Skip to content

ADscan 9.2.1

Choose a tag to compare

View all tags
@ADScanPro ADScanPro released this 29 Jun 21:26
· 27 commits to main since this release
v9.2.1
118e6f7

Added

  • New adscan doctor preflight command: a non-interactive connection and environment check (reachability, enabled-user count, trust discovery) with JSON output. It also powers a live "Validate connection" console in the platform so you can confirm a target is ready before launching a scan.
  • New adscan execute <verb> command to run a single step non-interactively without a full scan.
  • Per-phase scan configuration: a dynamic "Create New Scan" form in the platform, and a --scan-config file for the CLI, to choose which phases, subphases and collectors run, scope the CVE check, and set lockout-safe spraying.
  • Live scan visibility in the platform: watch hosts and users get discovered and compromised during a scan, with rate/ETA/elapsed progress for long steps (spraying, cracking, roasting, SMB/LDAP collection) at multi-thousand-host scale, and per-node provenance showing who was compromised, how, and the step that proves it.
  • Share Exposure view: the SMB share tree with per-principal effective access, sensitive-file surfacing, and links to the related findings.
  • Privilege Tier and Compromise Reach model across the CLI, report and platform: Tier 0/1/2 classification, a client glossary explaining it, tier breakdowns on the domain-takeover KPIs, and consistent reach labels.
  • Cleanup and rollback reporting in the report and platform: every change ADscan made to the environment, split into reverted-and-verified versus manual-cleanup-required.
  • Per-account credential provenance in the report and platform: how each credential was obtained, replacing generic "via unknown" attribution.
  • Group Managed Service Accounts (gMSAs) are now tagged and kept in the Users inventory instead of being dropped alongside trust accounts.

Changed

  • Reach severity is now graded by the target's Privilege Tier and the access edge's control strength (full local admin outranks a remote session, which outranks database-only access), sharpening attack-path ordering.
  • adscan update now reliably upgrades the launcher itself, and stale-runtime-image warnings are prominent and tell you to run it.
  • The SMB enrichment sweep can be stopped early by the operator, from the CLI (Ctrl+C) or a button in the platform.

Fixed

  • Kerberos service-ticket and AS-REP hashes are now routed to the correct cracking mode per encryption type. On AES-only and hardened domains these hashes were previously sent to an RC4-only mode and silently never attempted.
  • Credential verification now falls back to an NTLM bind when the Kerberos KDC is unreachable but LDAP/SMB is available, instead of failing with a misleading "verify the credential" message.
  • Multi-host SMB sweeps now stop on account lockout instead of re-triggering the lockout across every remaining host.
  • Share Exposure no longer reports a false Write or Full-Control right; rows whose NTFS permissions could not be verified are flagged as such.
  • A DCSync capability already held by a domain-breaking principal is no longer reported as a separate finding.
  • adscan deliver --frameworks now applies the selected compliance frameworks to the bonus documents (hardening playbook and remediation checklist), not just the main report.
  • CLI numeric and selection prompts no longer hang or crash in non-interactive runs.

Removed

  • The WeasyPrint PDF path was removed; Chromium is now the sole report engine and the only --report-engine choice.
Assets 2
Loading