diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index 567c54d..66692e6 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.129 +# Version: v1.130 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -1548,7 +1548,7 @@ function Invoke-HuntSMBShares $FileNamePatternsAll.Rows.Add("SAM","","None.","Secret","Get-PrivateKeyFilePath") | Out-Null $FileNamePatternsAll.Rows.Add("SAM-*","","None.","Secret","Get-PrivateKeyFilePath") | Out-Null $FileNamePatternsAll.Rows.Add("SAM_*","","None.","Secret","Get-PrivateKeyFilePath") | Out-Null - $FileNamePatternsAll.Rows.Add("SYSTEM","","None.","Secret","Get-PrivateKeyFilePath") | Out-Null + $FileNamePatternsAll.Rows.Add("SYSTEM","","None.","Secret","") | Out-Null $FileNamePatternsAll.Rows.Add("server.xml*","","None.","Secret","Get-PwServerXml") | Out-Null $FileNamePatternsAll.Rows.Add("shadow*","","None.","Secret","Get-PwShadow") | Out-Null $FileNamePatternsAll.Rows.Add("standalone.xml*","","None.","Secret","Get-PwStandalone") | Out-Null @@ -1852,7 +1852,7 @@ function Invoke-HuntSMBShares #> # Download the Files - $MySecretsTbl = $MySecrets | + $MySecretsTbl = $MySecrets | where ComputerName -notlike "" | Foreach { # "ComputerName","ShareName","SharePath","UncPath","FileName","Category" @@ -1874,20 +1874,72 @@ function Invoke-HuntSMBShares if($MySecretsFile -like "$MySecretKeywordCheck"){ # Call function to prase file - # write-output "Parsing $MySecretsFile with $MySecretKeywordFunction" + write-verbose "Parsing $MySecretsFile with $MySecretKeywordFunction" $FunctionToCall = Get-Command $MySecretKeywordFunction & $FunctionToCall -ComputerName $MySecretsComputer -ShareName $MySecretsShare -FileName $MySecretsFile -UncFilePath $MySecretsFilePath -FilePath $MySecretsFileLocalPath } } - } + } # Write passwords to file - $MySecretsTbl | Export-Csv -NoTypeInformation "$OutputDirectory\$TargetDomain-Shares-Recovered-Passwords.csv" + $MySecretsTbl | Export-Csv -NoTypeInformation "$OutputDirectory\$TargetDomain-Shares-Recovered-Passwords.csv" # Generate counts for dashabord summary and for "Recovered Secrets" Page + $SecretsRecoveredCount = $MySecretsTbl | Select-Object ComputerName, ShareName, UncFilePath, FileName, Section, ObjectName, TargetURL, TargetServer, TargetPort, Database, Domain, Username, Password, PasswordEnc, KeyFilePath -Unique | measure | select count -ExpandProperty count # Generate table content for "Recovered Secrets" Page + + $SecretsRecoveredString = $MySecretsTbl | Select-Object ComputerName, ShareName, UncFilePath, FileName, Section, ObjectName, TargetURL, TargetServer, TargetPort, Database, Domain, Username, Password, PasswordEnc, KeyFilePath -Unique | where ComputerName -NotLike "" | + Foreach { + + # Retrieve values for each column using the $_. format + $MySecretsTblComputerName = $_.ComputerName + $MySecretsTblShareName = $_.ShareName + $MySecretsTblUncFilePath = $_.UncFilePath + $MySecretsTblFileName = $_.FileName + $MySecretsTblSection = $_.Section + $MySecretsTblObjectName = $_.ObjectName + $MySecretsTblTargetURL = $_.TargetURL + $MySecretsTblTargetServer = $_.TargetServer + $MySecretsTblTargetPort = $_.TargetPort + $MySecretsTblDatabase = $_.Database + $MySecretsTblDomain = $_.Domain + $MySecretsTblUsername = $_.Username + $MySecretsTblPassword = $_.Password + $MySecretsTblPasswordEnc = $_.PasswordEnc + $MySecretsTblKeyFilePath = $_.KeyFilePath + + # Generate the HTML table row + $MySecretsTbl = @" + + $MySecretsTblComputerName + $MySecretsTblShareName + $MySecretsTblFileName + $MySecretsTblUncFilePath + $MySecretsTblUsername + $MySecretsTblPassword + $MySecretsTblPasswordEnc + $MySecretsTblKeyFilePath + + +
+ Section: $MySecretsTblSection
+ Object Name: $MySecretsTblObjectName
+ Target URL: $MySecretsTblTargetURL
+ Target Server: $MySecretsTblTargetServer
+ Target Port: $MySecretsTblTargetPort
+ Database: $MySecretsTblDatabase
+ Domain: $MySecretsTblDomain
+
+ + +"@ + + # Output or append the generated HTML table row + $MySecretsTbl + } + # ---------------------------------------------------------------------- # Calculate risk score per acl - ace insights @@ -4292,6 +4344,19 @@ $NewHtmlReport = @" Report