diff --git a/Scripts/Analyze-HuntSMBShares.ps1 b/Scripts/Analyze-HuntSMBShares.ps1 index cffa211..56f9314 100644 --- a/Scripts/Analyze-HuntSMBShares.ps1 +++ b/Scripts/Analyze-HuntSMBShares.ps1 @@ -5,7 +5,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.75 +# Version: v1.76 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Analyze-HuntSMBShares { @@ -3601,44 +3601,38 @@ $NewHtmlReport = @" width:100%; max-width:100%; --margin-bottom:1rem; - border-collapse:collapse; + border-collapse:collapse; + border:.5px solid lightgray; } - - table th:first-child { - --border-top-left-radius: 3px; - } - - table th:last-child { - --border-top-right-radius: 3px; - } .tabledrop { - outline-right:.5px solid #BEDFE1; - outline-left:.5px solid #BEDFE1; - outline-bottom:.5px solid #BEDFE1; - --border:1px solid #757575; - --border-top:1.5px solid #757575; - --box-shadow: 0 0 0 0; - box-shadow: 0 2px 4px 0 #DEDFE1; + box-shadow: 0 2px 4px 0 lightgray; margin: 10px; width: 90%; - --margin-left:10px; } + .tabledrop:hover { + box-shadow: 0 6px 12px 0 lightgray; + } + table thead th{ vertical-align:bottom; - background-color: #07142A; - color:white; - border:1px solid #3D3935; + background-color: white; + color:#4A4A4A; + border:.5px solid lightgray; + --border-top-right-radius: 10px; } table tbody tr{ background-color:white; - --font-weight: bold; } - table tbody td:nth-child(1){ - --font-weight: bold; + table thead th:nth-child(1){ + --border-top-left-radius: 10px; + } + + table thead th:nth-child(last){ + --border-top-right-radius: 10px; } table tbody tr:nth-of-type(odd){ @@ -4066,10 +4060,11 @@ $NewHtmlReport = @" } .card { - width: 250px; + padding:10px; + text-align: right; box-shadow: 0 2px 4px 0 #DEDFE1; transition:0.3s; - background-color: #07142A; + background-color: white; font-family:"Open Sans", sans-serif; font-size: 12; font-weight: 2; @@ -4079,24 +4074,19 @@ $NewHtmlReport = @" display:block; margin:10px; margin-bottom:20px; - border-radius: 3px; + border:.5px solid lightgray; + border-radius: 3px; } .card:hover{ - box-shadow: 0 8px 16px 0; + box-shadow: 0 6px 12px 0 lightgray; --box-shadow: 0 8px 16px 0 #DEDFE1; - } + } - .cardtitle{ - padding:5px; - -- padding-left: 20px; - font-size: 20; - color: white; - font-weight:bold; - font-family:"Open Sans", sans-serif; - border-bottom:1.5px solid transparent; - border-bottom-color:#07142A; + .cardtitle{ + font-size: 18; + text-align: left; } .cardsubtitle { @@ -4435,37 +4425,27 @@ $NewHtmlReport = @" margin-top:58px; } -.LargeCard { - width: 788px; - box-shadow: 0 2px 4px 0 #DEDFE1; +.LargeCard { + padding: 10px; + background-color: white; transition:0.3s; - --background-color: #07142A; font-family:"Open Sans", sans-serif; - font-size: 12; - font-weight: 2; - font-color: black; float: left; display:block; margin:10px; margin-bottom:20px; + border:.5px solid lightgray; border-radius: 3px; + box-shadow: 0 2px 4px 0 #DEDFE1; } .LargeCard:hover{ - box-shadow: 0 2px 16px 0; -} + box-shadow: 0 6px 12px lightgray; +} .LargeCardtitle{ - padding:5px; - padding-left: 20px; - font-size: 20; - color: white; - font-weight:bold; - font-family:"Open Sans", sans-serif; - border-bottom:1.5px solid transparent; - border-bottom-color:#757575; - border-top-right-radius: 3px; - border-top-left-radius: 3px; + font-size: 18; + text-align: left; } .LargeCardSubtitle2 { @@ -4632,36 +4612,29 @@ input[type="checkbox"]:checked::before { -
- -
- Interesting File Names Found -
-
-

- - $InterestingFilesAllFilesCount - -
- ($InterestingFilesAllFilesCountU unique file names) -
- -
+ +
+
+ Interesting File Names Found +
+

+ + $InterestingFilesAllFilesCount  + +
+
+ ($InterestingFilesAllFilesCountU unique file names) +
+
-
- -
- File Name Category Distribution -
- -
+
+
-
@@ -4707,9 +4680,9 @@ input[type="checkbox"]:checked::before {
-

Affected Assets

+

Affected Assets

- Below is a summary of the computers, shares, and ACEs (Access Control Entries) associated with shares configured with excessive privileges. + Below is a summary of the computers, shares, and ACEs (Access Control Entries) associated with shares configured with excessive privileges. $ExcessiveSharePrivsCount ACL entries, on $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers were found configured with excessive privileges on the $TargetDomain domain. Overall, $IdentityReferenceListCount identities were assigned excessive privileges. Click the "Exposure Summary" or the titles on the cards below to explore the details.

@@ -4721,13 +4694,12 @@ input[type="checkbox"]:checked::before { -
-
- Computers -
-
+
+
+ COMPUTERS +
- $ComputerWithExcessive + $ComputerWithExcessive 
@@ -4773,20 +4745,18 @@ input[type="checkbox"]:checked::before {
-
-
-
- Shares -
-
+
+
+ SHARES +
- $ExcessiveSharesCount + $ExcessiveSharesCount 
@@ -4832,20 +4802,18 @@ input[type="checkbox"]:checked::before {
-
-
-
- ACEs -
-
+
+
+ ACES +
- $ExcessiveSharePrivsCount + $ExcessiveSharePrivsCount 
@@ -4891,20 +4859,18 @@ input[type="checkbox"]:checked::before {
- -
-
- Identities -
-
+
+ - $IdentityReferenceListCount + $IdentityReferenceListCount 
@@ -4915,7 +4881,6 @@ input[type="checkbox"]:checked::before {
- @@ -4931,37 +4896,31 @@ input[type="checkbox"]:checked::before { |||||||||| CARD: RISK AND INTERESTING FILE SUMMARY -->
-

Exposure Summary

+

Exposure Summary

In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE configurations were discovered across shares in the $TargetDomain Active Directory domain. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. Overall, $InterestingFilesAllFilesCount interesting files were found that could potentially lead to unauthorized data access or remote code execution. Click the chart titles below to explore the details.

-
+
-
- Share ACL Count by Risk Level -
-
+
-
+
-
+ @@ -4971,7 +4930,7 @@ input[type="checkbox"]:checked::before {
-

Timelines

+

Timelines

Below are charts to help illustrate the share creation and last write timelines.

$CardCreationTimeLine @@ -5004,44 +4963,41 @@ $CardLastModifiedTimeLine $ComputerCount computers were found in the $TargetDomain Active Directory domain. Below is a list of the computers hosting shares configured with excessive privileges.
-
- -
- Live Computers Found -
-
-


- - $ComputerPingableCount -
($ComputerWithExcessive host shares with excessive privileges) -
+ + +
+
+ Live Computers Found +
+

+ + $ComputerPingableCount  + +
+
+ ($ComputerWithExcessive host shares with excessive privileges) +
-
-
- Computer Count by Share Exposure -
-
+
+
-
+
-
-
- Computer Count by Risk Level -
-
+
+
-
+
-