diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index ab845f1..fb8640a 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.104 +# Version: v1.105 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -1747,6 +1747,10 @@ function Invoke-HuntSMBShares # Outbout objects to file $InterestingFilesAllObjects | Export-Csv -NoTypeInformation "$OutputDirectory\$TargetDomain-Shares-Interesting-Files.csv" + # Get secrets & sensitive counts for dashboard + $InterestingFilesAllObjectsSecretCount = $InterestingFilesAllObjects | where category -eq 'secret' | measure | select count -ExpandProperty count + $InterestingFilesAllObjectsSensitiveCount = $InterestingFilesAllObjects | where category -eq 'sensitive' | measure | select count -ExpandProperty count + # Get order list of interesting file names by count $InterestingFilesAllFilesCount = $InterestingFilesAllObjects | measure | select count -ExpandProperty count $InterestingFilesAllFilesCountU = $InterestingFilesAllObjects | select filename -Unique | measure | select count -ExpandProperty count @@ -4955,16 +4959,16 @@ input[type="checkbox"]:checked::before {
- + + - - + @@ -5060,15 +5064,15 @@ input[type="checkbox"]:checked::before {
-

Results Overview

+

Summary Report

-
-
+
+

Affected Assets

- Below is a summary of the computers, shares, and ACLs associated with shares configured with excessive privileges. - $ExcessiveSharePrivsCount ACL entries, on $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers were found configured with excessive privileges on the $TargetDomain domain. Click the "Exposure Summary" or the titles for more detail.

+ Below is a summary of the computers, shares, and ACEs (Access Control Entries) associated with shares configured with excessive privileges. + $ExcessiveSharePrivsCount ACL entries, on $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers were found configured with excessive privileges on the $TargetDomain domain. Click the "Exposure Summary" or the titles on the cards below to explore the details.

@@ -5199,7 +5203,7 @@ input[type="checkbox"]:checked::before {
- ACLs + ACEs
@@ -5266,7 +5270,7 @@ input[type="checkbox"]:checked::before { -->

Exposure Summary

- Below is a summary of number of share ACLs by risk level and a summary of file name counts that may contain passwords, sensitive data, or result in remote code execution. Click the titles for more detail.

+ In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE configurations were discovered across shares in the $TargetDomain Active Directory domain. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. Overall, $InterestingFilesAllFilesCount interesting files were found that could potentially lead to unauthorized data access or remote code execution. Click the chart titles below to explore the details.

@@ -5287,7 +5291,7 @@ input[type="checkbox"]:checked::before {
- Exposed File Count by Category + Interesting Files Count
@@ -6222,16 +6226,16 @@ This section contains a list of the computers hosting shares configured with exc
-

Affected Subnets

+

Networks

-This section contains a list of subnets hosting computers with shares that are configured with accessibe privileges. +This section contains a list of networks/subnets hosting computers with shares that are configured with excessive privileges.
$SubnetSummaryHTML @@ -6275,7 +6279,7 @@ This section lists the most common share owners.

Folder Groups

-Folder groups are SMB shares that contain the exact same file listing. Each file group has been hashed so they can be quickly correlated. In some cases, shares with the exact same file listing may be related to a single application or process. This information can help identify the root cause associated with the excessive privileges and expedite remediation. +Folder groups are SMB shares that contain the exact same file listing. Each folder group has been hashed so they can be quickly correlated. In some cases, shares with the exact same file listing may be related to a single application or process. This information can help identify the root cause associated with the excessive privileges and expedite remediation.
@@ -6566,7 +6570,7 @@ Below are some tips for getting started on prioritizing the remediation of share
- Scan Summary
+
Scan Summary