Improve evidence classification and compact CLI reporting

This commit is contained in:
0x000 committed 2026-10-15 14:30:45 -04:00
1 parent 9dc7289652
commit dda4f8563f
28 files changed
+945 -87

No files matched your search

+33
View File
@@ -0,0 +1,33 @@
# Changelog
## 0.2.1
- Compact colored terminal report and phase-labelled progress bar by default;
`--verbose`, `--format full` and `--progress plain` retain detailed diagnostics.
- Native pre-login SMB2 compression-capability negotiation replaces the
login-dependent SMBGhost heuristic. No compressed transforms or exploits.
- Respect ignored/reserved SMB fields and compression-algorithm intersection;
retain strict bounds, response identity, context and absolute-timeout checks.
- Recognize Zerologon's explicit probabilistic negative; distinguish rejected
SMB authentication and denied PrintNightmare RPC binding from CVE verdicts.
- Preserve contradictory attempts, but suppress unqualified confirmed/clean
claims and use low-confidence conflict findings. Label optional signing
accurately; distinguish pending work, interruption and missing collectors.
- Detect RPC-dump protocol errors even on exit zero. Empty output cannot count
as successful enumeration. Preserve partial inventory and failure diagnostics.
- Stop queued RPC-dump copies after recognized local startup failures, without
suppressing independent remote failures or other selected checks.
- Save per-invocation timings and bounded error excerpts; retain complete,
uncolored evidence reports. Modernize wheel license metadata.
Validation uses synthetic protocol frames, mocked external tools and local
subprocess tests. No live target benchmark or patched/unpatched lab validation
has been performed. A summary showing RPC-dump exit code 1 still requires its
raw log to identify the actual root cause.
Primary behavior references:
- [MS-SMB2 negotiate response and reserved fields](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/63abf97c-0d09-47e2-88d6-6bfa552949a5)
- [MS-SMB2 negotiate-response processing](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/3b29f3af-86f9-4962-8cf3-43471cb59363)
- [MS-SMB2 compression capability format](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/78e0c942-ab41-472b-b117-4a95ebe88271)
- [Impacket RPC-dump error handling](https://github.com/fortra/impacket/blob/master/examples/rpcdump.py)