diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index 4bc6f09..29fb6e7 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.136 +# Version: v1.138 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -1773,17 +1773,17 @@ function Invoke-HuntSMBShares } | select | ForEach-Object { "'$_'" }) -join ", " $IFCategoryListCount = "[$IFCategoryList]" - # Outbout objects to file + # Export objects to file $InterestingFilesAllObjects | Export-Csv -NoTypeInformation "$OutputDirectory\$TargetDomain-Shares-Interesting-Files.csv" # Get secrets & sensitive counts for dashboard - $InterestingFilesAllObjectsSecretCount = $InterestingFilesAllObjects | where category -eq 'secret' | measure | select count -ExpandProperty count - $InterestingFilesAllObjectsSensitiveCount = $InterestingFilesAllObjects | where category -eq 'sensitive' | measure | select count -ExpandProperty count + $InterestingFilesAllObjectsSecretCount = $InterestingFilesAllObjects | where category -eq 'secret' | select UncPath -Unique | measure | select count -ExpandProperty count + $InterestingFilesAllObjectsSensitiveCount = $InterestingFilesAllObjects | where category -eq 'sensitive' | select UncPath -Unique | measure | select count -ExpandProperty count # Get order list of interesting file names by count $InterestingFilesAllFilesCount = $InterestingFilesAllObjects | measure | select count -ExpandProperty count $InterestingFilesAllFilesCountU = $InterestingFilesAllObjects | select filename -Unique | measure | select count -ExpandProperty count - $InterestingFilesAllFilesGrouped = $InterestingFilesAllObjects | group filename | select count,name | sort count -Descending + $InterestingFilesAllFilesGrouped = $InterestingFilesAllObjects | group filename | select count,name | sort count -Descending # Generate a row for each one # Headers are Instance Count, FileName, Type, File Paths,Affected Computers, Affected Shares @@ -5273,7 +5273,7 @@ $NewHtmlReport = @" } .percentagetext { - text-align: center; + text-align: left; font-size: 2.25em; font-weight: 700; font-family:"Open Sans", sans-serif; @@ -5936,7 +5936,7 @@ input[type="checkbox"]:checked::before { - + @@ -5961,35 +5961,37 @@ input[type="checkbox"]:checked::before { This section provides a list of files that may contain passwords or sensitive data, or may be abused for remote code execution. - +
-
-
- Interesting Files Found -
-

- - $InterestingFilesAllFilesCount  - -
-
- ($InterestingFilesAllFilesCountU unique file names) -
-
+ +
+
+
+ Interesting Files Found +
+
+ + $InterestingFilesAllFilesCount  + +
+
+ ($InterestingFilesAllFilesCountU unique file names) +
+
+
+
+ +
+
+
+
+
+
+
+
- -
- -
-
-
-
-
- - - -
+
@@ -6034,7 +6036,7 @@ input[type="checkbox"]:checked::before { -->

Risk & Data Exposure

- In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE (Access Control Entry) configurations were discovered across $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers in the $TargetDomain Active Directory domain. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. Overall, $InterestingFilesAllFilesCount interesting files were found that could potentially lead to unauthorized data access or remote code execution. + In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE (Access Control Entry) configurations were discovered across $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers in the $TargetDomain Active Directory domain. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. $SecretsRecoveredCount credentials were recovered from $SecretsRecoveredFileCount of the discovered $InterestingFilesAllObjectsSecretCount secrets files. Overall, $InterestingFilesAllFilesCount interesting files were found accessible to all domain users that could potentially lead to unauthorized data access or remote code execution.
@@ -6170,43 +6172,50 @@ $CardLastModifiedTimeLine
$ComputerCount computers were found in the $TargetDomain Active Directory domain, $ComputerPingableCount responded to ping requests, $Computers445OpenCount had port 445 open, and $ComputerWithExcessive were found hosting shares configured with excessive privileges. Below is a list of the computers hosting shares configured with excessive privileges.
- +
-
-
- Live Computers Found -
-

- - $PeerComparisonComputerCount  - -
-
- ($ComputerWithExcessive host shares with excessive privileges) -
-
+ +
+
+
+ Live Computers Found +
+
+ + $PeerComparisonComputerCount  + +
+
+ ($ComputerWithExcessive host shares with excessive privileges) +
+
+
+
- -
- -
-
-
-
- -
- -
- -
-
-
-
- -
+ +
+
+
+
+
+
+
+
+ + +
+
+
+
+
+
+
+
+ +
-
+
Clear
+
+
+
+ Identities Found +
+
+ + $IdentityCombinedListCount  + +
+
+
-
-
- Identities Assigned Ownership -
-

- - $IdentityOwnerListCount  - -
-
- -
-
- Identities Assigned Privileges -
-

- - $IdentityReferenceListCount  - -
-
-
-
+ +
+
+
+ Identities Assigned Ownership +
+
+ + $IdentityOwnerListCount  + +
+
+
+ + +
+
+
+ Identities Assigned Privileges +
+
+ + $IdentityReferenceListCount  + +
+
+
+ +
+ +
Note: Within the context of this report, all read and write access the "Everyone", "Authenticated Users", "BUILTIN\Users", "Domain Users", or "Domain Computers" groups are considered excessive privileges, because all provide domain users access to the affected shares due to privilege inheritance.
@@ -6363,40 +6384,45 @@ Note: Within the context of this report, all read and write access the "Everyone Below is a list of the ACE (access control entries) configured with excessive privileges found in the $TargetDomain Active Directory domain.
-
-
- Inescure ACEs Found -
-

- - $ExcessiveSharePrivsCount   - -
+
+ +
+
+
+ Insecure ACEs Found +
+
+ + $ExcessiveSharePrivsCount   + +
+
+
-
- -
-
-
-
-
- -
-
-
-
-
-
+ +
+
+
+
+
+
+
+
-
-
-
-
-
-
- -
+ +
+
+
+
+
+
+
+
+ +
+ +
Clear
+
+
+
+ Shares Found +
+
+ + $ExcessiveSharesCount   + +
+
+ ($ShareNameChartCount unique names) +
+
+
+
+ + +
+
+
+
+
+
+
+
+ +
-
+
Quick Filters
@@ -7059,34 +7088,35 @@ This section lists the most common share owners. Folder groups are SMB shares that contain the exact same file listing. Each folder group has been hashed so they can be quickly correlated. In some cases, shares with the exact same file listing may be related to a single application or process. This information can help identify the root cause associated with the excessive privileges and expedite remediation.
-
-
- Folder Groups Found -
-

- - $FolderGroupChartCount   - -
-
+
+ + +
+
+
+ Folder Groups Found +
+
+ + $FolderGroupChartCount   + +
+
+
+ + +
+
+
+
+
+
+
+
+ +
-
-
-
-
-
-
- - - -
-
-
-
-
-
- -
+
Clear