Excessive Share Privileges Dashboard
+Results Overview
Insecure ACEs
+ ++ + $ExcessiveSharePrivsCount +
+
Risk Level | +Computer | +Share Name | +Share Path | +ACE | +ACE Identity | +Share Owner | +Creation Date | +Modified Date | +Files | + +
---|
diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index 2497ebb..e0e6c9f 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.100 +# Version: v1.101 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -2003,7 +2003,84 @@ function Invoke-HuntSMBShares $RiskLevelCountLow = $ExcessiveSharePrivsFinal | where RiskLevel -eq 'Low' | measure | select count -ExpandProperty count $RiskLevelCountMedium = $ExcessiveSharePrivsFinal | where RiskLevel -eq 'Medium' | measure | select count -ExpandProperty count $RiskLevelCountHigh = $ExcessiveSharePrivsFinal | where RiskLevel -eq 'High' | measure | select count -ExpandProperty count - $RiskLevelCountCritical = $ExcessiveSharePrivsFinal | where RiskLevel -eq 'Critical' | measure | select count -ExpandProperty count + $RiskLevelCountCritical = $ExcessiveSharePrivsFinal | where RiskLevel -eq 'Critical' | measure | select count -ExpandProperty count + + # Create table for ACEs page + $AceTableRows = $ExcessiveSharePrivsFinal | + foreach { + + # Risk Level + $AceRowRiskScore = $_.RiskScore + $AceRowRiskLevel = $_.RiskLevel + + # Read + $AceRowHasRead = $_.HasRead + + # Write + $AceRowHasWrite = $_.HasWrite + + # HR + $AceRowHasHR = $_.HasHR + + # RCE + $AceRowHasRCE = $_.HasRCE + + # Has sesntive secrests + $AceRowHasSecrets = $_.HasSecrets + + # Has sesntive data + $AceRowHasIF = $_.HasIF + + # Computer + $AceRowComputer = $_.ComputerName + + # Share Name + $AceRowShareName = $_.ShareName + + # Share Path + $AceRowSharePath = $_.SharePath + + # ACE + $AceRowACE = $_.FileSystemRights + + # Identity + $AceRowIdentity = $_.IdentityReference + + # Share Owner + $AceRowShareOwner = $_.ShareOwner + + # Created + $AceRowCreated = $_. CreationDate + + # Modified + $AceRowModified = $_.LastModifiedDate + + # Files + $AceRowFilecount = $_.FileCount + $AceRowFileList = $_.FileList + + $AceRow = @" +
Risk Level | +Computer | +Share Name | +Share Path | +ACE | +ACE Identity | +Share Owner | +Creation Date | +Modified Date | +Files | + +
---|