diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index fb8640a..49d8f12 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.105 +# Version: v1.106 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -1804,10 +1804,6 @@ function Invoke-HuntSMBShares # ---------------------------------------------------------------------- # Calculate risk score per acl - ace insights # ---------------------------------------------------------------------- - # add interesting file flags - # add risk score - # create table for later use - # output table to file # foreach acl update the record $ExcessiveSharePrivsFinal = $ExcessiveSharePrivs | @@ -2128,8 +2124,78 @@ function Invoke-HuntSMBShares $UniqueFileSystemRightsSeries = "[" + ($UniqueFileSystemRightsCounts -replace(" ",",")) + "]" $UniqueFileSystemRightsSeries = $UniqueFileSystemRightsSeries -replace(" ",",") + # ---------------------------------------------------------------------- - # Create Computer Insight Summary Information + # Create Identity Insights Summary Information + # ---------------------------------------------------------------------- + + # Get share owners + [array]$IdentityOwnerList = $ExcessiveSharePrivsFinal | select ShareOwner -Unique -ExpandProperty ShareOwner + $IdentityOwnerListCount = $IdentityOwnerList | measure | select count -ExpandProperty count + + # Get identity references + [array]$IdentityReferenceList = $ExcessiveSharePrivsFinal | select IdentityReference -Unique -ExpandProperty IdentityReference + $IdentityReferenceListCount = $IdentityReferenceList | measure | select count -ExpandProperty count + + # Combine identity lists + $IdentityCombinedList = $IdentityOwnerList + $IdentityReferenceList | sort | select -Unique + $IdentityCombinedListCount = $IdentityCombinedList | measure | select count -ExpandProperty count + + # Process each identity + $IdentityTableRows = $IdentityCombinedList | + foreach { + + # Set target identity + $TargetIdentity = $_ + + # Get share owner count + $TargetIdentityOwnerCount = $ExcessiveSharePrivsFinal | where ShareOwner -eq "$TargetIdentity" | select SharePath | measure | select count -ExpandProperty count + + # Get share access count + $TargetIdentityShareAccessCount = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | select SharePath -Unique | measure | select count -ExpandProperty count + $TargetIdentityShareAccess = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | select SharePath -Unique -ExpandProperty SharePath | ForEach-Object { $ASDF = $_; "$ASDF
" } | Out-String + + # Get ACE low risk + $TargetIdentityLowRiskCount = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Low" | select SharePath -Unique |measure | select count -ExpandProperty count + #$TargetIdentityLowRisk = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Low" | select SharePath -Unique | ForEach-Object { $ASDF = $_; "$ASDF
" } | Out-String + + # Get ACE medium risk + $TargetIdentityMediumRiskrCount = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Medium" | select SharePath -Unique | measure | select count -ExpandProperty count + #$TargetIdentityMediumRisk = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Medium" | select SharePath -Unique | ForEach-Object { $ASDF = $_; "$ASDF
" } | Out-String + + # Get ACE high risk + $TargetIdentityHighRiskCount = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "High" | select SharePath -Unique | measure | select count -ExpandProperty count + #$TargetIdentityHighRisk = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "High" | select SharePath -Unique | ForEach-Object { $ASDF = $_; "$ASDF
" } | Out-String + + # Get ACE critical risk + $TargetIdentityCriticalRiskCount = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Critical" | select SharePath -Unique | measure | select count -ExpandProperty count + #$TargetIdentityCriticalRisk = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Critical" | select SharePath -Unique | ForEach-Object { $ASDF = $_; "$ASDF
" } | Out-String + + # Get interesting files count (same as share names) + $TargetIdentityInterestingFiles = "tbd" + + $BuildIdentityTableRows = @" + + $TargetIdentity + $TargetIdentityOwnerCount + + +
+ $TargetIdentityShareAccess +
+ + $TargetIdentityLowRiskCount + $TargetIdentityMediumRiskrCount + $TargetIdentityHighRiskCount + $TargetIdentityCriticalRiskCount + +"@ + $BuildIdentityTableRows + } + + + # ---------------------------------------------------------------------- + # Create Computer Insights Summary Information # ---------------------------------------------------------------------- # Reset global computer risk levels @@ -4967,10 +5033,9 @@ input[type="checkbox"]:checked::before { + - - @@ -5434,6 +5499,100 @@ $ComputerCount computers were found in the $TargetDomain Active Directory domain
+ + + + +
+

Identities

+
+
+$IdentityCombinedListCount identities were discovered across shares in the $TargetDomain Active Directory domain. $IdentityOwnerListCount were owners and $IdentityReferenceListCount were assigned privileges. +
+ +
+ +
+ Identities Found +
+
+
+
+ $IdentityCombinedListCount +
+
+
+ +
+ +
+ Identities Assigned Ownership +
+
+
+
+ $IdentityOwnerListCount +
+
+
+ +
+ +
+ Identities Assigned Privileges +
+
+
+
+ $IdentityReferenceListCount +
+
+
+
+
+Note: Within the context of this report, all read and write access the "Everyone", "Authenticated Users", "BUILTIN\Users", "Domain Users", or "Domain Computers" groups are considered excessive privileges, because all provide domain users access to the affected shares due to privilege inheritance. +
+
+ +
Clear
+ +
+
+
Loading...
+ Export +
+ + + + + + + + + + + + + + + + + $IdentityTableRows + +
IdentityOwned SharesAccessible SharesLow Risk SharesMedium Risk SharesHigh Risk SharesCritical Risk Shares
+
+
+ @@ -6701,108 +6860,7 @@ Invoke-HuntSMBShares -Threads 20 -RunSpaceTimeOut 10 -OutputDirectory c:\folder\ -

Collection Approach

-
-The PowerHuntShares audit script was run against the netspi.local domain to collect SMB Share data, generate this HTML summary report, and generate the associated csv files that detail potentially excessive share configurations. -The left menu can be used to find summary data, the scan summary is in the table to the left, and a summary of the data collection approach has been outlined below.

-
- -
-
- Find Domain Computers
-
-
- - -
- Get a list of domain computers by querying a domain controller via ldap. -
-
-
- - -
-
-
- Ping Scan
- Computers -
-
- - -
- Perform ping scanning to determine basic connectivity to domain computers. -
- -
-
- - -
-
-
- Port Scan
- TCP 445 -
-
- - -
- Perform port scanning on tcp port 445 to determine targets for share enumeration. -
-
-
- - -
-
-
- Enumerate
- Shares -
-
- - -
- Scan for a list of shares on accessible domain computers.

-
-
-
- - -
-
-
- Enumerate Share ACLs
-
-
- - -
- Scan enumerated shares for ACL entries configured with excessive privileges. -
-
-
-
-
-
-
-