feat: ESC8 detection and dashboard overhaul#63
Merged
Conversation
- add Get-WebEnrollmentEndpointStatus (HttpClient probe) and Set-CAWebEnrollmentEndpoints (CA pipeline enrichment) to detect HTTP/HTTPS NTLM auth exposure and EPA posture on web enrollment endpoints - add ESC8 definition, detection branch in Find-LS2VulnerableCA, and WebEnrollmentEndpoints property on LS2AdcsObject; wire ESC8 into Initialize-LS2Scan and Invoke-Locksmith2 technique lists - add 75-test ESCCoverage suite that enforces all four wiring points for every technique in ESCDefinitions; add maintenance comment in ESCDefinitions listing required wiring steps - add 28 ESC8 unit tests in Find-LS2VulnerableCA.Tests.ps1, 9 enrichment tests in Set-CAWebEnrollmentEndpoints.Tests.ps1, and integration test stub guarded by LS2_TEST_CA_HOST - fix PS5.1 CP1252 encoding issue in Test-IsUtf8.ps1 (U+2713 checkmark replaced with [+])
…ntext - replace per-tab hardcoded filter/table/format blocks with \ [ordered] hashtable (single source of truth for icon, color, technique filter, subtitle, sort column) and a single foreach render loop; eliminates ~130 lines of duplication - add ESC8 to CAs and Dangerous Configurations tabs; fix tab off-by-one caused by New-HTMLSection before first New-HTMLTab (moved to New-HTMLHeader); remove -Transition from New-HTMLTabStyle (caused animation-phase shift); rename Misconfigurations to Dangerous Configurations - replace title text in New-HTMLHeader with Locksmith2.png logo (50% width, resolved from module base or source-tree fallback) plus inline context line (Forest, User, Computer, Generated); move issue count + tab description to below each data table as italic footer; remove context lines from tab footer - add ESC8, ESC3c2, ESC4o, ESC5o to technique filters; ensure all CA/template/ object techniques consistently filtered across all 8 tabs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two commits covering a full ESC8 detection implementation and a major dashboard refactor.
feat(esc8): detect NTLM relay to AD CS HTTP endpoints
New functions
Get-WebEnrollmentEndpointStatus— probes a single URL for NTLM auth exposure and EPA posture usingHttpClient; returns$nullon failureSet-CAWebEnrollmentEndpoints— pipeline enrichment; probes 5 paths × http + https per CA and stores results onLS2AdcsObject.WebEnrollmentEndpointsDetection
ESCDefinitions.ps1with maintenance comment listing all 4 required wiring points for future techniquesFind-LS2VulnerableCA: HTTP always flagged; HTTPS flagged when NTLM offered or EPA not required; dedup by URL$caTechniquesinInitialize-LS2Scanand$techniquesinInvoke-Locksmith2[object[]]$WebEnrollmentEndpointsproperty added toLS2AdcsObjectTests
Find-LS2VulnerableCA.Tests.ps1Set-CAWebEnrollmentEndpoints.Tests.ps1Get-WebEnrollmentEndpointStatus.Integration.Tests.ps1(guarded by$env:LS2_TEST_CA_HOST)Locksmith2.ESCCoverage.Tests.ps1suite enforcing all 4 wiring points for every technique in ESCDefinitionsrefactor(dashboard): DRY rewrite, ESC8 wiring, logo header, footer context
Structure
$tabDefs[ordered]hashtable and oneforeachrender loop; ~130 lines removedLayout
New-HTMLSectionbefore firstNew-HTMLTabwas counting as a tab-content slot; moved header content toNew-HTMLHeader-TransitionfromNew-HTMLTabStyle(caused animation-phase off-by-one)Locksmith2.pnglogo (50% width, resolves from module base or source-tree fallback)Coverage