diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index 49d8f12..b8be899 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.106 +# Version: v1.107 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -5133,11 +5133,11 @@ input[type="checkbox"]:checked::before {
-
+

Affected Assets

-
+
Below is a summary of the computers, shares, and ACEs (Access Control Entries) associated with shares configured with excessive privileges. - $ExcessiveSharePrivsCount ACL entries, on $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers were found configured with excessive privileges on the $TargetDomain domain. Click the "Exposure Summary" or the titles on the cards below to explore the details.

+ $ExcessiveSharePrivsCount ACL entries, on $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers were found configured with excessive privileges on the $TargetDomain domain. Overall, $IdentityReferenceListCount identities were assigned excessive privileges. Click the "Exposure Summary" or the titles on the cards below to explore the details.

@@ -5148,7 +5148,7 @@ input[type="checkbox"]:checked::before { -
+
@@ -5207,7 +5207,7 @@ input[type="checkbox"]:checked::before { |||||||||| CARD: SHARE SUMMARY --> -
+
@@ -5266,7 +5266,7 @@ input[type="checkbox"]:checked::before { |||||||||| CARD: ACL SUMMARY --> -
+
@@ -5321,6 +5321,30 @@ input[type="checkbox"]:checked::before {
+ + +
+ +
+ + $IdentityReferenceListCount + +
+ +
+
+
+ Coming soon. +
+
+
+
+
+
@@ -5333,11 +5357,11 @@ input[type="checkbox"]:checked::before { -
+

Exposure Summary

In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE configurations were discovered across shares in the $TargetDomain Active Directory domain. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. Overall, $InterestingFilesAllFilesCount interesting files were found that could potentially lead to unauthorized data access or remote code execution. Click the chart titles below to explore the details.

-