Improve evidence classification and compact CLI reporting

tests/test_checks.py

@@ -50,11 +50,33 @@ class CheckerOutputTests(unittest.TestCase):
         ) + "\x1b[0m"
         self.assertEqual(classify_nxc("printnightmare", HOST, text).status, "suspected")
 
-    def test_smbghost_capability_indicator_is_only_suspected(self):
+    def test_smbghost_capability_indicator_is_not_a_cve_finding(self):
         text = nxc_line(
             "SMBGHOST", "[+] Potentially vulnerable to SMBGhost (CVE-2020-0796)",
         )
-        self.assertEqual(classify_nxc("smbghost", HOST, text).status, "suspected")
+        self.assertEqual(classify_nxc("smbghost", HOST, text).status, "exposed")
+
+    def test_zerologon_exhausted_attempts_are_a_scoped_negative(self):
+        result = classify_nxc("zerologon", HOST, nxc_line("ZEROLOGON", "[+] Attack failed. Target is probably patched."))
+        self.assertEqual(result.status, "not-vulnerable")
+        self.assertIn("probabilistic", result.evidence)
+
+    def test_denial_blocks_probe_instead_of_implying_patched(self):
+        result = classify_nxc("printnightmare", HOST, nxc_line("PRINTNIGHTMARE", "[-] Failed to bind: STATUS_ACCESS_DENIED"))
+        self.assertEqual(result.status, "skipped-access-denied")
+        self.assertEqual(classify_nxc("ms17-010", HOST, nxc_line("SMB", "[-] LAB\\: STATUS_LOGON_FAILURE")).status, "skipped-auth-denied")
+        self.assertEqual(classify_nxc("ms17-010", HOST, nxc_line("SMB", "[+] LAB\\user:STATUS_LOGON_FAILURE")).status, "inconclusive")
+
+    def test_mixed_rpc_methods_do_not_hide_positive_binds_behind_another_denial(self):
+        text = nxc_line("COERCE_PLUS", "[-] Failed to bind: STATUS_ACCESS_DENIED") + nxc_line("COERCE_PLUS", "[+] VULNERABLE, PetitPotam")
+        self.assertEqual(classify_nxc("petitpotam", HOST, text).status, "exposed")
+        text = nxc_line("PRINTNIGHTMARE", "[-] Failed to bind: STATUS_ACCESS_DENIED") + nxc_line(
+            "PRINTNIGHTMARE", "[+] Vulnerable, next step https://github.com/ly4k/PrintNightmare")
+        self.assertEqual(classify_nxc("printnightmare", HOST, text).status, "inconclusive")
+
+    def test_zerologon_mixed_positive_negative_is_unknown_not_patched(self):
+        text = nxc_line("ZEROLOGON", "[+] VULNERABLE") + nxc_line("ZEROLOGON", "[+] Attack failed. Target is probably patched.")
+        self.assertEqual(classify_nxc("zerologon", HOST, text).status, "inconclusive")
 
     def test_nonzero_exit_fails_closed_even_with_result_markers(self):
         for message in ("[+] VULNERABLE", f"[-] {HOST} does NOT appear vulnerable"):
@@ -80,8 +102,7 @@ class CheckerOutputTests(unittest.TestCase):
     def test_silence_and_upstream_errors_remain_inconclusive(self):
         cases = [
             ("ms17-010", "MS17-010", ""),
-            ("zerologon", "ZEROLOGON", "[+] Attack failed. Target is probably patched."),
-            ("printnightmare", "PRINTNIGHTMARE", "[-] Failed to bind: access denied"),
+            ("zerologon", "ZEROLOGON", "[-] Error while connecting to host: DCERPCException, which means this is probably not a DC!"),
             ("smbghost", "SMBGHOST", "[-] Error while connecting to host: timed out"),
         ]
         for key, module, message in cases: