diff --git a/PowerHuntShares.psm1 b/PowerHuntShares.psm1 index 6d278c2..5242b1d 100644 --- a/PowerHuntShares.psm1 +++ b/PowerHuntShares.psm1 @@ -4,7 +4,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.112 +# Version: v1.113 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Invoke-HuntSMBShares { @@ -2389,6 +2389,45 @@ function Invoke-HuntSMBShares if($RiskLevelFileListGroupResult -eq "Critical"){$RiskLevelFolderGroupCountCritical = $RiskLevelFolderGroupCountCritical + 1} } + # ---------------------------------------------------------------------- + # Calculate Peer Comparison Data - INSIGHTS + # ---------------------------------------------------------------------- + # % of computers, shares, aces with excessive privs enumerated from single active directory domain + + # Set averages from a sample of 50 representative (size and industry) environments + $PeerCompareAverageP = "[18, 9, 15]" + + # Get actual computer % + if($ComputerPingableCount -gt 0){ + $PeerComparisonComputerCount = $ComputerPingableCount # use ping count + }else{ + $PeerComparisonComputerCount = $Computers445OpenCount # use open445 count + } + $PeerComparActualComputers = [math]::Round($ComputerWithExcessive/$PeerComparisonComputerCount,2) * 100 + + # Get actual shares % + $PeerComparActualShares = [math]::Round($ExcessiveSharesCount/$AllSMBSharesCount,2) * 100 + + # Get actual aces % + $PeerComparActualAces = [math]::Round($ExcessiveSharePrivsCount/$ShareACLsCount ,2) * 100 + + # Set actual + $PeerCompareActuaP = "[$PeerComparActualComputers, $PeerComparActualShares, $PeerComparActualAces]" + + # ---------------------------------------------------------------------- + # Calculate Remediation Prioritization and Charts - INSIGHTS + # ---------------------------------------------------------------------- + $RemediationBase = "[$ExcessiveSharePrivsCount,$ExcessiveSharePrivsCount,$ExcessiveSharePrivsCount]" + $RemediationSave = "[$ExcessiveSharePrivsCount,$FolderGroupChartCount,$ShareNameChartCount]" + $RemediationSaveFgP = 100 - ([math]::Round($FolderGroupChartCount/$ExcessiveSharePrivsCount,2) * 100) + $RemediationSaveSnP = 100 - ([math]::Round($ShareNameChartCount/$ExcessiveSharePrivsCount,2) * 100) + + if($RemediationSaveFgP -gt $RemediationSaveSnP){ + $RemediationSavings = $RemediationSaveFgP + }else{ + $RemediationSavings = $RemediationSaveSnP + } + # ---------------------------------------------------------------------- # Create ShareGraph Nodes and Edges # ---------------------------------------------------------------------- @@ -5596,6 +5635,25 @@ input[type="checkbox"]:checked::before {
+ +