diff --git a/Scripts/Analyze-HuntSMBShares.ps1 b/Scripts/Analyze-HuntSMBShares.ps1 index 127ca9a..5e7cf2b 100644 --- a/Scripts/Analyze-HuntSMBShares.ps1 +++ b/Scripts/Analyze-HuntSMBShares.ps1 @@ -5,7 +5,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.71 +# Version: v1.72 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Analyze-HuntSMBShares { @@ -1320,7 +1320,11 @@ function Analyze-HuntSMBShares $IFCategoryListCount = "[$IFCategoryList]" # Outbout objects to file - $InterestingFilesAllObjects | Export-Csv -NoTypeInformation "$OutputDirectory\$TargetDomain-Shares-Interesting-Files.csv" + $InterestingFilesAllObjects | Export-Csv -NoTypeInformation "$OutputDirectory\$TargetDomain-Shares-Interesting-Files.csv" + + # Get secrets & sensitive counts for dashboard + $InterestingFilesAllObjectsSecretCount = $InterestingFilesAllObjects | where category -eq 'secret' | measure | select count -ExpandProperty count + $InterestingFilesAllObjectsSensitiveCount = $InterestingFilesAllObjects | where category -eq 'sensitive' | measure | select count -ExpandProperty count # Get order list of interesting file names by count $InterestingFilesAllFilesCount = $InterestingFilesAllObjects | measure | select count -ExpandProperty count @@ -4524,16 +4528,16 @@ input[type="checkbox"]:checked::before {
- + + - - + @@ -4629,15 +4633,15 @@ input[type="checkbox"]:checked::before {
-

Results Overview

+

Summary Report

Affected Assets

- Below is a summary of the computers, shares, and ACLs associated with shares configured with excessive privileges. - $ExcessiveSharePrivsCount ACL entries, on $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers were found configured with excessive privileges on the $TargetDomain domain. Click the "Exposure Summary" or the titles for more detail.

+ Below is a summary of the computers, shares, and ACEs (Access Control Entries) associated with shares configured with excessive privileges. + $ExcessiveSharePrivsCount ACL entries, on $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers were found configured with excessive privileges on the $TargetDomain domain. Click the "Exposure Summary" or the titles on the cards below to explore the details.

@@ -4768,7 +4772,7 @@ input[type="checkbox"]:checked::before {
- ACLs + ACEs
@@ -4835,7 +4839,7 @@ input[type="checkbox"]:checked::before { -->

Exposure Summary

- Below is a summary of number of share ACLs by risk level and a summary of file name counts that may contain passwords, sensitive data, or result in remote code execution. Click the titles for more detail.

+ In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE configurations were discovered across shares in the $TargetDomain Active Directory domain. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. Overall, $InterestingFilesAllFilesCount interesting files were found that could potentially lead to unauthorized data access or remote code execution. Click the chart titles below to explore the details.

@@ -4856,7 +4860,7 @@ input[type="checkbox"]:checked::before {
- Exposed File Count by Category + Interesting Files Count
@@ -5677,16 +5681,16 @@ $AllSMBSharesCount shares were discovered across computers in the $TargetDomain
-

Affected Subnets

+

Networks

-This section contains a list of subnets hosting computers with shares that are configured with accessibe privileges. +This section contains a list of networks/subnets hosting computers with shares that are configured with excessive privileges.
$SubnetSummaryHTML @@ -5730,7 +5734,7 @@ This section lists the most common share owners.

Folder Groups

-Folder groups are SMB shares that contain the exact same file listing. Each file group has been hashed so they can be quickly correlated. In some cases, shares with the exact same file listing may be related to a single application or process. This information can help identify the root cause associated with the excessive privileges and expedite remediation. +Folder groups are SMB shares that contain the exact same file listing. Each folder group has been hashed so they can be quickly correlated. In some cases, shares with the exact same file listing may be related to a single application or process. This information can help identify the root cause associated with the excessive privileges and expedite remediation.
@@ -6010,7 +6014,7 @@ Below are some tips for getting started on prioritizing the remediation of share
- This report summarizes the shares identified as being configured with excessive privileges. + The PowerHuntShares audit script was run against the $TargetDomain Active Directory domain to collect SMB Share data, generate this HTML summary report, and generate the associated csv files that detail potentially excessive share configurations. Below is a the scan summary and an overview of how to use this report.

-

Collection Approach

-
-The PowerHuntShares audit script was run against the netspi.local domain to collect SMB Share data, generate this HTML summary report, and generate the associated csv files that detail potentially excessive share configurations. -The left menu can be used to find summary data, the scan summary is in the table to the left, and a summary of the data collection approach has been outlined below.
-
-
- -
-
- Find Domain Computers
-
-
- - -
- Get a list of domain computers by querying a domain controller via ldap. -
-
-
- - -
-
-
- Ping Scan
- Computers -
-
- - -
- Perform ping scanning to determine basic connectivity to domain computers. -
- -
-
- - -
-
-
- Port Scan
- TCP 445 -
-
- - -
- Perform port scanning on tcp port 445 to determine targets for share enumeration. -
-
-
- - -
-
-
- Enumerate
- Shares -
-
- - -
- Scan for a list of shares on accessible domain computers.

-
-
-
- - -
-
-
- Enumerate Share ACLs
-
-
- - -
- Scan enumerated shares for ACL entries configured with excessive privileges. -
-
-
-
-
-

How do I use this report?

-Follow the guidance below to get the most out of this report. +Follow the guidance below to get the most out of this report. Click each step for more information.

@@ -6254,6 +6158,7 @@ Invoke-HuntSMBShares -Threads 20 -RunSpaceTimeOut 10 -OutputDirectory c:\folder\

+