diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1
index c1a6602..e6ec252 100644
--- a/PowerHuntShares.psm1
+++ b/PowerHuntShares.psm1
@@ -4,7 +4,7 @@
#--------------------------------------
# Author: Scott Sutherland, 2024 NetSPI
# License: 3-clause BSD
-# Version: v1.189
+# Version: v1.190
# References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell.
function Invoke-HuntSMBShares
{
@@ -3741,8 +3741,22 @@ function Invoke-HuntSMBShares
$ShareNameBars = Get-GroupNameNoBar -DataTable $ExcessiveSharePrivs -Name $ShareName -AllComputerCount $ComputerCount -AllShareCount $AllSMBSharesCount -AllAclCount $ShareACLsCount
$ComputerBar = $ShareNameBars.ComputerBar
$ShareBar = $ShareNameBars.ShareBar
- $AclBar = $ShareNameBars.AclBar
+ $AclBar = $ShareNameBars.AclBar
+ # Get app description from llm results
+ if($ApiKey -and $Endpoint){
+
+ # Get lmm fingerprint matches for sharename
+ $SnLLmMatchesRaw = $ExcessiveSharePrivsFinal |
+ Where-Object { $_.ShareName -eq "$ShareName" -and $_.ShareGuessApp -notlike "" } |
+ Select-Object ShareGuessApp -ExpandProperty ShareGuessApp -Unique
+
+ # Join the results into a comma-separated list
+ $SnLLmMatchesList = $SnLLmMatchesRaw -join ', '
+ }else{
+ $SnLLmMatchesList= "LLM lookup was not run."
+ }
+
# Share Description
$ShareDescriptionSample = $ExcessiveSharePrivs | where sharename -EQ "$ShareName" | where ShareDescription -NE "" | select ShareDescription -first 1 -expandproperty ShareDescription | foreach {"Sample Description
$_
"}
@@ -4684,7 +4698,10 @@ function Invoke-HuntSMBShares
$ShareDescriptionSample
Share Context Guess
$ShareNameListValue
-
+
+ LLM Application Guess
+ $SnLLmMatchesList
+
View in ShareGraph
Affected Assets