daemon-sec-lotl

split-impacket.mjs (5606B)

---

 /**
  * One-time, idempotent migration of the committed dataset:
  *
  *   1. Split the umbrella `wadcoms:Impacket` tool into one tool per impacket
  *      example script (secretsdump.py, ntlmrelayx.py, psexec.py, …).
  *   2. Fold case-duplicate WADComs families (Enum4Linux / enum4linux) onto one
  *      canonical page so no tool's techniques are silently dropped by the
  *      static router.
  *
  * It reads and rewrites the checked-in JSON directly, because the full builder
  * (build-dataset.mjs) needs the vendored upstreams under vendor/ which are not
  * present at deploy/dev time. build-dataset.mjs applies the *same*
  * normalisations (via wadcoms-normalize.mjs), so a future `npm run data` with
  * vendor/ present produces an identical result.
  *
  * The WADComs tool records are fully derived from their techniques, so the
  * migration rebuilds EVERY `wadcoms:` tool from the transformed techniques
  * (mirroring the builder's toolsFromWad) and asserts that unaffected tools are
  * bit-for-bit unchanged — leaving GTFOBins / LOLBAS / daemon tools alone.
  *
  * Safe to re-run: once the split is applied there is no `wadcoms:Impacket`
  * left, and the case-fold is a no-op the second time.
  */
 import { readFileSync, writeFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, resolve } from 'node:path';
 import { splitImpacket, canonicalizeFamilyCase } from './wadcoms-normalize.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = resolve(__dirname, '..');
 const SRC = join(ROOT, 'src', 'data');
 
 const uniq = (a) => [...new Set(a.filter((x) => x != null && x !== ''))];
 const read = (p) => JSON.parse(readFileSync(p, 'utf8'));
 
 // Rebuild the per-tool record set for the wadcoms namespace from its
 // techniques — a verbatim mirror of build-dataset.mjs's toolsFromWad.
 function toolsFromWad(techniques) {
   const map = new Map();
   for (const t of techniques) {
     if (!map.has(t.toolId)) {
       map.set(t.toolId, { id: t.toolId, name: t.toolName, source: t.source, platform: [], references: [], count: 0 });
     }
     const tool = map.get(t.toolId);
     tool.count++;
     tool.platform = uniq([...tool.platform, ...t.platform]);
     tool.references = uniq([...tool.references, ...t.references]);
     if (t.source === 'DAEMON' && tool.source !== 'DAEMON') tool.source = 'WADComs';
   }
   return [...map.values()];
 }
 
 function main() {
   const techniques = read(join(SRC, 'techniques.json'));
   const tools = read(join(SRC, 'tools.json'));
   const facets = read(join(SRC, 'facets.json'));
 
   const isWad = (id) => id.startsWith('wadcoms:');
 
   // ---- Transform techniques -------------------------------------------------
   const before = techniques.filter((t) => t.toolId === 'wadcoms:Impacket').length;
   const split = techniques.map(splitImpacket);
   // Fold case-duplicate families over the WADComs namespace ONLY, exactly as
   // build-dataset.mjs does (it runs canonicalizeFamilyCase over the WADComs
   // techniques alone), so a fresh regen and this migration stay identical.
   const foldedById = new Map(
     canonicalizeFamilyCase(split.filter((t) => isWad(t.toolId))).map((t) => [t.id, t]),
   );
   const techniques2 = split.map((t) => foldedById.get(t.id) ?? t);
 
   const impacketTools = new Set(
     techniques2.filter((t) => t.toolId.startsWith('wadcoms:Impacket-')).map((t) => t.toolId),
   );
   console.log(`Impacket: ${before} techniques under wadcoms:Impacket -> ${impacketTools.size} script tools`);
 
   // ---- Rebuild the wadcoms tool records ------------------------------------
   const wadTechs = techniques2.filter((t) => isWad(t.toolId));
   const rebuiltWad = toolsFromWad(wadTechs);
   const rebuiltById = new Map(rebuiltWad.map((t) => [t.id, t]));
 
   // Assert unaffected wadcoms tools are unchanged (bit-for-bit).
   const oldWadById = new Map(tools.filter((t) => isWad(t.id)).map((t) => [t.id, t]));
   let drifted = 0;
   for (const [id, rebuilt] of rebuiltById) {
     const old = oldWadById.get(id);
     if (old && JSON.stringify(old) !== JSON.stringify(rebuilt)) {
       // Expected only for a family whose membership actually changed (none but
       // the impacket/enum4linux families should differ).
       if (!/^wadcoms:(Impacket-|Enum4Linux$|enum4linux$)/.test(id)) {
         console.error(`  ! unexpected drift in ${id}`);
         drifted++;
       }
     }
   }
   if (drifted) { console.error(`ABORT: ${drifted} unaffected wadcoms tool(s) drifted — refusing to write.`); process.exit(1); }
 
   const nonWadTools = tools.filter((t) => !isWad(t.id));
   const tools2 = [...nonWadTools, ...rebuiltWad];
 
   // ---- Recompute the derived facet counts ----------------------------------
   const count = (arr) => arr.reduce((m, v) => ((m[v] = (m[v] || 0) + 1), m), {});
   facets.counts.tools = tools2.length;
   facets.counts.toolsBySource = count(tools2.map((t) => t.source));
 
   // ---- Emit (match build-dataset.mjs formatting) ---------------------------
   // public/data/techniques.json is a gitignored build artifact regenerated by
   // `npm run data:public`, so only the source-of-truth files are written here.
   writeFileSync(join(SRC, 'techniques.json'), JSON.stringify(techniques2));
   writeFileSync(join(SRC, 'tools.json'), JSON.stringify(tools2));
   writeFileSync(join(SRC, 'facets.json'), JSON.stringify(facets, null, 2));
 
   console.log(`Tools: ${tools.length} -> ${tools2.length} (wadcoms ${oldWadById.size} -> ${rebuiltWad.length})`);
   console.log(`toolsBySource: ${JSON.stringify(facets.counts.toolsBySource)}`);
   console.log('Wrote src/data/{techniques,tools,facets}.json');
 }
 
 main();