diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index 227be4e..421f9db 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.167 +# Version: v1.168 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -5176,18 +5176,18 @@ $NewHtmlReport = @" margin-bottom:1rem } - a,a:visited{ + a, a:visited{ text-decoration:none; - font-size: 14; - color: gray; + color: #4A4A4A; + font-style: italic; font-weight: bold; } a:hover{ - --color:#9B3722; - text-decoration:underline + text-decoration: underline; } + .preload *{ -webkit-transition:none !important; -moz-transition:none !important; @@ -5983,12 +5983,12 @@ input[type="checkbox"]:checked::before {
- +
- POWERHUNTSHARES + POWERHUNTSHARES
$TargetDomain
- +
@@ -6123,9 +6123,11 @@ input[type="checkbox"]:checked::before { -->
Risk & Data Exposure
 - In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE (Access Control Entry) configurations were discovered across $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers in the $TargetDomain Active Directory domain. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. $SecretsRecoveredCount credentials were recovered from $SecretsRecoveredFileCount of the discovered $InterestingFilesAllObjectsSecretCount secrets files. Overall, $InterestingFilesAllFilesCount interesting files were found accessible to all domain users that could potentially lead to unauthorized data access or remote code execution. -
-
+ In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE (Access Control Entry) configurations were discovered across $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers in the $TargetDomain Active Directory domain. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. $SecretsRecoveredCount credentials were recovered from $SecretsRecoveredFileCount of the discovered $InterestingFilesAllObjectsSecretCount secrets files. Overall, $InterestingFilesAllFilesCount interesting files were found accessible to all domain users that could potentially lead to unauthorized data access or remote code execution. +

View the + Insecure ACEs, + Extracted Secrets, and + Interesting Files sections for more details.
@@ -6213,7 +6215,10 @@ input[type="checkbox"]:checked::before { Remediation & Prioritization Recommendations
 Consider remediating share ACEs by risk level, starting with critical and high risks. Consider reviewing the share creation timeline and data details from the other sections for additional context. Next, prioritize remediating groups of shares to speed up the process. Prioritize by folder group (shares containing exactly the same files) or by share names that have a high similarity score. - Prioritizing those groups may help reduce remediation actions by as much as $RemediationSavings percent for this environment. Below is a summary of the potential task reduction for each approach. + Prioritizing those groups may help reduce remediation actions by as much as $RemediationSavings percent for this environment. Below is a summary of the potential task reduction for each approach. +

View the + Folder Group or + Share Names sections for more details.