark an exploit as successful
  • Unit tests for new detection logic - Added tests for ticket-granting primitive recognition and ticket evidence detection in various tool output formats

Changed:

  • Exploit success evaluation - Modified process_completed_task to treat a successful Kerberos ticket save (for relevant primitives) as sufficient evidence for marking a vulnerability as exploited, even when no parser evidence is found

Removed:

  • Restrictive success requirement - Relaxed the previous check that only credited exploits with parser-extracted discoveries, allowing ticket saves to be recognized as valid evidence for ticket-granting exploits

**Added:**

- Added `is_ticket_grant_vuln` function to identify primitives where Kerberos ticket saves indicate success
- Added `result_has_ccache_evidence` function to detect saved ticket evidence in tool output
- Introduced tests for both new functions to verify correct detection logic

**Changed:**

- Updated exploit success detection logic to allow ticket-only primitives (e.g., delegation, RBCD, S4U) to be marked successful based on saved ticket evidence, not just parser discoveries
@l50 l50 changed the base branch from main to feat/more-attack-cov May 12, 2026 22:29
@l50 l50 changed the title feat: implement new cross-forest exploitation primitives and comprehensive post-exploitation automation fix: correctly credit ticket-granting exploits without parser discoveries May 12, 2026
…dreadgoad-delegation-fixes

# Conflicts:
#	ares-cli/src/orchestrator/result_processing/tests.rs
@codecov
Copy link
Copy Markdown

codecov Bot commented May 12, 2026

Codecov Report

❌ Patch coverage is 93.84615% with 4 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (feat/more-attack-cov@374fcaa). Learn more about missing BASE report.

Files with missing lines Patch % Lines
ares-cli/src/orchestrator/result_processing/mod.rs 87.87% 4 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@                   Coverage Diff                   @@
##             feat/more-attack-cov     #282   +/-   ##
=======================================================
  Coverage                        ?   76.32%           
=======================================================
  Files                           ?      432           
  Lines                           ?   112992           
  Branches                        ?        0           
=======================================================
  Hits                            ?    86238           
  Misses                          ?    26754           
  Partials                        ?        0           
Files with missing lines Coverage Δ
...es-cli/src/orchestrator/result_processing/tests.rs 100.00% <100.00%> (ø)
ares-cli/src/orchestrator/result_processing/mod.rs 18.19% <87.87%> (ø)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@l50 l50 merged commit d218ae8 into feat/more-attack-cov May 12, 2026
11 checks passed
@l50 l50 deleted the feat/dreadgoad-delegation-fixes branch May 12, 2026 22:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant