Skip to content

WAC 4.0.0

Choose a tag to compare

View all tags
@reygiss reygiss released this 08 Nov 15:31
· 92 commits to master since this release
4.0.0
9d44171

WAC 4.0.0 — Windows servers, the directory and websites

Servers

  • Every generation from Server 2003 to 2025, and Server 2022 Core, collected by the same executables (WAC32 for Server 2003), each measured by the test cycle on the server itself. Artefacts absent from a version or from a Core installation are said so (CollectionStatus) instead of failing.
  • Domain controllers: ntds.dit and its logs copied raw (no LDAP, no replication) and replayed in the working copy; every object, deleted ones included, linked values with their removal dates, replication metadata attribute by attribute, security descriptors (DCSync rights). The directory's secrets are neither read nor written: only a closed list of attributes is decoded.
  • Group policies: SYSVOL read the same way — Registry.pol, scripts, scheduled tasks of the preferences, security template; a cpassword is flagged by its file, its value not written.
  • Web servers: IIS, Apache and nginx found by their configuration and services — sites, pools, modules, access and error logs in UTC, each site's folder copied whole; SQLite accounts with their hash scheme; MySQL, MariaDB and PostgreSQL data folders collected.
  • Roles: DNS (settings and plug-in DLLs, zones, debug log), DHCP (scopes and leases of dhcp.mdb, audit logs), Hyper-V (machines and their disks' paths), and User Access Logging (LogFiles\Sum): by role, account and address, who reached the server and on which days.

Security review

A full review of the 4.0.0 code before publication: 8 findings fixed, each with the test that catches it (forged NTFS index name written out of the exhibit store, .. of a web configuration read out of the collection, Apache Define chain exhausting memory, SQLite 3.54.1 with neither views nor triggers in a forged database, uncaught exception ending a collection unsealed, and smaller ones).

Fixes since the last measurements

  • The shipped verification scripts (verify-exhibits, verifier-consigne) accept a file name holding a lone half of a UTF-16 surrogate pair (Server 2016 names its User Access Logging databases so): the PowerShell one called the exhibit unreadable, the Linux one refused the whole manifest.
  • A conversion that cannot delete the previous working copy gives the real Windows error and the entry that holds, no longer a fixed "access denied".

Measured

Final series on 7 and 8 November 2026, WAC started from a USB key as in the field: Windows 11 605 checks; Server 2025 566, 2022 586, Core 2022 534, 2019 540, 2016 521, 2012 R2 505, 2012 497, 2008 R2 431, Server 2003 109; domain controller 2022 609. On 4 November, on that controller: 3,711 directory objects identical to Get-ADObject, 145,421 ntds.dit values identical to dissect.esedb. Manuals, validation, harmlessness and comparison files, and the article, in French and English.

Files

WAC.exe (x64), WAC32.exe (x86: XP SP1 to 8, Server 2003), wac.yml, verify-exhibits.ps1|.sh, verifier-consigne.ps1|.sh, raw_hive_test.exe, SHA256SUMS.

Documentation (PDF, French and English, as on master at 9de6ea2)

User manual (documentation_FR|EN), testing guide (testing_FR|EN), validation (validation_FR|EN), harmlessness (harmlessness_FR|EN) and comparison (comparison_FR|EN) files, and the article (article_FR|EN_4.0). The documents were brought up to date after the tag (final series as reference result, every test harness described, ATT&CK coverage with User Access Logging and the DNS role: 476 of 479 techniques); the binaries are unchanged.

Assets 23
Loading