Skip to content

feat: capture trust partner SID from trust enum to unblock child→parent forge#311

Merged
l50 merged 1 commit into
feat/more-attack-covfrom
feat/dreadgoad-trust-partner-sid
May 14, 2026
Merged

feat: capture trust partner SID from trust enum to unblock child→parent forge#311
l50 merged 1 commit into
feat/more-attack-covfrom
feat/dreadgoad-trust-partner-sid

Conversation

@l50
Copy link
Copy Markdown
Contributor

@l50 l50 commented May 13, 2026

Key Changes:

  • Added support for extracting and propagating the securityIdentifier (domain SID) during domain trust enumeration and parsing
  • Updated trust parsing logic to handle both canonical and base64-encoded securityIdentifier formats
  • Modified orchestrator state publishing to upsert domain SIDs from trust data, ensuring correct automation on hardened DCs
  • Expanded and improved test coverage to validate new SID extraction and handling logic

Added:

  • security_identifier field to TrustInfo struct, with appropriate serde handling for optionality and defaulting - ares-core/src/models/core.rs
  • Logic in trust parser to extract securityIdentifier from both canonical text and base64-encoded LDAP outputs, including a decoder for binary SIDs - ares-tools/src/parsers/trust.rs
  • Tests for parsing, decoding, and correct state population of securityIdentifier, including multiple edge cases and block boundaries - ares-tools/src/parsers/trust.rs, ares-cli/src/orchestrator/state/publishing/entities.rs
  • Inline extraction and emission of canonical securityIdentifier in impacket LDAP enumeration for pass-the-hash authentication - ares-tools/src/recon.rs

Changed:

  • Trust enumeration and parsing code paths to support and carry securityIdentifier where present, ensuring downstream state and automation logic can use the SID directly
  • Orchestrator state publishing logic to upsert domain_sids from trust-enum data, mirroring the post-SAMR lookup persistence path and supporting automation on hardened 2019+ DCs - ares-cli/src/orchestrator/state/publishing/entities.rs
  • Test helpers and fixtures across several test modules to include security_identifier in constructed TrustInfo instances where relevant

Removed:

  • Redundant or now-unnecessary fallback logic and comments related to SID acquisition via legacy mechanisms in favor of direct propagation from trust enumeration

…ation

**Added:**

- Added `security_identifier` field to `TrustInfo` struct to store domain SID in canonical S-1-5-21-X-Y-Z form
- Extended trust enumeration parsers to extract and decode securityIdentifier from both canonical string and base64 LDAP outputs
- Introduced logic to upsert domain SIDs into orchestrator state and persist them in Redis when available
- Added tests to verify correct extraction, propagation, and absence handling of securityIdentifier during trust enumeration and state publishing

**Changed:**

- Updated trust enumeration logic in ares-tools to request and emit securityIdentifier for each trusted domain, both in impacket-LDAP and ldapsearch code paths
- Modified orchestrator state publishing to mirror securityIdentifier from trust objects into domain_sids and Redis for reliable parent-SID checks, improving automation on hardened DCs
- Updated all relevant test trust objects to include the new `security_identifier` field as None where not set

**Removed:**

- Removed legacy approach of only relying on post-hoc SAMR/lsaquery for domain SID resolution, replacing with direct propagation from trust enumeration when available
@codecov
Copy link
Copy Markdown

codecov Bot commented May 13, 2026

Codecov Report

❌ Patch coverage is 98.88268% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.08%. Comparing base (72fa578) to head (e8e6784).

Files with missing lines Patch % Lines
ares-cli/src/ops/inject.rs 0.00% 1 Missing ⚠️
ares-tools/src/parsers/trust.rs 99.20% 1 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@                   Coverage Diff                    @@
##           feat/more-attack-cov     #311      +/-   ##
========================================================
+ Coverage                 76.05%   76.08%   +0.03%     
========================================================
  Files                       439      439              
  Lines                    118188   118361     +173     
========================================================
+ Hits                      89884    90054     +170     
- Misses                    28304    28307       +3     
Files with missing lines Coverage Δ
ares-cli/src/orchestrator/automation/trust.rs 26.48% <100.00%> (+0.16%) ⬆️
ares-cli/src/orchestrator/completion.rs 53.23% <100.00%> (+0.07%) ⬆️
...src/orchestrator/result_processing/admin_checks.rs 40.31% <100.00%> (+0.11%) ⬆️
...-cli/src/orchestrator/state/publishing/entities.rs 98.34% <100.00%> (+0.09%) ⬆️
ares-core/src/models/core.rs 98.20% <100.00%> (+0.02%) ⬆️
ares-core/src/state/reader.rs 94.03% <100.00%> (+<0.01%) ⬆️
ares-llm/src/routing/credentials.rs 97.75% <100.00%> (+0.01%) ⬆️
ares-tools/src/recon.rs 83.70% <100.00%> (+0.09%) ⬆️
ares-cli/src/ops/inject.rs 0.00% <0.00%> (ø)
ares-tools/src/parsers/trust.rs 99.68% <99.20%> (-0.32%) ⬇️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@l50 l50 merged commit 82f0fec into feat/more-attack-cov May 14, 2026
12 checks passed
@l50 l50 deleted the feat/dreadgoad-trust-partner-sid branch May 14, 2026 02:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant