0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-VQG4FT5D.js

@@ -0,0 +1,685 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+
+// packages/core/dist/adgraph/paths.js
+var AD_EDGE_TECHNIQUES = {
+  MemberOf: "inherits the group's rights through membership",
+  Contains: "controls the child object via the containing OU/container",
+  GPLink: "applies policy to every object under the linked container",
+  TrustedBy: "crosses the domain trust into the trusting domain",
+  HasSIDHistory: "carries the target's SID in SID history, inheriting its access",
+  AdminTo: "has local administrator rights on the host",
+  HasSession: "can dump the logged-on user's credentials from LSASS",
+  CanRDP: "can log on interactively over RDP",
+  CanPSRemote: "can execute code over PowerShell Remoting (WinRM)",
+  ExecuteDCOM: "can execute code through DCOM activation",
+  SQLAdmin: "is a SQL sysadmin and can execute OS commands via xp_cmdshell",
+  GenericAll: "holds full control and can reset the password or add itself",
+  GenericWrite: "can write attributes, e.g. set an SPN or a logon script",
+  WriteDacl: "can rewrite the DACL and grant itself full control",
+  WriteOwner: "can take ownership and then rewrite the DACL",
+  Owns: "owns the object and can grant itself full control",
+  WriteSPN: "can set an SPN and then kerberoast the account",
+  AllExtendedRights: "holds all extended rights, including password reset",
+  ForceChangePassword: "can reset the account password without knowing the old one",
+  AddMember: "can add any principal to the group",
+  AddSelf: "can add itself to the group",
+  AddKeyCredentialLink: "can shadow-credential the account and request a TGT",
+  WriteAccountRestrictions: "can set delegation attributes on the account",
+  WriteGPLink: "can link a malicious GPO to the container",
+  ReadLAPSPassword: "can read the LAPS-managed local administrator password",
+  ReadGMSAPassword: "can read the gMSA password blob and derive its keys",
+  SyncLAPSPassword: "can sync the LAPS password via directory replication",
+  DumpSMSAPassword: "can dump the sMSA password from the host",
+  AllowedToDelegate: "can impersonate any user to the target service (constrained delegation)",
+  AllowedToAct: "is trusted for resource-based constrained delegation to the host",
+  AddAllowedToAct: "can configure RBCD on the target and then impersonate any user",
+  DCSync: "can replicate directory secrets, including the krbtgt hash",
+  GetChanges: "holds one half of the replication rights needed for DCSync",
+  GetChangesAll: "holds the second half of the replication rights needed for DCSync",
+  GetChangesInFilteredSet: "can replicate the filtered attribute set (LAPS)",
+  ADCSESC1: "enrolls in a template allowing a caller-supplied SAN (ESC1)",
+  ADCSESC3: "abuses an enrollment-agent template to enrol on behalf of others (ESC3)",
+  ADCSESC4: "has write access over the certificate template itself (ESC4)",
+  ADCSESC5: "controls a PKI object the CA depends on (ESC5)",
+  ADCSESC6a: "abuses EDITF_ATTRIBUTESUBJECTALTNAME2 on the CA (ESC6)",
+  ADCSESC6b: "abuses EDITF_ATTRIBUTESUBJECTALTNAME2 with weak binding (ESC6)",
+  ADCSESC7: "holds ManageCA/ManageCertificates on the CA (ESC7)",
+  ADCSESC9a: "abuses a template with CT_FLAG_NO_SECURITY_EXTENSION (ESC9)",
+  ADCSESC9b: "abuses no-security-extension against a machine account (ESC9)",
+  ADCSESC10a: "abuses weak certificate mapping on the DC (ESC10)",
+  ADCSESC10b: "abuses UPN certificate mapping on the DC (ESC10)",
+  ADCSESC13: "abuses an issuance policy linked to a privileged group (ESC13)",
+  GoldenCert: "can steal the CA private key and forge certificates for any principal",
+  ManageCA: "is a CA administrator and can enable a vulnerable configuration",
+  ManageCertificates: "is a certificate manager and can approve pending requests",
+  Enroll: "may request a certificate from the template",
+  WritePKIEnrollmentFlag: "can set the enrollment flags on the template",
+  WritePKINameFlag: "can enable caller-supplied subject names on the template",
+  CoerceToTGT: "can coerce the target into authenticating and capture its TGT",
+  CoerceAndRelayNTLMToADCS: "can coerce authentication and relay it to ADCS web enrollment",
+  CoerceAndRelayNTLMToLDAP: "can coerce authentication and relay it to LDAP",
+  CoerceAndRelayNTLMToLDAPS: "can coerce authentication and relay it to LDAPS",
+  CoerceAndRelayNTLMToSMB: "can coerce authentication and relay it to SMB"
+};
+function describeEdgeTechnique(kind) {
+  return AD_EDGE_TECHNIQUES[kind] ?? `holds the ${kind} relationship over the target`;
+}
+var DEFAULT_MAX_DEPTH = 8;
+var DEFAULT_MAX_RESULTS = 25;
+var DEFAULT_MAX_EXPANSIONS = 5e5;
+function resolveEdgeFilter(opts) {
+  const allowed = opts.allowedEdgeKinds ? new Set(opts.allowedEdgeKinds) : void 0;
+  const denied = opts.deniedEdgeKinds ? new Set(opts.deniedEdgeKinds) : void 0;
+  if (!allowed && !denied)
+    return () => true;
+  return (edge) => {
+    if (allowed && !allowed.has(edge.kind))
+      return false;
+    if (denied && denied.has(edge.kind))
+      return false;
+    return true;
+  };
+}
+function resolveEdgeCost(opts) {
+  const fn = opts.edgeCost;
+  if (!fn)
+    return () => 1;
+  return (edge) => {
+    const cost = fn(edge);
+    return Number.isFinite(cost) && cost > 0 ? cost : 0;
+  };
+}
+var LabelHeap = class {
+  cost;
+  depth;
+  items = [];
+  constructor(cost, depth) {
+    this.cost = cost;
+    this.depth = depth;
+  }
+  get size() {
+    return this.items.length;
+  }
+  before(a, b) {
+    if (this.cost[a] !== this.cost[b])
+      return this.cost[a] < this.cost[b];
+    return this.depth[a] < this.depth[b];
+  }
+  push(label) {
+    const items = this.items;
+    items.push(label);
+    let i = items.length - 1;
+    while (i > 0) {
+      const parent = i - 1 >> 1;
+      if (!this.before(items[i], items[parent]))
+        break;
+      [items[i], items[parent]] = [items[parent], items[i]];
+      i = parent;
+    }
+  }
+  pop() {
+    const items = this.items;
+    if (items.length === 0)
+      return void 0;
+    const top = items[0];
+    const last = items.pop();
+    if (items.length === 0)
+      return top;
+    items[0] = last;
+    let i = 0;
+    for (; ; ) {
+      const left = 2 * i + 1;
+      const right = left + 1;
+      let smallest = i;
+      if (left < items.length && this.before(items[left], items[smallest]))
+        smallest = left;
+      if (right < items.length && this.before(items[right], items[smallest]))
+        smallest = right;
+      if (smallest === i)
+        break;
+      [items[i], items[smallest]] = [items[smallest], items[i]];
+      i = smallest;
+    }
+    return top;
+  }
+};
+function buildAttackPath(graph, edgeIndices, edgeCost = () => 1, describeEdge = (edge) => describeEdgeTechnique(edge.kind)) {
+  if (edgeIndices.length === 0)
+    return void 0;
+  const steps = [];
+  let cost = 0;
+  for (const edgeIndex of edgeIndices) {
+    const edge = graph.edges[edgeIndex];
+    if (!edge)
+      return void 0;
+    const from = graph.nodes.get(edge.source);
+    const to = graph.nodes.get(edge.target);
+    if (!from || !to)
+      return void 0;
+    cost += edgeCost(edge);
+    steps.push({ from, edge, to, technique: `${from.label} ${describeEdge(edge)}` });
+  }
+  return {
+    sourceId: steps[0].from.objectId,
+    targetId: steps[steps.length - 1].to.objectId,
+    steps,
+    length: steps.length,
+    cost,
+    technique: steps.map((step) => step.edge.kind).join(" -> ")
+  };
+}
+function shortestPaths(graph, sourceIds, targetIds, opts = {}) {
+  const maxDepth = Math.max(1, opts.maxDepth ?? DEFAULT_MAX_DEPTH);
+  const maxResults = Math.max(1, opts.maxResults ?? DEFAULT_MAX_RESULTS);
+  const maxExpansions = Math.max(1, opts.maxExpansions ?? DEFAULT_MAX_EXPANSIONS);
+  const passesFilter = resolveEdgeFilter(opts);
+  const edgeCost = resolveEdgeCost(opts);
+  const describeEdge = opts.describeEdge ?? ((edge) => describeEdgeTechnique(edge.kind));
+  const targets = /* @__PURE__ */ new Set();
+  for (const id of targetIds)
+    if (graph.nodes.has(id))
+      targets.add(id);
+  if (targets.size === 0)
+    return [];
+  const labelNode = [];
+  const labelCost = [];
+  const labelDepth = [];
+  const labelEdge = [];
+  const labelPrev = [];
+  const heap = new LabelHeap(labelCost, labelDepth);
+  const bestCostByDepth = /* @__PURE__ */ new Map();
+  const admit = (node, cost, depth, edgeIndex, prev) => {
+    let frontier = bestCostByDepth.get(node);
+    if (!frontier) {
+      frontier = new Array(maxDepth + 1).fill(Number.POSITIVE_INFINITY);
+      bestCostByDepth.set(node, frontier);
+    }
+    if (cost >= frontier[depth])
+      return false;
+    for (let d = depth; d <= maxDepth; d += 1) {
+      if (frontier[d] <= cost)
+        break;
+      frontier[d] = cost;
+    }
+    const label = labelNode.length;
+    labelNode.push(node);
+    labelCost.push(cost);
+    labelDepth.push(depth);
+    labelEdge.push(edgeIndex);
+    labelPrev.push(prev);
+    heap.push(label);
+    return true;
+  };
+  let seeded = false;
+  for (const id of sourceIds) {
+    if (!graph.nodes.has(id))
+      continue;
+    if (admit(id, 0, 0, -1, -1))
+      seeded = true;
+  }
+  if (!seeded)
+    return [];
+  const bestLabelByTarget = /* @__PURE__ */ new Map();
+  let expansions = 0;
+  while (heap.size > 0 && bestLabelByTarget.size < targets.size && expansions < maxExpansions) {
+    const label = heap.pop();
+    const node = labelNode[label];
+    const cost = labelCost[label];
+    const depth = labelDepth[label];
+    if (cost > bestCostByDepth.get(node)[depth])
+      continue;
+    if (depth > 0 && targets.has(node) && !bestLabelByTarget.has(node)) {
+      bestLabelByTarget.set(node, label);
+    }
+    if (depth >= maxDepth)
+      continue;
+    for (const edgeIndex of graph.outbound.get(node) ?? []) {
+      const edge = graph.edges[edgeIndex];
+      if (!passesFilter(edge))
+        continue;
+      expansions += 1;
+      if (expansions >= maxExpansions)
+        break;
+      admit(edge.target, cost + edgeCost(edge), depth + 1, edgeIndex, label);
+    }
+  }
+  const paths = [];
+  for (const label of bestLabelByTarget.values()) {
+    const edgeIndices = [];
+    for (let cursor = label; cursor !== -1; cursor = labelPrev[cursor]) {
+      const edgeIndex = labelEdge[cursor];
+      if (edgeIndex !== -1)
+        edgeIndices.push(edgeIndex);
+    }
+    edgeIndices.reverse();
+    const path = buildAttackPath(graph, edgeIndices, edgeCost, describeEdge);
+    if (path)
+      paths.push(path);
+  }
+  paths.sort((a, b) => a.cost - b.cost || a.length - b.length || a.targetId.localeCompare(b.targetId));
+  return paths.slice(0, maxResults);
+}
+function bfs(graph, startIds, maxDepth, index, step, opts) {
+  const passesFilter = resolveEdgeFilter(opts);
+  const maxExpansions = Math.max(1, opts.maxExpansions ?? DEFAULT_MAX_EXPANSIONS);
+  const depths = /* @__PURE__ */ new Map();
+  let frontier = [];
+  for (const id of startIds) {
+    if (!graph.nodes.has(id) || depths.has(id))
+      continue;
+    depths.set(id, 0);
+    frontier.push(id);
+  }
+  let expansions = 0;
+  for (let depth = 0; depth < Math.max(0, maxDepth) && frontier.length > 0; depth += 1) {
+    const next = [];
+    for (const node of frontier) {
+      for (const edgeIndex of index.get(node) ?? []) {
+        const edge = graph.edges[edgeIndex];
+        if (!passesFilter(edge))
+          continue;
+        if (++expansions >= maxExpansions)
+          return depths;
+        const neighbour = step(edge);
+        if (depths.has(neighbour))
+          continue;
+        depths.set(neighbour, depth + 1);
+        next.push(neighbour);
+      }
+    }
+    frontier = next;
+  }
+  return depths;
+}
+function reachableFrom(graph, sourceIds, maxDepth = DEFAULT_MAX_DEPTH, opts = {}) {
+  return bfs(graph, sourceIds, maxDepth, graph.outbound, (edge) => edge.target, opts);
+}
+function reachableTo(graph, targetIds, maxDepth = DEFAULT_MAX_DEPTH, opts = {}) {
+  return bfs(graph, targetIds, maxDepth, graph.inbound, (edge) => edge.source, opts);
+}
+function nodeOrStub(graph, objectId) {
+  return graph.nodes.get(objectId) ?? { objectId, label: objectId, kind: "Base", properties: {}, stub: true };
+}
+
+// packages/core/dist/adgraph/analyzers.js
+var TIER0_DOMAIN_RIDS = ["512", "516", "518", "519", "521", "526", "527"];
+var DOMAIN_ADMIN_RIDS = ["512", "519"];
+var BUILTIN_ADMINISTRATORS = "S-1-5-32-544";
+var TIER0_BUILTIN_SIDS = [
+  BUILTIN_ADMINISTRATORS,
+  "S-1-5-32-548",
+  // Account Operators
+  "S-1-5-32-549",
+  // Server Operators
+  "S-1-5-32-550",
+  // Print Operators
+  "S-1-5-32-551"
+  // Backup Operators
+];
+var DEFAULT_REPLICATION_HOLDER_SIDS = /* @__PURE__ */ new Set(["S-1-5-9", "S-1-5-32-544"]);
+var DEFAULT_REPLICATION_HOLDER_RIDS = ["512", "516", "518", "519", "498", "521"];
+var DOMAIN_CONTROLLER_RIDS = ["516", "521"];
+var DANGEROUS_ACL_EDGES = [
+  "GenericAll",
+  "GenericWrite",
+  "WriteDacl",
+  "WriteOwner",
+  "Owns",
+  "AllExtendedRights",
+  "ForceChangePassword",
+  "AddMember",
+  "AddSelf",
+  "AddKeyCredentialLink",
+  "WriteSPN",
+  "WriteAccountRestrictions",
+  "WriteGPLink"
+];
+var ADCS_ABUSE_EDGES = [
+  "GoldenCert",
+  "ManageCA",
+  "ManageCertificates",
+  "WritePKIEnrollmentFlag",
+  "WritePKINameFlag",
+  "CanAbuseUPNCertMapping",
+  "CanAbuseWeakCertBinding"
+];
+function resolveOptions(opts) {
+  const maxDepth = Math.max(1, opts.maxDepth ?? 6);
+  return {
+    maxDepth,
+    maxPathsPerFinding: Math.max(1, opts.maxPathsPerFinding ?? 5),
+    maxFindingsPerAnalyzer: Math.max(1, opts.maxFindingsPerAnalyzer ?? 25),
+    includeDefaultPrivileged: opts.includeDefaultPrivileged ?? false,
+    traversal: { maxDepth, ...opts.traversal }
+  };
+}
+function slug(...parts) {
+  return parts.map((part) => part.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "x").join(":");
+}
+function hasRid(objectId, rids) {
+  return rids.some((rid) => objectId.endsWith(`-${rid}`));
+}
+function isTrue(value) {
+  return value === true || value === "true" || value === "True";
+}
+function isEnabled(node) {
+  return node.properties.enabled !== false;
+}
+function nodesOfKind(graph, kind) {
+  const ids = graph.nodesByKind.get(kind) ?? [];
+  const out = [];
+  for (const id of ids) {
+    const node = graph.nodes.get(id);
+    if (node)
+      out.push(node);
+  }
+  return out;
+}
+function singleEdgePaths(graph, edgeIndices, cap) {
+  const paths = [];
+  for (const edgeIndex of edgeIndices.slice(0, cap)) {
+    const path = buildAttackPath(graph, [edgeIndex]);
+    if (path)
+      paths.push(path);
+  }
+  return paths;
+}
+function finding(analyzer, id, severity, title, description, remediation, paths, affectedPrincipals, evidence) {
+  return {
+    id: `adgraph:${analyzer}:${id}`,
+    analyzer,
+    title,
+    severity,
+    description,
+    paths,
+    affectedPrincipals: [...new Set(affectedPrincipals)],
+    remediation,
+    ...evidence ? { evidence } : {}
+  };
+}
+function domainAdminGroupIds(graph) {
+  const out = [];
+  for (const node of nodesOfKind(graph, "Group")) {
+    if (hasRid(node.objectId, DOMAIN_ADMIN_RIDS) || node.objectId === BUILTIN_ADMINISTRATORS) {
+      out.push(node.objectId);
+    }
+  }
+  return out;
+}
+function highValueTargetIds(graph, extra) {
+  const out = new Set(extra ?? []);
+  for (const node of nodesOfKind(graph, "Group")) {
+    if (hasRid(node.objectId, TIER0_DOMAIN_RIDS) || TIER0_BUILTIN_SIDS.includes(node.objectId)) {
+      out.add(node.objectId);
+    }
+  }
+  for (const node of nodesOfKind(graph, "Domain"))
+    out.add(node.objectId);
+  for (const node of graph.nodes.values()) {
+    if (isTrue(node.properties.highvalue))
+      out.add(node.objectId);
+  }
+  return out;
+}
+function isDomainController(graph, node) {
+  if (isTrue(node.properties.isdc))
+    return true;
+  const dn = String(node.properties.distinguishedname ?? "").toUpperCase();
+  if (dn.includes("OU=DOMAIN CONTROLLERS"))
+    return true;
+  for (const edgeIndex of graph.outbound.get(node.objectId) ?? []) {
+    const edge = graph.edges[edgeIndex];
+    if (edge.kind === "MemberOf" && hasRid(edge.target, DOMAIN_CONTROLLER_RIDS))
+      return true;
+  }
+  return false;
+}
+function candidateSources(graph, opts, highValue) {
+  if (opts.ownedPrincipalIds) {
+    return [...opts.ownedPrincipalIds].filter((id) => graph.nodes.has(id));
+  }
+  return nodesOfKind(graph, "User").filter((node) => isEnabled(node) && !highValue.has(node.objectId) && !isTrue(node.properties.admincount)).map((node) => node.objectId);
+}
+function findPathsToDomainAdmin(graph, opts = {}) {
+  const resolved = resolveOptions(opts);
+  const targets = domainAdminGroupIds(graph);
+  if (targets.length === 0)
+    return [];
+  const highValue = highValueTargetIds(graph, opts.highValueIds);
+  const sources = candidateSources(graph, opts, highValue);
+  if (sources.length === 0)
+    return [];
+  const findings = [];
+  for (const targetId of targets) {
+    if (findings.length >= resolved.maxFindingsPerAnalyzer)
+      break;
+    const target = graph.nodes.get(targetId);
+    const distances = reachableTo(graph, [targetId], resolved.maxDepth, resolved.traversal);
+    const reaching = sources.filter((id) => id !== targetId && distances.has(id)).sort((a, b) => distances.get(a) - distances.get(b) || a.localeCompare(b));
+    if (reaching.length === 0)
+      continue;
+    const paths = [];
+    for (const sourceId of reaching.slice(0, resolved.maxPathsPerFinding)) {
+      const [path] = shortestPaths(graph, [sourceId], [targetId], {
+        ...resolved.traversal,
+        maxResults: 1
+      });
+      if (path)
+        paths.push(path);
+    }
+    if (paths.length === 0)
+      continue;
+    findings.push(finding("paths-to-domain-admin", slug(targetId), "critical", `Attack path from unprivileged principals to ${target.label}`, `${reaching.length} unprivileged principal(s) can reach ${target.label} within ${resolved.maxDepth} hops. The shortest path takes ${paths[0].length} hop(s): ${paths[0].technique}.`, `Break the shortest hop first \u2014 it is usually a single over-broad ACL or a stale local-admin membership. Move ${target.label} into a Tier-0 admin tier, remove standing membership in favour of just-in-time elevation, and re-run collection to confirm the path is gone.`, paths, reaching.slice(0, 100), {
+      targetId,
+      reachingPrincipalCount: reaching.length,
+      shortestPathLength: paths[0].length
+    }));
+  }
+  return findings;
+}
+function findKerberoastablePaths(graph, opts = {}) {
+  const resolved = resolveOptions(opts);
+  const highValue = highValueTargetIds(graph, opts.highValueIds);
+  const roastable = nodesOfKind(graph, "User").filter((node) => isTrue(node.properties.hasspn) && isEnabled(node));
+  if (roastable.length === 0)
+    return [];
+  const distances = reachableTo(graph, highValue, resolved.maxDepth, resolved.traversal);
+  const findings = [];
+  for (const node of roastable) {
+    if (findings.length >= resolved.maxFindingsPerAnalyzer)
+      break;
+    const alreadyPrivileged = highValue.has(node.objectId) || isTrue(node.properties.admincount);
+    if (!alreadyPrivileged && !distances.has(node.objectId))
+      continue;
+    const paths = alreadyPrivileged ? [] : shortestPaths(graph, [node.objectId], highValue, {
+      ...resolved.traversal,
+      maxResults: resolved.maxPathsPerFinding
+    });
+    if (!alreadyPrivileged && paths.length === 0)
+      continue;
+    const description = alreadyPrivileged ? `${node.label} has an SPN and is itself a Tier-0 principal. Any domain user can request a service ticket for it and crack the hash offline, yielding privileged access directly.` : `${node.label} has an SPN and reaches ${paths.length} high-value target(s) within ${resolved.maxDepth} hops. Cracking its password gives an attacker the whole path: ${paths[0].technique}.`;
+    findings.push(finding("kerberoastable-paths", slug(node.objectId), alreadyPrivileged ? "critical" : "high", `Kerberoastable account with a path to privilege: ${node.label}`, description, `Move ${node.label} to a group Managed Service Account so the password is machine-generated and rotated automatically. If that is not possible, set a 25+ character random password and remove the account's privileged group memberships.`, paths, [node.objectId], {
+      hasSpn: true,
+      alreadyPrivileged,
+      servicePrincipalNames: node.properties.serviceprincipalnames,
+      pwdLastSet: node.properties.pwdlastset
+    }));
+  }
+  return findings;
+}
+function findUnconstrainedDelegation(graph, opts = {}) {
+  const resolved = resolveOptions(opts);
+  const findings = [];
+  const candidates = [...nodesOfKind(graph, "Computer"), ...nodesOfKind(graph, "User")];
+  for (const node of candidates) {
+    if (findings.length >= resolved.maxFindingsPerAnalyzer)
+      break;
+    if (!isTrue(node.properties.unconstraineddelegation))
+      continue;
+    if (!isEnabled(node))
+      continue;
+    if (node.kind === "Computer" && isDomainController(graph, node))
+      continue;
+    const controlEdges = [];
+    const controllers = [];
+    for (const edgeIndex of graph.inbound.get(node.objectId) ?? []) {
+      const edge = graph.edges[edgeIndex];
+      if (edge.kind === "MemberOf" || edge.kind === "Contains")
+        continue;
+      controlEdges.push(edgeIndex);
+      controllers.push(edge.source);
+    }
+    findings.push(finding("unconstrained-delegation", slug(node.objectId), "critical", `Unconstrained delegation on ${node.label}`, `${node.label} is trusted for unconstrained delegation and is not a domain controller. An attacker controlling this host can coerce a DC into authenticating to it, capture the DC's TGT from memory, and replay it to replicate domain secrets. ${controllers.length} principal(s) already hold a direct relationship over it.`, `Clear the TRUSTED_FOR_DELEGATION flag on ${node.label} and switch the service to resource-based constrained delegation. Add Tier-0 accounts to the Protected Users group and mark them "sensitive and cannot be delegated" so their tickets are never cacheable here.`, singleEdgePaths(graph, controlEdges, resolved.maxPathsPerFinding), [node.objectId, ...controllers], {
+      objectId: node.objectId,
+      kind: node.kind,
+      operatingSystem: node.properties.operatingsystem,
+      directControllerCount: controllers.length
+    }));
+  }
+  return findings;
+}
+function findDcsyncPrincipals(graph, opts = {}) {
+  const resolved = resolveOptions(opts);
+  const findings = [];
+  for (const domain of nodesOfKind(graph, "Domain")) {
+    const rights = /* @__PURE__ */ new Map();
+    for (const edgeIndex of graph.inbound.get(domain.objectId) ?? []) {
+      const edge = graph.edges[edgeIndex];
+      if (edge.kind !== "DCSync" && edge.kind !== "GetChanges" && edge.kind !== "GetChangesAll")
+        continue;
+      let entry = rights.get(edge.source);
+      if (!entry) {
+        entry = { kinds: /* @__PURE__ */ new Set(), edges: [] };
+        rights.set(edge.source, entry);
+      }
+      entry.kinds.add(edge.kind);
+      entry.edges.push(edgeIndex);
+    }
+    for (const [principalId, entry] of rights) {
+      if (findings.length >= resolved.maxFindingsPerAnalyzer)
+        break;
+      const viaDcsyncEdge = entry.kinds.has("DCSync");
+      const viaReplicationPair = entry.kinds.has("GetChanges") && entry.kinds.has("GetChangesAll");
+      if (!viaDcsyncEdge && !viaReplicationPair)
+        continue;
+      const isDefault = DEFAULT_REPLICATION_HOLDER_SIDS.has(principalId) || hasRid(principalId, DEFAULT_REPLICATION_HOLDER_RIDS);
+      if (isDefault && !resolved.includeDefaultPrivileged)
+        continue;
+      const principal = graph.nodes.get(principalId);
+      if (!principal)
+        continue;
+      if (principal.kind === "Computer" && isDomainController(graph, principal) && !resolved.includeDefaultPrivileged) {
+        continue;
+      }
+      const inherited = [...reachableTo(graph, [principalId], resolved.maxDepth, {
+        ...resolved.traversal,
+        allowedEdgeKinds: ["MemberOf"]
+      }).keys()].filter((id) => id !== principalId);
+      findings.push(finding("dcsync-principals", slug(domain.objectId, principalId), "critical", `${principal.label} can DCSync ${domain.label}`, `${principal.label} holds ${viaDcsyncEdge ? "a DCSync right" : "both GetChanges and GetChangesAll"} on ${domain.label} and is not a domain controller or a default replication holder. That is enough to replicate every credential in the domain, including the krbtgt hash, which enables Golden Ticket forgery. ${inherited.length} principal(s) inherit this through group membership.`, `Remove the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All ACEs for ${principal.label} from the domain head. Replication rights belong to domain controllers and to directory-sync service accounts that are managed as Tier 0.`, singleEdgePaths(graph, entry.edges, resolved.maxPathsPerFinding), [principalId, ...inherited.slice(0, 100)], {
+        domainId: domain.objectId,
+        grantedBy: [...entry.kinds],
+        inheritedByCount: inherited.length
+      }));
+    }
+  }
+  return findings;
+}
+function findAclAbuseChains(graph, opts = {}) {
+  const resolved = resolveOptions(opts);
+  const highValue = highValueTargetIds(graph, opts.highValueIds);
+  if (highValue.size === 0)
+    return [];
+  const bySource = /* @__PURE__ */ new Map();
+  for (const kind of DANGEROUS_ACL_EDGES) {
+    for (const edgeIndex of graph.edgesByKind.get(kind) ?? []) {
+      const edge = graph.edges[edgeIndex];
+      if (!highValue.has(edge.target))
+        continue;
+      if (highValue.has(edge.source))
+        continue;
+      const source = graph.nodes.get(edge.source);
+      if (!source)
+        continue;
+      if (!resolved.includeDefaultPrivileged && hasRid(edge.source, TIER0_DOMAIN_RIDS))
+        continue;
+      const bucket = bySource.get(edge.source);
+      if (bucket)
+        bucket.push(edgeIndex);
+      else
+        bySource.set(edge.source, [edgeIndex]);
+    }
+  }
+  const findings = [];
+  for (const [sourceId, edgeIndices] of bySource) {
+    if (findings.length >= resolved.maxFindingsPerAnalyzer)
+      break;
+    const source = graph.nodes.get(sourceId);
+    const kinds = [...new Set(edgeIndices.map((index) => graph.edges[index].kind))];
+    const targets = [...new Set(edgeIndices.map((index) => graph.edges[index].target))];
+    const inherited = [...reachableTo(graph, [sourceId], resolved.maxDepth, {
+      ...resolved.traversal,
+      allowedEdgeKinds: ["MemberOf"]
+    }).keys()].filter((id) => id !== sourceId);
+    findings.push(finding("acl-abuse-chains", slug(sourceId), "high", `${source.label} holds ${kinds.join("/")} over ${targets.length} Tier-0 object(s)`, `${source.label} is not a Tier-0 principal yet holds ${kinds.join(", ")} over ${targets.length} high-value object(s). Any of these rights can be converted into membership or control of the target in a single step, so compromising ${source.label} is equivalent to compromising Tier 0. ${inherited.length} principal(s) inherit these rights through group membership.`, `Remove the ACEs granting ${source.label} control over Tier-0 objects, or promote and manage it as a Tier-0 principal itself. Enable AdminSDHolder protection on the affected objects so the ACL is restored automatically if it is loosened again.`, singleEdgePaths(graph, edgeIndices, resolved.maxPathsPerFinding), [sourceId, ...inherited.slice(0, 100)], {
+      rightKinds: kinds,
+      targetIds: targets.slice(0, 50),
+      inheritedByCount: inherited.length
+    }));
+  }
+  return findings;
+}
+function findAdcsEscalation(graph, opts = {}) {
+  const resolved = resolveOptions(opts);
+  const findings = [];
+  const relevantKinds = [];
+  for (const kind of graph.edgesByKind.keys()) {
+    if (/^ADCSESC/i.test(kind) || ADCS_ABUSE_EDGES.includes(kind))
+      relevantKinds.push(kind);
+  }
+  relevantKinds.sort();
+  for (const kind of relevantKinds) {
+    if (findings.length >= resolved.maxFindingsPerAnalyzer)
+      break;
+    const edgeIndices = graph.edgesByKind.get(kind) ?? [];
+    if (edgeIndices.length === 0)
+      continue;
+    const principals = [...new Set(edgeIndices.map((index) => graph.edges[index].source))];
+    const targets = [...new Set(edgeIndices.map((index) => graph.edges[index].target))];
+    const isEsc = /^ADCSESC/i.test(kind);
+    findings.push(finding("adcs-escalation", slug(kind), isEsc || kind === "GoldenCert" ? "critical" : "high", `ADCS escalation available: ${kind}`, `${principals.length} principal(s) hold the ${kind} relationship over ${targets.length} certificate-services object(s). This lets an attacker obtain a certificate that authenticates as a higher-privileged principal, which survives a password reset and is usable until the certificate expires or is revoked.`, `Audit the affected certificate templates and CAs. Remove caller-supplied subject names (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT), require manager approval or authorised signatures for client-authentication templates, restrict enrollment rights to the principals that need them, and clear EDITF_ATTRIBUTESUBJECTALTNAME2 on the CA. Revoke certificates already issued under the vulnerable configuration.`, singleEdgePaths(graph, edgeIndices, resolved.maxPathsPerFinding), principals.slice(0, 100), {
+      edgeKind: kind,
+      edgeCount: edgeIndices.length,
+      targetIds: targets.slice(0, 50)
+    }));
+  }
+  return findings;
+}
+var AD_ANALYZERS = [
+  findPathsToDomainAdmin,
+  findDcsyncPrincipals,
+  findUnconstrainedDelegation,
+  findAdcsEscalation,
+  findAclAbuseChains,
+  findKerberoastablePaths
+];
+
+export {
+  AD_EDGE_TECHNIQUES,
+  describeEdgeTechnique,
+  buildAttackPath,
+  shortestPaths,
+  reachableFrom,
+  reachableTo,
+  nodeOrStub,
+  domainAdminGroupIds,
+  highValueTargetIds,
+  findPathsToDomainAdmin,
+  findKerberoastablePaths,
+  findUnconstrainedDelegation,
+  findDcsyncPrincipals,
+  findAclAbuseChains,
+  findAdcsEscalation,
+  AD_ANALYZERS
+};