ADscan 9.1.0

Added

• SPN-jacking attack path. ADscan now detects and executes SPN-jacking with constrained delegation: it relocates a service principal name onto a target computer and impersonates a privileged user against it, turning a write-over-a-machine-account right into a full compromise path. Modeled in the attack graph and shown in reports.
• NTLMv1 exposure across the estate. A per-host sweep classifies which machines still negotiate NTLMv1 (not only the domain controller), with a live classification dashboard and a review table that flags NTLMv1 hosts as the actionable targets. The resulting coerce-to-relay and offline-crack techniques are modeled as attack steps with business labels and compliance mappings for ENS, NIS2, DORA, ISO 27001, and PCI DSS.
• NTLM-relay-to-LDAP workflow. A new relay command coerces a target, relays the authentication to LDAP, and writes either resource-based delegation or Shadow Credentials, then mints a service ticket to continue the chain. It opens with a go/no-go feasibility panel, resolves the victim's name automatically, can reuse an existing controlled machine account instead of creating a new one, and tracks every change it makes for clean rollback.
• Credential capture via writable-share bait. ADscan can drop a passive bait file into a writable share so that a user who merely browses the folder authenticates to ADscan, capturing their NTLM response. Supports per-folder targeting across multiple shares under one listener, reports the actual captured version (NTLMv1 flagged as higher value), and offers to crack the captured hash offline.
• MSSQL escalation to Domain Admin through service-account impersonation. When a SQL service account owns its own service principal name, ADscan can impersonate a privileged account to reach database sysadmin. On a domain controller, takeover now offers either creating a new Domain Admin account or promoting an already-controlled user.
• Effective share access. SMB share enumeration reports effective access (share permissions intersected with the underlying NTFS permissions) instead of share-level permissions alone, removing false "writable" results on hardened file servers.
• Progress feedback for long operations. SMB collection, Kerberos user enumeration, password spraying, and the important-port scan now show a live progress dashboard, with an up-front notice when a run is expected to take a while.
• Collection scope selector. At the start of domain collection you can choose which sub-collections run (directory/ACL base, local accounts, shares) for a faster directory-only pass.

Changed

• Attack paths are ordered by how directly they reach domain compromise, and a foothold on a Tier 0 asset where control is still pending appears in its own "Tier 0 Footholds" section rather than being counted as a full domain compromise.
• Domain controller and KDC address selection is now reachability-aware, so ADscan uses the address it can actually reach on multi-homed hosts and over VPN instead of an internal, unroutable one.
• Large-estate SMB collection skips hosts that do not answer on the SMB port and skips disabled computer accounts, cutting scan time substantially (per-host timeouts on dead hosts were the main bottleneck).
• Durable AD objects ADscan creates during an engagement (machine accounts, delegation grants) are kept on success and reverted on failure, and the exit "revert these changes?" prompt now defaults to reverting so pressing Enter leaves a clean environment.
• Accounts ADscan mints (during MSSQL and relay workflows) now get a policy-compliant password by default, an editable name and password, and are rolled back automatically after use.

Fixed

• Reliable operation against hardened domain controllers. NTLM-disabled / Kerberos-only DCs, AES-only KDCs with a non-default Kerberos salt, DCs enforcing LDAP signing and channel binding, and restricted-anonymous DCs are now detected and handled correctly. This resolves cases where the attack-graph collector returned no results, authentication or certificate enrollment failed, or a hardening control was mis-reported.
• Credential coercion now works against member servers and patched/hardened hosts that previously returned access-denied.
• Trust enumeration no longer misroutes to the wrong domain controller for a trusted domain, which had caused failed cross-domain lookups.
• Password reset via the ForceChangePassword right works again; a regression had corrupted the new password value and produced a misleading "insufficient rights" message.
• Cracking of Kerberos service-ticket and AS-REP hashes no longer silently fails to load the hashes.
• Attack paths no longer show false positives in which reaching a host through a user-level session was treated as owning that host.
• ADCS web enrollment (ESC8) is no longer falsely reported on hosts running unrelated web services with no certificate endpoint.
• Flag collection survives domain controllers that aggressively reset SMB sessions and now finds flags in custom top-level and domain-suffixed profile directories.
• Blank-password default accounts (such as Guest) are no longer stored or reused as credentials.
• The listener used for credential capture no longer crashes on connections from modern Windows SMB clients.
• The LITE post-scan panel no longer lists commands that do not exist.

Removed

• (none)