Update Analyze-HuntSMBShares.ps1

Bug fix.
This commit is contained in:
Scott Sutherland 2024-09-17 12:35:38 -05:00 committed by GitHub
parent 71aa800567
commit cbca2188e7
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -5,7 +5,7 @@
#--------------------------------------
# Author: Scott Sutherland, 2024 NetSPI
# License: 3-clause BSD
# Version: v1.90
# Version: v1.91
# References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell.
function Analyze-HuntSMBShares
{
@ -3374,11 +3374,11 @@ function Analyze-HuntSMBShares
$ShareNameCategoryName = $_
# Get list of that sharename and category
$ShareNameCategoryFilesBase = $InterestingFilesAllObjects | Where ShareName -eq "$ShareName" | where Category -eq "$ShareNameCategoryName" | select FileName
$ShareNameCategoryFiles = $InterestingFilesAllObjects | Where ShareName -eq "$ShareName" | where Category -eq "$ShareNameCategoryName" | select FileName | ForEach-Object { $ASDF = $_.FileName; "$ASDF<br>" } | out-string
$ShareNameCategoryFilesBase = $InterestingFilesAllObjects | Where ShareName -eq "$ShareName" | where Category -eq "$ShareNameCategoryName" | where FileName -notlike "" | select FileName -Unique
$ShareNameCategoryFiles = $InterestingFilesAllObjects | Where ShareName -eq "$ShareName" | where Category -eq "$ShareNameCategoryName" | select FileName -Unique | ForEach-Object { $ASDF = $_.FileName; "$ASDF<br>" } | out-string
# Get category count
$ShareNameCategoryFilesCount = $ShareNameCategoryFilesBase | measure | select count -expandproperty count
$ShareNameCategoryFilesCount = $ShareNameCategoryFilesBase | where FileName -notlike "" | select FileName -Unique | measure | select count -expandproperty count
# Generate HTML with Category
if($ShareNameCategoryFilesCount -ne 0){
@ -3394,7 +3394,7 @@ function Analyze-HuntSMBShares
}
# Get total for interesting files for target share name
$ShareNameInterestingFilesCount = $InterestingFilesAllObjects | Where ShareName -eq "$ShareName" | measure | select count -expandproperty count
$ShareNameInterestingFilesCount = $InterestingFilesAllObjects | Where ShareName -eq "$ShareName" | select filename -Unique | measure | select count -expandproperty count
if($ShareNameInterestingFilesCount -gt 0){
$ShareRowCountInteresting = "Yes"
}else{