diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index b8eac00..618033c 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.198 +# Version: v1.199 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -3112,7 +3112,12 @@ function Invoke-HuntSMBShares $PeerComparActualShares = [math]::Round($ExcessiveSharesCount/$AllSMBSharesCount,2) * 100 # Get actual aces % - $PeerComparActualAces = [math]::Round($ExcessiveSharePrivsCount/$ShareACLsCount ,2) * 100 + $PeerComparActualAces = [math]::Round($ExcessiveSharePrivsCount/$ShareACLsCount ,2) * 100 + + # Set comparison status + If($PeerComparActualAces -eq 15 ){$EnvironmentStatus = "average"} + If($PeerComparActualAces -lt 15 ){$EnvironmentStatus = "more secure"} + If($PeerComparActualAces -gt 15 ){$EnvironmentStatus = "less secure"} # Set actual $PeerCompareActuaP = "[$PeerComparActualComputers, $PeerComparActualShares, $PeerComparActualAces]" @@ -6661,7 +6666,7 @@ input[type="checkbox"]:checked::before { In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE (Access Control Entry) configurations were discovered across $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers in the $TargetDomain Active Directory domain. Overall, $InterestingFilesAllFilesCount interesting files were found accessible to all domain users that could potentially lead to unauthorized data access or remote code execution. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. $SecretsRecoveredCount credentials were recovered from $SecretsRecoveredFileCount of the discovered $InterestingFilesAllObjectsSecretCount secrets files.

- The summary report below includes an overview of the affected assets, data & finding exposure, share creation timelines, and general recommendations. + The section provides a summary of the affected assets, findings, data exposure, share creation timelines, peer comparison and general recommendations.