Update PowerHuntShares.psm1

Added netlogon and sysvol to the excessive privileges exclusion list.
This commit is contained in:
Scott Sutherland 2022-12-12 15:29:35 -06:00 committed by GitHub
parent 87df2f1c4c
commit bffa1363b5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -4,7 +4,7 @@
#--------------------------------------
# Author: Scott Sutherland, 2022 NetSPI
# License: 3-clause BSD
# Version: v1.32
# Version: v1.33
# References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell.
function Invoke-HuntSMBShares
{
@ -634,7 +634,7 @@ function Invoke-HuntSMBShares
if($line.ShareAccess -like "Yes"){
if(($line.ShareName -notlike "print$") -and ($line.ShareName -notlike "prnproc$") -and ($line.ShareName -notlike "*printer*"))
if(($line.ShareName -notlike "print$") -and ($line.ShareName -notlike "prnproc$") -and ($line.ShareName -notlike "*printer*") -and ($line.ShareName -notlike "sysvol") -and ($line.ShareName -notlike "netlogon"))
{
$line
}