diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index 25ab44a..6310cf4 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.107 +# Version: v1.108 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -4029,46 +4029,40 @@ $NewHtmlReport = @" width:100%; max-width:100%; --margin-bottom:1rem; - border-collapse:collapse; + border-collapse:collapse; + border:.5px solid lightgray; } - - table th:first-child { - --border-top-left-radius: 3px; - } - - table th:last-child { - --border-top-right-radius: 3px; - } .tabledrop { - outline-right:.5px solid #BEDFE1; - outline-left:.5px solid #BEDFE1; - outline-bottom:.5px solid #BEDFE1; - --border:1px solid #757575; - --border-top:1.5px solid #757575; - --box-shadow: 0 0 0 0; - box-shadow: 0 2px 4px 0 #DEDFE1; + box-shadow: 0 2px 4px 0 lightgray; margin: 10px; width: 90%; - --margin-left:10px; } + .tabledrop:hover { + box-shadow: 0 6px 12px 0 lightgray; + } + table thead th{ vertical-align:bottom; - background-color: #07142A; - color:white; - border:1px solid #3D3935; + background-color: white; + color:#4A4A4A; + border:.5px solid lightgray; + --border-top-right-radius: 10px; } table tbody tr{ background-color:white; - --font-weight: bold; } - table tbody td:nth-child(1){ - --font-weight: bold; + table thead th:nth-child(1){ + --border-top-left-radius: 10px; } + table thead th:nth-child(last){ + --border-top-right-radius: 10px; + } + table tbody tr:nth-of-type(odd){ --background-color:#F0E8E8; background-color:#f9f9f9; @@ -4494,10 +4488,11 @@ $NewHtmlReport = @" } .card { - width: 250px; + padding:10px; + text-align: right; box-shadow: 0 2px 4px 0 #DEDFE1; transition:0.3s; - background-color: #07142A; + background-color: white; font-family:"Open Sans", sans-serif; font-size: 12; font-weight: 2; @@ -4507,24 +4502,19 @@ $NewHtmlReport = @" display:block; margin:10px; margin-bottom:20px; - border-radius: 3px; + border:.5px solid lightgray; + border-radius: 3px; } .card:hover{ - box-shadow: 0 8px 16px 0; + box-shadow: 0 6px 12px 0 lightgray; --box-shadow: 0 8px 16px 0 #DEDFE1; - } + } - .cardtitle{ - padding:5px; - -- padding-left: 20px; - font-size: 20; - color: white; - font-weight:bold; - font-family:"Open Sans", sans-serif; - border-bottom:1.5px solid transparent; - border-bottom-color:#07142A; + .cardtitle{ + font-size: 18; + text-align: left; } .cardsubtitle { @@ -4863,37 +4853,27 @@ $NewHtmlReport = @" margin-top:58px; } -.LargeCard { - width: 788px; - box-shadow: 0 2px 4px 0 #DEDFE1; +.LargeCard { + padding: 10px; + background-color: white; transition:0.3s; - --background-color: #07142A; font-family:"Open Sans", sans-serif; - font-size: 12; - font-weight: 2; - font-color: black; float: left; display:block; margin:10px; margin-bottom:20px; + border:.5px solid lightgray; border-radius: 3px; + box-shadow: 0 2px 4px 0 #DEDFE1; } .LargeCard:hover{ - box-shadow: 0 2px 16px 0; -} + box-shadow: 0 6px 12px lightgray; +} .LargeCardtitle{ - padding:5px; - padding-left: 20px; - font-size: 20; - color: white; - font-weight:bold; - font-family:"Open Sans", sans-serif; - border-bottom:1.5px solid transparent; - border-bottom-color:#757575; - border-top-right-radius: 3px; - border-top-left-radius: 3px; + font-size: 18; + text-align: left; } .LargeCardSubtitle2 { @@ -5045,6 +5025,7 @@ input[type="checkbox"]:checked::before {
+ @@ -5060,36 +5041,29 @@ input[type="checkbox"]:checked::before {
-
- -
- Interesting File Names Found -
-
-

- - $InterestingFilesAllFilesCount - -
- ($InterestingFilesAllFilesCountU unique file names) -
- -
+ +
+
+ Interesting File Names Found +
+

+ + $InterestingFilesAllFilesCount  + +
+
+ ($InterestingFilesAllFilesCountU unique file names) +
+
-
- -
- File Name Category Distribution -
- -
+
+
-
@@ -5135,9 +5109,9 @@ input[type="checkbox"]:checked::before {
-

Affected Assets

+

Affected Assets

- Below is a summary of the computers, shares, and ACEs (Access Control Entries) associated with shares configured with excessive privileges. + Below is a summary of the computers, shares, and ACEs (Access Control Entries) associated with shares configured with excessive privileges. $ExcessiveSharePrivsCount ACL entries, on $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers were found configured with excessive privileges on the $TargetDomain domain. Overall, $IdentityReferenceListCount identities were assigned excessive privileges. Click the "Exposure Summary" or the titles on the cards below to explore the details.

@@ -5149,13 +5123,12 @@ input[type="checkbox"]:checked::before { -
-
- Computers -
-
+
+
+ COMPUTERS +
- $ComputerWithExcessive + $ComputerWithExcessive 
@@ -5201,20 +5174,18 @@ input[type="checkbox"]:checked::before {
-
-
-
- Shares -
-
+
+
+ SHARES +
- $ExcessiveSharesCount + $ExcessiveSharesCount 
@@ -5260,20 +5231,18 @@ input[type="checkbox"]:checked::before {
-
-
-
- ACEs -
-
+
+
+ ACES +
- $ExcessiveSharePrivsCount + $ExcessiveSharePrivsCount 
@@ -5319,20 +5288,18 @@ input[type="checkbox"]:checked::before {
- -
-
- Identities -
-
+
+
+ IDENTITIES +
- $IdentityReferenceListCount + $IdentityReferenceListCount 
@@ -5343,7 +5310,6 @@ input[type="checkbox"]:checked::before {
- @@ -5359,37 +5325,31 @@ input[type="checkbox"]:checked::before { |||||||||| CARD: RISK AND INTERESTING FILE SUMMARY -->
-

Exposure Summary

+

Exposure Summary

In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE configurations were discovered across shares in the $TargetDomain Active Directory domain. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. Overall, $InterestingFilesAllFilesCount interesting files were found that could potentially lead to unauthorized data access or remote code execution. Click the chart titles below to explore the details.

-
+
-
- Share ACL Count by Risk Level -
-
+
-
+
-
+
-
- Interesting Files Count -
-
+
-
+
@@ -5399,7 +5359,7 @@ input[type="checkbox"]:checked::before {
-

Timelines

+

Timelines

Below are charts to help illustrate the share creation and last write timelines.

$CardCreationTimeLine @@ -5432,44 +5392,41 @@ $CardLastModifiedTimeLine $ComputerCount computers were found in the $TargetDomain Active Directory domain. Below is a list of the computers hosting shares configured with excessive privileges.
-
- -
- Live Computers Found -
-
-


- - $ComputerPingableCount -
($ComputerWithExcessive host shares with excessive privileges) -
+ + +
+
+ Live Computers Found +
+

+ + $ComputerPingableCount  + +
+
+ ($ComputerWithExcessive host shares with excessive privileges) +
-
-
- Computer Count by Share Exposure -
-
+
+
-
+
-
-
- Computer Count by Risk Level -
-
+
+
-
+
-
+
Clear
+
@@ -5748,7 +5686,7 @@ Below is a summary of the domain computers that were targeted, connectivity to t
100.00% $ComputerCount - CSV | HTML + CSV | HTML PING RESPONSE @@ -5967,8 +5905,6 @@ In the context of this report, excessive read and write share permissions have b Below is a summary of the exposure associated with each of those groups.
-
- @@ -6185,47 +6121,38 @@ Below is a summary of the exposure associated with each of those groups.
$AllSMBSharesCount shares were discovered across computers in the $TargetDomain Active Directory domain. $ShareNameChartCount shares were found configured with excessive privileges. Below is a summary of those shares grouped by name. -
-
- -
- Shares Found -
-
-


- - $ShareNameChartCountUnique -
($ShareNameChartCount unique share names found) -
+
+ +
+
+ Shares Found +
+

+ + $ShareNameChartCountUnique   + +
+
+ ($ShareNameChartCount unique share names found) +
+
- - -
-
- Share Name Count by Risk Level -
-
+
-
-
-
- Exposed File Count by Category -
-
+
-
-
+
Quick Filters
@@ -6295,120 +6222,6 @@ $AllSMBSharesCount shares were discovered across computers in the $TargetDomain
- - - - -
-

Computers

-
-
-This section contains a list of the computers hosting shares configured with excessive privileges. -
-
- -
- Shares Found -
-
-


- - $ComputerNameChartCountUnique -
- -
- -
-
- Computer Count by Risk Level -
-
-
-
-
-
-
-
- - -
-
- Exposed File Count by Category -
-
-
-
-
-
-
-
- -
- -
Quick Filters
- - - - - - - -
-
-
Loading...
- Export -
-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Share
Name  
Computer Name
is the name of the computer.
Risk
Level  
Risk Level
relfects the exposure of credentials and sensitive data.
Share
Count  
Share Count
is the number of unique shares with
the same name.
Interesting
Files  
Interesting Files
are filenames that
may be sensitive.
1111
1111
- -
- @@ -6465,46 +6278,35 @@ This section lists the most common share owners.
Folder groups are SMB shares that contain the exact same file listing. Each folder group has been hashed so they can be quickly correlated. In some cases, shares with the exact same file listing may be related to a single application or process. This information can help identify the root cause associated with the excessive privileges and expedite remediation.
-
- -
- Folder Groups Found -
-
-


- - $FolderGroupChartCount -
+ +
+
+ Folder Groups Found +
+

+ + $FolderGroupChartCount   + +
+
-
- -
-
- Folder Group Count by Risk Level -
-
+
-
-
-
- Exposed File Count by Category -
-
+
-
-
+
Clear
-
+

How do I use this report?

-Follow the guidance below to get the most out of this report. +Follow the guidance below to get the most out of this report. Click each step for more information.

@@ -6885,6 +6685,9 @@ Invoke-HuntSMBShares -Threads 20 -RunSpaceTimeOut 10 -OutputDirectory c:\folder\
+
+
+