mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 00:23:15 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

2.5 KiB

Raw Blame History

Active Directory Vulnerability Assessment - API Reference

PingCastle XML Report

PingCastle generates XML health check reports with scoring across four categories:

Category	Description
StaleObjects	Dormant accounts, old computer objects, unused groups
PrivilegiedGroup	Excessive admin memberships, unprotected privileged accounts
Trust	Insecure trust relationships, SID filtering
Anomaly	Unusual configurations, legacy protocols

Score Interpretation

0-20: Excellent
21-50: Good
51-75: Needs improvement
76-100: Critical

XML Structure

<HealthcheckData>
  <GlobalScore>45</GlobalScore>
  <StaleObjectsScore>15</StaleObjectsScore>
  <PrivilegiedGroupScore>20</PrivilegiedGroupScore>
  <RiskRules>
    <HealthcheckRiskRule>
      <RiskId>P-AdminCount</RiskId>
      <Category>PrivilegiedGroup</Category>
      <Points>30</Points>
      <Rationale>15 accounts with adminCount=1</Rationale>
    </HealthcheckRiskRule>
  </RiskRules>
</HealthcheckData>

LDAP Checks (ldap3)

Password Policy Attributes

Attribute	Type	Description
`minPwdLength`	int	Minimum password length
`lockoutThreshold`	int	Failed attempts before lockout (0 = disabled)
`pwdHistoryLength`	int	Number of remembered passwords
`maxPwdAge`	interval	Maximum password age

krbtgt Account

The krbtgt account key encrypts all Kerberos tickets. If compromised (Golden Ticket attack), all tickets must be invalidated by resetting krbtgt password twice. Recommended rotation: every 180 days.

conn.search(base_dn, "(&(objectClass=user)(sAMAccountName=krbtgt))",
            attributes=["pwdLastSet"])

Vulnerability Categories

Critical

No account lockout policy
krbtgt password > 180 days old
PingCastle risk rules with 50+ points

High

Minimum password length < 12
Accounts with adminCount=1 not in privileged groups
Legacy protocols enabled (NTLMv1, LM hashes)

Medium

Password history < 12
Stale computer objects > 90 days
Unconstrained delegation

Output Schema

{
  "report": "ad_vulnerability_assessment",
  "pingcastle_scores": {"global": 45, "staleobjects": 15},
  "total_findings": 20,
  "severity_summary": {"critical": 3, "high": 10, "medium": 7}
}

CLI Usage

python agent.py --pingcastle-xml report.xml --server ldaps://dc.example.com --username "DOMAIN\\user" --password "pass" --output report.json

2.5 KiB Raw Blame History