diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index af113a2..4a3ed37 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.98 +# Version: v1.99 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -2006,10 +2006,110 @@ function Invoke-HuntSMBShares $RiskLevelCountCritical = $ExcessiveSharePrivsFinal | where RiskLevel -eq 'Critical' | measure | select count -ExpandProperty count # ---------------------------------------------------------------------- - # Create Computer Summary Information + # Create Computer Insight Summary Information # ---------------------------------------------------------------------- - # TBD + # Reset global computer risk levels + $RiskLevelComputersCountCritical = 0 + $RiskLevelComputersCountHigh = 0 + $RiskLevelComputersCountMedium = 0 + $RiskLevelComputersCountLow = 0 + + # Rest row data + $ComputerTableRows = "" + $ComputerTableRow = "" + + # Get computer list + $ComputerPageComputerList = $ExcessiveSharePrivsFinal | select ComputerName -Unique + + # Get computer count + $ComputersChartCount = $ComputerPageComputerList | measure | select count -ExpandProperty count # Unique folder group + + # Process each computer & add data to final risk counts + $ComputerPageComputerList | + foreach { + + # Set target share name + $TargetComputers = $_.ComputerName + + # Grab the risk level for the highest risk acl for the share name + $ComputersTopACLRiskScore = $ExcessiveSharePrivsFinal | where ComputerName -eq $TargetComputers | select RiskScore | sort RiskScore -Descending | select -First 1 | select RiskScore -ExpandProperty RiskScore + + # Check risk level - Highest wins + If($ComputersTopACLRiskScore -le 4 ) { $RiskLevelComputersResult = "Low"} + If($ComputersTopACLRiskScore -gt 4 -and $ComputersTopACLRiskScore -lt 11 ) { $RiskLevelComputersResult = "Medium"} + If($ComputersTopACLRiskScore -ge 11 -and $ComputersTopACLRiskScore -lt 20 ) { $RiskLevelComputersResult = "High"} + If($ComputersTopACLRiskScore -ge 20 ) { $RiskLevelComputersResult = "Critical"} + + # Increment counts + if($RiskLevelComputersResult -eq "Low" ){$RiskLevelComputersCountLow = $RiskLevelComputersCountLow + 1} + if($RiskLevelComputersResult -eq "Medium" ){$RiskLevelComputersCountMedium = $RiskLevelComputersCountMedium + 1} + if($RiskLevelComputersResult -eq "High" ){$RiskLevelComputersCountHigh = $RiskLevelComputersCountHigh + 1} + if($RiskLevelComputersResult -eq "Critical"){$RiskLevelComputersCountCritical = $RiskLevelComputersCountCritical + 1} + + # Get share count + $ComputerPageShares = $ExcessiveSharePrivsFinal | where ComputerName -eq $TargetComputers | select SharePath -Unique | ForEach-Object { $ASDF = $_.SharePath; "$ASDF
" } | out-string + $ComputerPageShareCount = $ExcessiveSharePrivsFinal | where ComputerName -eq $TargetComputers | select SharePath -Unique | measure | select count -ExpandProperty count + $ComputerPageShareCountHTML = @" + +
+ $ComputerPageShares +
+"@ + # Check for interesting files + # For each file category generate count and list + $ComputerPageInterestingFilesInsideHTML = "" + $ComputerPageInterestingFilesOutsideHTML = "" + $FileNamePatternCategories | select Category -ExpandProperty Category | + foreach{ + + # Get category + $ComputerPageCategoryName = $_ + + # Get list of that sharename and category + $ComputerPageCategoryFilesBase = $InterestingFilesAllObjects | where ComputerName -eq $TargetComputers | where Category -eq "$ComputerPageCategoryName" | select FileName + $ComputerPageCategoryFiles = $InterestingFilesAllObjects | where ComputerName -eq $TargetComputers | where Category -eq "$ComputerPageCategoryName" | select FileName | ForEach-Object { $ASDF = $_.FileName; "$ASDF
" } | out-string + + # Get category count + $ComputerPageCategoryFilesCount = $ComputerPageCategoryFilesBase | measure | select count -expandproperty count + + # Generate HTML with Category + if($ComputerPageCategoryFilesCount -ne 0){ + $ComputerPageInterestingFilesHTMLPrep = @" + +
+ $ComputerPageCategoryFiles +
+"@ + # Add to code block + $ComputerPageInterestingFilesInsideHTML = $ComputerPageInterestingFilesInsideHTML + $ComputerPageInterestingFilesHTMLPrep + } + } + + # Get total for interesting files for target share name + $ComputerPageInterestingFilesCount = $InterestingFilesAllObjects | where ComputerName -eq $TargetComputers | measure | select count -expandproperty count + + # Build final interesting file html for computers page + $ComputerPageInterestingFilesOutsideHTML = @" + +
+ $ComputerPageInterestingFilesInsideHTML +
+"@ + + # Create Row + $ComputerTableRow = @" + + $TargetComputers + $ComputersTopACLRiskScore $RiskLevelComputersResult + $ComputerPageShareCountHTML + $ComputerPageInterestingFilesOutsideHTML + +"@ + + # Add row to rows + $ComputerTableRows = $ComputerTableRows + $ComputerTableRow + } # ---------------------------------------------------------------------- # Create Share Name Summary Information @@ -4717,10 +4817,11 @@ input[type="checkbox"]:checked::before { - - + + - + + @@ -5083,6 +5184,112 @@ $CardLastModifiedTimeLine + + + + +
+

Computers

+
+
+$ComputerCount computers were found in the $TargetDomain Active Directory domain. Below is a list of the computers hosting shares configured with excessive privileges. +
+ +
+ +
+ Live Computers Found +
+
+


+ + $ComputerPingableCount +
($ComputerWithExcessive host shares with excessive privileges) +
+
+ + +
+
+ Computer Count by Share Exposure +
+
+
+
+
+
+
+
+
+
+ Computer Count by Risk Level +
+
+
+
+
+
+
+
+ +
+ +
Clear
+ +
+
+
Loading...
+ Export +
+ + + + + + + + + + + + + + + + + $ComputerTableRows + +
Computer
Name  
Computer Name
is the name of the computer.
Risk
Level  
Risk Level
relfects the exposure of credentials and sensitive data.
Share
Count  
Share Count
is the number of shares
hosted on the same computer.
Interesting
Files  
Interesting Files
are filenames that
may be sensitive.
+
+
+ + @@ -5547,7 +5754,7 @@ Below is a summary of the exposure associated with each of those groups.

Share Names

-This section contains a list of the most common SMB share names. In some cases, shares with the exact same name may be related to a single application or process. This information can help identify the root cause associated with the excessive privileges and expedite remediation. +$AllSMBSharesCount shares were discovered across computers in the $TargetDomain Active Directory domain. $ShareNameChartCount shares were found configured with excessive privileges. Below is a summary of those shares grouped by name.
@@ -5658,6 +5865,120 @@ This section contains a list of the most common SMB share names. In some cases,
+ + + + +
+

Computers

+
+
+This section contains a list of the computers hosting shares configured with excessive privileges. +
+
+ +
+ Shares Found +
+
+


+ + $ComputerNameChartCountUnique +
+ +
+ +
+
+ Computer Count by Risk Level +
+
+
+
+
+
+
+
+ + +
+
+ Exposed File Count by Category +
+
+
+
+
+
+
+
+ +
+ +
Quick Filters
+ + + + + + + +
+
+
Loading...
+ Export +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Share
Name  
Computer Name
is the name of the computer.
Risk
Level  
Risk Level
relfects the exposure of credentials and sensitive data.
Share
Count  
Share Count
is the number of unique shares with
the same name.
Interesting
Files  
Interesting Files
are filenames that
may be sensitive.
1111
1111
+ +
+ @@ -6237,6 +6558,7 @@ The left menu can be used to find summary data, the scan summary is in the table