Update PowerHuntShares.psm1

Added unique folder group count column to "top share name" page.
This commit is contained in:
Scott Sutherland 2024-06-02 08:40:04 -05:00 committed by GitHub
parent 2bf0a514eb
commit 0eef2d6c53
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -4,7 +4,7 @@
#-------------------------------------- #--------------------------------------
# Author: Scott Sutherland, 2024 NetSPI # Author: Scott Sutherland, 2024 NetSPI
# License: 3-clause BSD # License: 3-clause BSD
# Version: v1.40 # Version: v1.41
# References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell.
function Invoke-HuntSMBShares function Invoke-HuntSMBShares
{ {
@ -1597,7 +1597,7 @@ function Invoke-HuntSMBShares
$CommonShareNamesTopString = $CommonShareNamesTop5 | $CommonShareNamesTopString = $CommonShareNamesTop5 |
foreach { foreach {
$ShareCount = $_.count $ShareCount = $_.count
$ShareName = $_.name $ShareName = $_.name
Write-Output "$ShareCount $ShareName <br>" Write-Output "$ShareCount $ShareName <br>"
} }
@ -1606,6 +1606,7 @@ function Invoke-HuntSMBShares
foreach { foreach {
$ShareCount = $_.count $ShareCount = $_.count
$ShareName = $_.name $ShareName = $_.name
$ShareFolderGroupCount = $ExcessiveSharePrivs | where sharename -like "$ShareName" | select filelistgroup -Unique | measure | select count -ExpandProperty count
$ShareNameBars = Get-GroupNameBar -DataTable $ExcessiveSharePrivs -Name $ShareName -AllComputerCount $ComputerCount -AllShareCount $AllSMBSharesCount -AllAclCount $ShareACLsCount $ShareNameBars = Get-GroupNameBar -DataTable $ExcessiveSharePrivs -Name $ShareName -AllComputerCount $ComputerCount -AllShareCount $AllSMBSharesCount -AllAclCount $ShareACLsCount
$ComputerBar = $ShareNameBars.ComputerBar $ComputerBar = $ShareNameBars.ComputerBar
$ShareBar = $ShareNameBars.ShareBar $ShareBar = $ShareNameBars.ShareBar
@ -1646,7 +1647,10 @@ function Invoke-HuntSMBShares
</td> </td>
<td> <td>
$ShareName $ShareName
</td> </td>
<td>
$ShareFolderGroupCount
</td>
<td> <td>
$ShareFolderGroupList $ShareFolderGroupList
</td> </td>
@ -3604,7 +3608,8 @@ This section contains a list of the most common SMB share names. In some cases,
<tr> <tr>
<th align="left">Share Count</th> <th align="left">Share Count</th>
<th align="left">Share Name</th> <th align="left">Share Name</th>
<th align="left">Folder Groups</th> <th align="left">Unique Folder Group Count</th>
<th align="left">Unique Folder Groups</th>
<th align="left">Affected Computers</th> <th align="left">Affected Computers</th>
<th align="left">Affected Shares</th> <th align="left">Affected Shares</th>
<th align="left">Affected ACLs</th> <th align="left">Affected ACLs</th>