diff --git a/Scripts/Analyze-HuntSMBShares.ps1 b/Scripts/Analyze-HuntSMBShares.ps1 index 8f06cbd..2263b60 100644 --- a/Scripts/Analyze-HuntSMBShares.ps1 +++ b/Scripts/Analyze-HuntSMBShares.ps1 @@ -5,7 +5,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.68 +# Version: v1.70 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Analyze-HuntSMBShares { @@ -1631,14 +1631,18 @@ function Analyze-HuntSMBShares # Files $AceRowFilecount = $_.FileCount - $AceRowFileList = $_.FileList + $AceRowFileList = $_.FileList -split "`r`n" | ForEach-Object { $ASDF = $_; "$ASDF
" } | Out-String $AceRow = @" - $AceRowRiskScore $AceRowRiskLevel + $AceRowRiskScore $AceRowRiskLevel $AceRowComputer - $AceRowShareName - $AceRowSharePath + + $AceRowShareName +
+ $AceRowSharePath +
+ $AceRowACE $AceRowIdentity $AceRowShareOwner @@ -1656,6 +1660,35 @@ function Analyze-HuntSMBShares $AceRow } + # + # Build ACE summary + # + + # Get unique filesystemright Names + $UniqueFileSystemRights = (($ExcessiveSharePrivsFinal | Select FileSystemRights -Unique -ExpandProperty FileSystemRights | Sort) -split("/")) -split(",") | select -Unique | sort + + # Create structure for chart categories + $UniqueFileSystemRightsNames = "" + $UniqueFileSystemRightsCategories = "'" + ($UniqueFileSystemRights -join("','") ) + "'" + + # Get count for each system right + $UniqueFileSystemRightsCounts = $UniqueFileSystemRights | + foreach { + + # Set target right + $TargetFileSystemRight = $_ + + # Get count for filesystemright + $TargetFileSystemRightCount = $ExcessiveSharePrivsFinal | where FileSystemRights -like "*$TargetFileSystemRight*" | measure | select count -ExpandProperty count + + # Append to end of string + $TargetFileSystemRightCount + " " + } + + # Create structure for chart series data + $UniqueFileSystemRightsSeries = "[" + ($UniqueFileSystemRightsCounts -replace(" ",",")) + "]" + $UniqueFileSystemRightsSeries = $UniqueFileSystemRightsSeries -replace(" ",",") + # ---------------------------------------------------------------------- # Create Computer Insight Summary Information & Table Rows @@ -4970,21 +5003,19 @@ $ComputerCount computers were found in the $TargetDomain Active Directory domain Below is a list of the ACE (access control entries) configured with excessive privileges found in the $TargetDomain Active Directory domain. -
- +
- Inescure ACEs + Inescure ACEs Found



- +
$ExcessiveSharePrivsCount -
+

- -
+
ACE Count by Risk Level
@@ -4994,10 +5025,23 @@ Below is a list of the ACE (access control entries) configured with excessive pr
-
-
+
+ +
- Exposed File Count by Category + ACE Type Count +
+
+
+
+
+
+
+
+ +
+
+ Interesting File Count
@@ -5022,7 +5066,7 @@ Below is a list of the ACE (access control entries) configured with excessive pr
Loading...
- Export + Export
@@ -5030,14 +5074,13 @@ Below is a list of the ACE (access control entries) configured with excessive pr - - - - - - - - + + + + + + + @@ -5744,7 +5787,7 @@ Folder groups are SMB shares that contain the exact same file listing. Each file - + @@ -6219,7 +6262,48 @@ Invoke-HuntSMBShares -Threads 20 -RunSpaceTimeOut 10 -OutputDirectory c:\folder\ } } +// -------------------------- +// ACE Page: Type chart +// -------------------------- +// Initialize ApexCharts +const ChartAceTypeOptions = { + series: [{ + data: $UniqueFileSystemRightsSeries + }], + chart: { + type: 'bar', + height: 200 + }, + plotOptions: { + bar: { + borderRadius: 0, + borderRadiusApplication: 'end', + horizontal: true, + colors: { + backgroundBarColors: ['#e0e0e0'], + backgroundBarOpacity: 1, + ranges: [{ + from: 0, + to: 1000, + color: '#f08c41' + }] + } + } + }, + dataLabels: { + enabled: false + }, + grid: { + show: false + }, + xaxis: { + categories: [$UniqueFileSystemRightsCategories] + } +}; + +const ChartAceType = new ApexCharts(document.querySelector("#ChartAceType"), ChartAceTypeOptions); +ChartAceType.render(); // -------------------------- // ACE Page: Risk Level chart
Risk Level ComputerShare NameShare PathACEACE IdentityShare OwnerCreation DateModified DateFilesShare NameFileSystemRightIdentityShare OwnerCreation DateLast ModifiedFiles
Share Count File Count Risk LevelFile GroupFolder Group