diff --git a/Scripts/Analyze-HuntSMBShares.ps1 b/Scripts/Analyze-HuntSMBShares.ps1 index 5e7cf2b..712b8ea 100644 --- a/Scripts/Analyze-HuntSMBShares.ps1 +++ b/Scripts/Analyze-HuntSMBShares.ps1 @@ -5,7 +5,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.72 +# Version: v1.73 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Analyze-HuntSMBShares { @@ -1703,6 +1703,74 @@ function Analyze-HuntSMBShares $UniqueFileSystemRightsSeries = "[" + ($UniqueFileSystemRightsCounts -replace(" ",",")) + "]" $UniqueFileSystemRightsSeries = $UniqueFileSystemRightsSeries -replace(" ",",") + # ---------------------------------------------------------------------- + # Create Identity Insight Summary Information + # ---------------------------------------------------------------------- + + # Get share owners + [array]$IdentityOwnerList = $ExcessiveSharePrivsFinal | select ShareOwner -Unique -ExpandProperty ShareOwner + $IdentityOwnerListCount = $IdentityOwnerList | measure | select count -ExpandProperty count + + # Get identity references + [array]$IdentityReferenceList = $ExcessiveSharePrivsFinal | select IdentityReference -Unique -ExpandProperty IdentityReference + $IdentityReferenceListCount = $IdentityReferenceList | measure | select count -ExpandProperty count + + # Combine identity lists + [array]$IdentityCombinedList = $IdentityOwnerList + $IdentityReferenceList | sort | select -Unique + $IdentityCombinedListCount = $IdentityCombinedList | measure | select count -ExpandProperty count + + # Process each identity + $IdentityTableRows = $IdentityCombinedList | + foreach { + + # Set target identity + $TargetIdentity = $_ + + # Get share owner count + $TargetIdentityOwnerCount = $ExcessiveSharePrivsFinal | where ShareOwner -eq "$TargetIdentity" | select SharePath | measure | select count -ExpandProperty count + + # Get share access count + $TargetIdentityShareAccessCount = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | select SharePath -Unique | measure | select count -ExpandProperty count + $TargetIdentityShareAccess = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | select SharePath -Unique -ExpandProperty SharePath | ForEach-Object { $ASDF = $_; "$ASDF
" } | Out-String + + # Get ACE low risk + $TargetIdentityLowRiskCount = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Low" | select SharePath -Unique |measure | select count -ExpandProperty count + #$TargetIdentityLowRisk = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Low" | select SharePath -Unique | ForEach-Object { $ASDF = $_; "$ASDF
" } | Out-String + + # Get ACE medium risk + $TargetIdentityMediumRiskrCount = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Medium" | select SharePath -Unique | measure | select count -ExpandProperty count + #$TargetIdentityMediumRisk = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Medium" | select SharePath -Unique | ForEach-Object { $ASDF = $_; "$ASDF
" } | Out-String + + # Get ACE high risk + $TargetIdentityHighRiskCount = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "High" | select SharePath -Unique | measure | select count -ExpandProperty count + #$TargetIdentityHighRisk = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "High" | select SharePath -Unique | ForEach-Object { $ASDF = $_; "$ASDF
" } | Out-String + + # Get ACE critical risk + $TargetIdentityCriticalRiskCount = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Critical" | select SharePath -Unique | measure | select count -ExpandProperty count + #$TargetIdentityCriticalRisk = $ExcessiveSharePrivsFinal | where IdentityReference -eq "$TargetIdentity" | where RiskLevel -eq "Critical" | select SharePath -Unique | ForEach-Object { $ASDF = $_; "$ASDF
" } | Out-String + + # Get interesting files count (same as share names) + $TargetIdentityInterestingFiles = "tbd" + + $BuildIdentityTableRows = @" + + $TargetIdentity + $TargetIdentityOwnerCount + + +
+ $TargetIdentityShareAccess +
+ + $TargetIdentityLowRiskCount + $TargetIdentityMediumRiskrCount + $TargetIdentityHighRiskCount + $TargetIdentityCriticalRiskCount + +"@ + $BuildIdentityTableRows + } + # ---------------------------------------------------------------------- # Create Computer Insight Summary Information & Table Rows @@ -4536,10 +4604,9 @@ input[type="checkbox"]:checked::before { + - - @@ -5003,6 +5070,99 @@ $ComputerCount computers were found in the $TargetDomain Active Directory domain
+ + + + +
+

Identities

+
+
+$IdentityCombinedListCount identities were discovered across shares in the $TargetDomain Active Directory domain. $IdentityOwnerListCount were owners and $IdentityReferenceListCount were assigned privileges. +
+ +
+ +
+ Identities Found +
+
+
+
+ $IdentityCombinedListCount +
+
+
+ +
+ +
+ Identities Assigned Ownership +
+
+
+
+ $IdentityOwnerListCount +
+
+
+ +
+ +
+ Identities Assigned Privileges +
+
+
+
+ $IdentityReferenceListCount +
+
+
+
+
+Note: Within the context of this report, all read and write access the "Everyone", "Authenticated Users", "BUILTIN\Users", "Domain Users", or "Domain Computers" groups are considered excessive privileges, because all provide domain users access to the affected shares due to privilege inheritance. +
+
+ +
Clear
+ +
+
+
Loading...
+ Export +
+ + + + + + + + + + + + + + + + + $IdentityTableRows + +
IdentityOwned SharesAccessible SharesLow Risk SharesMedium Risk SharesHigh Risk SharesCritical Risk Shares
+
+