diff --git a/Scripts/Analyze-HuntSMBShares.ps1 b/Scripts/Analyze-HuntSMBShares.ps1 index 8e8350c..3ae6c33 100644 --- a/Scripts/Analyze-HuntSMBShares.ps1 +++ b/Scripts/Analyze-HuntSMBShares.ps1 @@ -5,7 +5,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.82 +# Version: v1.83 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Analyze-HuntSMBShares { @@ -702,10 +702,10 @@ function Analyze-HuntSMBShares $Object | Add-Member Desc $SubnetDesc $Object | Add-Member Created $SubnetCreated $Object | Add-Member Site $SubnetSite - $Object | Add-Member Acls $subnetaclsCount - $Object | Add-Member ReadAcls $subnetaclrCount - $Object | Add-Member WriteAcls $subnetaclwCount - $Object | Add-Member HighRiskAcls $subnetaclxCount + $Object | Add-Member ACEs $subnetaclsCount + $Object | Add-Member ReadACEs $subnetaclrCount + $Object | Add-Member WriteACEs $subnetaclwCount + $Object | Add-Member ExploitableACEs $subnetaclxCount $Object | Add-Member Shares $subnetsharesCount $Object | Add-Member Computers $subnetcomputersCount @@ -723,15 +723,15 @@ function Analyze-HuntSMBShares $SubnetFile = "$TargetDomain-Shares-Inventory-Common-Subnets.csv" # Create HTML table for report - + # Setup HTML begin Write-Verbose "[+] Creating html top." $HTMLSTART = @" "@ - + # Get list of columns - $MyCsvColumns = ("Computers","Shares","HighRiskAcls","WriteAcls","ReadAcls","Acls","Site","Created","Desc","Subnet") + $MyCsvColumns = ("Computers","Shares","ExploitableACEs","WriteACEs","ReadACEs","ACEs","Site","Created","Desc","Subnet") # Print columns creation $HTMLTableHeadStart= "" @@ -743,28 +743,41 @@ function Analyze-HuntSMBShares } $HTMLTableColumn = "$HTMLTableHeadStart$HTMLTableColumn" - # Create table rows + # Create table rows Write-Verbose "[+] Creating html table rows." $HTMLTableRow = $SubnetSummary | ForEach-Object { - + # Create a value contain row data - # Read = yellow, write = orange, highrisk = red (if value >0) $CurrentRow = $_ $PrintRow = "" $MyCsvColumns | ForEach-Object{ - + try{ $GetValue = $CurrentRow | Select-Object $_ -ExpandProperty $_ -ErrorAction SilentlyContinue + $ColumnIndex = $MyCsvColumns.IndexOf($_) + 1 + + # Set background color based on shifted conditions + $BackgroundColor = "" + + if ($ColumnIndex -eq 5 -and [int]$GetValue -gt 0) { # Originally for column 4 = write + $BackgroundColor = ' style="background-color:#FDFFd9;"' + } elseif ($ColumnIndex -eq 4 -and [int]$GetValue -gt 0) { # Originally for column 5 = read + $BackgroundColor = ' style="background-color:#FFCC98;"' + } elseif ($ColumnIndex -eq 3 -and [int]$GetValue -gt 0) { + $BackgroundColor = ' style="background-color:#FC6C84;"' # Originally for column 3=exploitable, 2=shares,1=computers + } + + # Append the value with the background color if($PrintRow -eq ""){ - $PrintRow = "" + $PrintRow = "$GetValue" }else{ - $PrintRow = "$PrintRow" + $PrintRow = "$GetValue$PrintRow" } }catch{} } - + # Return row $HTMLTableHeadstart = "" $HTMLTableHeadend = "" @@ -774,13 +787,12 @@ function Analyze-HuntSMBShares # Setup HTML end Write-Verbose "[+] Creating html bottom." $HTMLEND = @" - -
$GetValue$GetValue
+ + "@ # Return it - $SubnetSummaryHTML = "$HTMLSTART $HTMLTableColumn $HTMLTableRow $HTMLEND" - + $SubnetSummaryHTML = "$HTMLSTART $HTMLTableColumn $HTMLTableRow $HTMLEND" # ---------------------------------------------------------------------- # Calculate percentages @@ -1981,8 +1993,12 @@ function Analyze-HuntSMBShares $PeerComparisonComputerCount = $ComputerPingableCount # use ping count }else{ $PeerComparisonComputerCount = $Computers445OpenCount # use open445 count + $ComputerPingableCount = 0 #hacky patch } - $PeerComparActualComputers = [math]::Round($ComputerWithExcessive/$PeerComparisonComputerCount,2) * 100 + $PeerComparActualComputers = [math]::Round($ComputerWithExcessive/$PeerComparisonComputerCount,2) * 100 + $PeerComparActualComputersr = [math]::Round($ComputerWithReadCount/$PeerComparisonComputerCount,2) * 100 + $PeerComparActualComputersW = [math]::Round($ComputerWithWriteCount/$PeerComparisonComputerCount,2) * 100 + $PeerComparActualComputershr = [math]::Round($ComputerwithHighRisk/$PeerComparisonComputerCount,2) * 100 # Get actual shares % $PeerComparActualShares = [math]::Round($ExcessiveSharesCount/$AllSMBSharesCount,2) * 100 @@ -4936,7 +4952,7 @@ input[type="checkbox"]:checked::before {
- Interesting File Names Found + Interesting Files Found


@@ -4998,12 +5014,69 @@ input[type="checkbox"]:checked::before {

Summary Report

-
+
+ + +
+

Risk & Data Exposure

+ In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE (Access Control Entry) configurations were discovered across $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers in the $TargetDomain Active Directory domain. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. Overall, $InterestingFilesAllFilesCount interesting files were found that could potentially lead to unauthorized data access or remote code execution. +
+
+ +
+ + + +
+
+
+
+ +
+ + + +
+ + + +
+
+
+
+ +
+ + +
+ Remediation Prioritization
 + Consider remediating share ACEs by risk level, starting with critical and high risks. Next, prioritize remediating groups of shares to speed up the process. Prioritize by folder group (shares containing exactly the same files) or by share names that have a high similarity score. + Prioritizing those groups may help reduce remediation actions by as much as $RemediationSavings percent for this environment. Below is a summary of the potential task reduction for each approach. +
+ +
+ + + +
+
+
+
+ +
+ +
-

Affected Assets

+

Affected Asset Exposure

- Below is a summary of the computers, shares, and ACEs (Access Control Entries) associated with shares configured with excessive privileges. + Below is a summary of the computers, shares, and ACEs associated with shares configured with excessive privileges. $ExcessiveSharePrivsCount ACL entries, on $ExcessiveSharesCount shares, hosted by $ComputerWithExcessive computers were found configured with excessive privileges on the $TargetDomain domain. Overall, $IdentityReferenceListCount identities were assigned excessive privileges. Click the "Exposure Summary" or the titles on the cards below to explore the details.

@@ -5027,7 +5100,7 @@ input[type="checkbox"]:checked::before {
- $ComputerWithExcessive of $ComputerCount ($PercentComputerExPrivP)

+ $ComputerWithExcessive of $PeerComparisonComputerCount ($PeerComparActualComputers%)

@@ -5048,18 +5121,18 @@ input[type="checkbox"]:checked::before {
- $ComputerWithWriteCount of $ComputerCount ($PercentComputerWriteP) + $ComputerWithWriteCount of $PeerComparisonComputerCount ($PeerComparActualComputersW%)
@@ -5037,7 +5110,7 @@ input[type="checkbox"]:checked::before {
- $ComputerWithReadCount of $ComputerCount ($PercentComputerReadP) + $ComputerWithReadCount of $PeerComparisonComputerCount ($PeerComparActualComputersr%)
- High Risk + Exploitable
- $ComputerwithHighRisk of $ComputerCount ($PercentComputerHighRiskP) + $ComputerwithHighRisk of $PeerComparisonComputerCount ($PeerComparActualComputershr%)
@@ -5110,7 +5183,7 @@ input[type="checkbox"]:checked::before { - High Risk + Exploitable
@@ -5167,7 +5240,7 @@ input[type="checkbox"]:checked::before { - High Risk + Exploitable
@@ -5218,7 +5291,8 @@ input[type="checkbox"]:checked::before { -->
Peer Comparison
 - This section displays the percentage of assets associated with excessive share Access Control Entries (ACEs). Each percentage is calculated based on the total number of assets of that type discovered in the target environment. It also compares these figures to the average percentage of affected assets observed in other environments. + Below is a comaprison between the percent of affected assets in this environment and the average percent of affected assets observed in other environments. + The percentage is calculated based on the total number of assets discovered for each asset type.
@@ -5230,58 +5304,7 @@ input[type="checkbox"]:checked::before {
-
- -
-

Exposure Summary

- In total, $RiskLevelCountCritical critical, $RiskLevelCountHigh high, $RiskLevelCountMedium medium, and $RiskLevelCountLow low risk ACE configurations were discovered across shares in the $TargetDomain Active Directory domain. The affected shares were found hosting $InterestingFilesAllObjectsSecretCount files that may contain passwords and $InterestingFilesAllObjectsSensitiveCount files that may contain sensitive data. Overall, $InterestingFilesAllFilesCount interesting files were found that could potentially lead to unauthorized data access or remote code execution. Click the chart titles below to explore the details.

-
- -
- - - -
-
-
-
- -
- - - -
- - - -
-
-
-
- -
- - -
- Remediation Prioritization
 - In most cases it makes sense to remediate share ACEs that have been categorized as high or critical risk first. Next, prioritize shares in groups by folder group (shares containing exactly the same files) or by share names that have a high similarity score. - Prioritizing those groups may help reduce remediation actions by as much as $RemediationSavings percent for this environment. That has been illustrated in the chart below. -
- -
- - - -
-
-
-
- -
+
- This section provides an interactive graph that can be used to explore the computer, share, files, and identity relationships. This functionality is still experimental. + This provides an interactive graph that can be used to explore the computer, share, and other relationships. Experimental.
 Selected Node: None
@@ -8678,7 +8701,7 @@ const ChartAcesIFOptions = { categories: categoriesc, }, title: { - text: 'Interesting File Count', + text: 'Interesting File Exposure', align: 'center', // Aligns the title, can be 'left', 'center', or 'right' margin: 10, // Adjusts the space between the title and the chart style: { @@ -8839,7 +8862,7 @@ const ChartFGPageIFOptions = { categories: categoriesb, }, title: { - text: 'Exposed File Count by Category', + text: 'Interesting File Exposure', align: 'center', // Aligns the title, can be 'left', 'center', or 'right' margin: 10, // Adjusts the space between the title and the chart style: { @@ -8947,7 +8970,7 @@ const ChartSharePageIFOptions = { categories: categoriesa, }, title: { - text: 'Exposed File Count by Category', + text: 'Interesting File Exposure', align: 'center', // Aligns the title, can be 'left', 'center', or 'right' margin: 10, // Adjusts the space between the title and the chart style: { @@ -9069,7 +9092,7 @@ const ChartDashboardIFOptions = { categories: categories, }, title: { - text: 'Interesting Files Count', + text: 'Interesting File Exposure', align: 'center', // Aligns the title, can be 'left', 'center', or 'right' margin: 10, // Adjusts the space between the title and the chart style: { @@ -9272,7 +9295,7 @@ ChartDashboardIF.render(); } }, title: { - text: 'Percentage of Assets with Excessive Privileges', // Updated chart title + text: 'Percent of Assets with Excessive Privileges', // Updated chart title align: 'center', style: { fontSize: '18px', @@ -9324,7 +9347,7 @@ const ChartDashboardRiskOptions = { categories: ['Critical','High','Medium','Low'] }, title: { - text: 'Share ACL Count by Risk Level', + text: 'ACE Count by Risk Level', align: 'center', // Aligns the title, can be 'left', 'center', or 'right' margin: 10, // Adjusts the space between the title and the chart style: { @@ -9478,7 +9501,7 @@ const chartOptions = { } }, title: { - text: 'File Name Category Distribution', + text: 'Interesting File Exposure', align: 'center', // Aligns the title, can be 'left', 'center', or 'right' margin: 10, // Adjusts the space between the title and the chart style: {