From a0f3e54cdeac26419dfbe7fd5226e6ec7149f31e Mon Sep 17 00:00:00 2001 From: Scott Sutherland Date: Fri, 19 Jul 2024 09:45:10 -0500 Subject: [PATCH] Update PowerHuntShares.psm1 small dashboard updates. --- PowerHuntShares.psm1 | 512 ++++++++++++++----------------------------- 1 file changed, 164 insertions(+), 348 deletions(-) diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index 045f73d..5c0f961 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.77 +# Version: v1.78 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -3670,7 +3670,7 @@ $NewHtmlReport = @" .cardtitle{ padding:5px; - padding-left: 20px; + --padding-left: 20px; font-size: 20; color: white; font-weight:bold; @@ -4148,7 +4148,7 @@ input[type="checkbox"]:checked::before { } - + -
$ExcessiveSharePrivsCount ACL entries, on $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers were found configured with excessive privilegs on the $TargetDomain domain.
- -
-
- Computers
- host shares with excessive privileges +
+ Computers
- - -
- - $PercentComputerExPrivP - - $ComputerWithExcessive - of $ComputerCount - - - - - - - - - - - - - - - - -
- Read Access - $CheckStatusComputerR - -
-
-
- $PercentComputerReadP
$ComputerWithReadCount of $ComputerCount -
- Write Access - $CheckStatusComputerW - -
-
-
- $PercentComputerWriteP
$ComputerWithWriteCount of $ComputerCount -
- High Risk - $CheckStatusComputerH - -
-
-
- $PercentComputerHighRiskP
$ComputerwithHighRisk of $ComputerCount -
+ + $ComputerWithExcessive + +
+ +
+
+
+ $ComputerWithExcessive of $ComputerCount ($PercentComputerExPrivP)

+ + + + + + + + + + + + + +
+ Read + +
+
+
+ $ComputerWithReadCount of $ComputerCount ($PercentComputerReadP) +
+ Write + +
+
+
+ $ComputerWithWriteCount of $ComputerCount ($PercentComputerWriteP) +
+ High Risk + +
+
+
+ $ComputerwithHighRisk of $ComputerCount ($PercentComputerHighRiskP) +
+
+
+
- - -
-
- Shares
- configured with excessive privileges +
+
+ Shares
- - -
- - $PercentSharesExPrivP - - $ExcessiveSharesCount - of $AllSMBSharesCount - - - - - - - - - - - - - - - - -
- Read Access - $CheckStatusShareR - -
-
-
- $PercentSharesReadP
$SharesWithReadCount of $AllSMBSharesCount -
- Write Access - $CheckStatusShareW - -
-
-
- $PercentSharesWriteP
$SharesWithWriteCount of $AllSMBSharesCount -
- High Risk - $CheckStatusShareH - -
-
-
- $PercentSharesHighRiskP
$SharesHighRiskCount of $AllSMBSharesCount -
+ + $ExcessiveSharesCount + +
+ +
+
+
+ $ExcessiveSharesCount of $AllSMBSharesCount ($PercentSharesExPrivP)

+ + + + + + + + + + + + + +
+ Read + +
+
+
+ $SharesWithReadCount of $AllSMBSharesCount ($PercentSharesReadP;) +
+ Write + +
+
+
+ $SharesWithWriteCount of $AllSMBSharesCount ($PercentSharesWriteP) +
+ High Risk + +
+
+
+ $SharesHighRiskCount of $AllSMBSharesCount ($PercentSharesHighRiskP) +
+
+
+
- - -
-
- Share ACLs
- configured with excessive privileges +
+
+ ACLs
- - -
- - $PercentAclExPrivP - - $ExcessiveSharePrivsCount - of $ShareACLsCount - - - - - - - - - - - - - - - - -
- Read Access - $CheckStatusAclR - -
-
-
- $PercentAclReadP
$AclWithReadCount of $ShareACLsCount -
- Write Access - $CheckStatusAclw - -
-
-
- $PercentAclWriteP
$AclWithWriteCount of $ShareACLsCount -
- High Risk - $CheckStatusAclH - -
-
-
- $PercentAclHighRiskP
$AclHighRiskCount of $ShareACLsCount -
+ + $ExcessiveSharePrivsCount + +
+ +
+
+
+ $ExcessiveSharePrivsCount of $ShareACLsCount ($PercentAclExPrivP)

+ + + + + + + + + + + + + +
+ Read + +
+
+
+ $AclWithReadCount of $ShareACLsCount ($PercentAclReadP) +
+ Write + +
+
+
+ $AclWithWriteCount of $ShareACLsCount ($PercentAclWriteP) +
+ High Risk + +
+
+
+ $AclHighRiskCount of $ShareACLsCount ($PercentAclHighRiskP) +
+
+
+
- - -
-
- Top Share Names
- configured with excessive privileges -
-
- - -
- - $CommonShareNamesTotalP - - $CommonShareNamesRollingCount - of $AllSMBSharesCount - - - - - $CommonShareNamesTopStringTCard -
-
-
- - - - -
-
- Shares Created
- in last $ShareCreationDays days -
-
- - -
- - $ExpPrivCreationLastP - - $ExPrivCreationLastnShareCount - of $AllSMBSharesCount - - - - - - - - - - - - - - - - -
Computers - $ExPrivCreationLastComputerB -
Shares - $ExPrivCreationLastShareB -
ACLs - $ExPrivCreationLastShareAclB -
-
-
- - - $CardCreationTimeLine -
- - - -
-
- Shares Accessed
- in last $LastAccessDays days -
-
- - -
- - $ExpPrivAccessLastP - - $ExPrivAccessLastnShareCount - of $AllSMBSharesCount - - - - - - - - - - - - - - - - -
Computers - $ExPrivAccesLastComputerB -
Shares - $ExPrivAccesLastShareB -
ACLs - $ExPrivAccesLastShareAclB -
-
-
- - - $CardLastAccessTimeLine -
- - - - -
-
- Shares Modified
- in last $LastModDays days -
-
- - -
- - $ExpPrivModifiedLastP - - $ExPrivModifiedLastnShareCount - of $AllSMBSharesCount - - - - - - - - - - - - - - - - -
Computers - $ExPrivModifiedLastComputerB -
Shares - $ExPrivModifiedLastShareB -
ACLs - $ExPrivModifiedLastShareAclB -
-
-
- - - $CardLastModifiedTimeLine - -
@@ -5421,7 +5237,7 @@ Below are some tips for getting started on prioritizing the remediation of share
-

SMB Share Excessive Privilege Report

+

HELP!

This report summarizes the shares identified as being configured with excessive privileges.